Schedule

Infrastructure whose failure scenarios result in catastrophic cascading failures that can lead to loss of life, extensive environmental impacts, and loss of organisational or government reputation.

In this session, we will examine the five-year journey an Australian major hazard facility embarked upon that resulted in the safe adoption of automated ways of working. You will see how a risk and business centric approach, underpinned by SABSA and functional safety engineering standards (IEC 61508/61511), increased process maturity, uplifted capability, removed people from harm’s way, reduced operational risk by a factor of 10, and modernised work management.

We will discuss use cases C-suite and plant managers care about (hint: it’s not configuration management), COTS vs. inhouse development, pre-requisite logical services required to ensure human and computer instantiated workflows remain distinguishable, the “physics” of maintenance debt and its impact on organisational change management, as well as the challenges associated with event-driven automation and extending orchestration to the physical world.

All concepts discussed will be related to a vendor neutral “just in time network administration” capability we build throughout the presentation culminating in its implementation through a live demo.

During my CISO career I have witnessed how security teams operating without proper data context make decisions based on assumptions rather than data and evidence. They deploy controls that do not match actual risk scenarios, prioritize threats that are not present in their environments, and end up missing actual gaps they should be addressing.

The presentation examines how context transforms the effectiveness of your security program. Through case studies from other companies as well as my own teams, I will demonstrate how data driven approaches make threat modelling, incident response, risk assessments and other
security functions more efficient and impactful.

Key takeaways will include strategies for building context-driven security functions, establishing engagement channels that help your teams focus on what matters, and creating processes grounded in data rather than the industry hype.

But.

If the very most important of them, the Big Kahuna, makes it known to you that they have their complete and undivided attention on you and the answers you are giving them, then you had better make sure those answers are succinct, accurate and simple enough to pass the smell test on any concern that they are very, very much interested in, that very, very much matters to them personally, and in whose opinion they are very, very much heavily invested.

Fortunately, SABSA provides you with the very tried and true method to withstand such scrutiny when this situation befalls.

In this presentation, we will provide a real case study where the high-roller stakeholder took control of the discussion, posed employment-defining questions to the presenters, and how SABSA was deployed to seize the initiative and win the day.

Manifesting from the digital realm, cybersecurity is rich in the traits that make risk analysis difficult. This is compounded by large, highly complex and interconnected systems characterised by multiple many-to-many relationship along the attack chain: risks – vectors – vulnerabilities – actors – controls.

These inherent issues have important consequences for how cybersecurity teams design and implement their GRC and assurance frameworks. How can we optimise our risk posture, using our limited resources, when any adjustment without triggering the ‘butterfly effect’.
In this presentation, the speakers will explore recent developments in EA tooling that promise better visualisation of cybersecurity risk. While the virtual world might never become so tangible as to be familiar, it is becoming increasingly possible to immerse and interact with the virtual world and understand it more intuitively – offering a depth of situational awareness and understanding that few can achieve from a bookshelf of traditionally documented artefacts.

The session, which will include a practical demonstration, should be of value to a wide range of delegates that would be interested in what visualisation can contribute to security management.

This session is for those who feel that creating meaning from words is both a powerful and dangerous undertaking. These brave persons want to better would language for their work. It is also for anyone who enjoys a cheeky bit of wordplay.

Attendees will be exposed to principles and tools to help form robust attributes and demonstrate their utility for ESA. By the end of the session you will be drafting Attributes with the decisiveness of James Murray heading the Oxford Scriptorium.

This presentation will focus on how a data-driven comprehensive representation of the security fabric can drive faster and better decision-making. Using real-life case studies, we will highlight how the development of a single source of truth helps to identify actionable insights, simplify remediations actions and improve the risk position of the organisation. Most importantly, it becomes the foundation for the operationalisation of self-assurance across the estate which brings commercial benefit to the business through facilitating smooth and rapid delivery whilst also optimise the utilisation of the cyber security resources. 

Presenting from dual perspectives – that of a cub reporter hungry for clarity and a regional information ambassador advocating for purpose-driven stewardship – we explore how SABSA’s conceptual and contextual layers can be revitalised through ontological thinking. Together, we propose a shift in focus from static taxonomies to flexible ontologies, enabling organisations to navigate ambiguity, reinforce relevance, and transform data into embedded knowledge.

Key topics include:

• Data Cleansing as Stewardship: Neglecting this foundational step is like letting an under-11s football team run riot in your newly renovated house.
• Metadata’s Dual Edge: A potential gateway to insight – or a quiet amplifier of bias?
• OWL as Enabler or Encumbrance: Can the Web Ontological Language evolve from overhead to guardian?

We argue that embracing ontology allows SABSA to support intuitive, gut-driven decision-making with structured insight – particularly in organisations where data is the dominant, if not sole, asset. We outline a practical ontological model for SABSA’s conceptual and contextual layers, demonstrating how it can better reflect the real-world complexity that businesses face.

By the end of the session, attendees will be invited to reconsider the relevance of ontologies for modern security architectures – and perhaps reimagine what SABSA could become when data is understood not just as resource, but as relationship.”

Biometric authentication is being sold as progress. But beneath the promise lies a problem of permanence, precision, and power – who controls the data, who accesses it, and what happens when it’s wrong.

This presentation will examine:

• Why biometric data is inherently high risk, and why most storage and transmission models don’t treat it that way
• Real-world failures of biometric systems, from government IDs to commercial smartphones
• How biometric spoofing and false positives are exploited, even in mature deployments
• What effective biometric implementation actually looks like

Key takeaways:

• Biometric data is immutable – we cannot treat it like passwords
• Spoofing is practical, repeatable, and underreported
• Consent and transparency in biometric systems are mostly performative
• Most implementations trade off accuracy, auditability, or user rights – sometimes all three
• There are ways to deploy biometrics safely, but they’re expensive, complex, and rarely done properly

We started by profiling threat actors based on what they wanted, what they could do, and who they typically went after. Then we mapped their favourite tactics and techniques using MITRE ATT&CK as our guide. The interesting part came when we linked these attack patterns directly to existing security controls – suddenly we could see exactly where we had important gaps and where we were over-investing.

Weaknesses in recovery procedures, gaps in system dependencies and unclear operational resilience targets were revealed.

We could finally show leadership how specific threats connected to business risk and prove that our security investments were hitting the right targets. SABSA helped to remind us how we needed to create traceability throughout.

The accuracy, completeness and timely accessibility of the information required to determine the optimum way forward is more important than ever.

The session draws in from philosophy to  illustrate how ancient wisdom can be applied to cyber security and risk management. Will illustrate how Socratic method, an interactive technique for establishing knowledge, allows us to test assumptions through honest dialogue, think differently and ultimately guide us towards better understanding the implications of decisions that needs to be made. The audience will experience how to draw strength from contrarian thought, and utilise it as a tool for both establishing ignorance and knowledge.

Next, we’ll delve into techniques for writing and using effective security patterns, highlighting best practices and common pitfalls to avoid.

Participants will have the opportunity to understand how security patterns can be adopted in practice.

We’ll then examine how security patterns can enhance overall security and why they offer a more practical approach compared to relying solely on security standards.

Participants will learn the core steps for writing security patterns as part of the SABSA framework.

We’ll provide practical examples of a security pattern for AWS and how this is being applied in businesses to provide design assurance.

This session reframes traditional tabletop exercises, highlighting how process targeted digital twin environments, cyber ranges, and business aligned simulation models can enhance not just technical preparedness but real decision making, incident response coordination, and organisational insight. From the boardroom to the supply chain, attendees will gain insights in to how the use of real-world simulations can inform and evolve with the business to reflect enterprise priorities, regulatory obligations, and operational risks.

Designed for seasoned professionals, this session avoids prescriptive training models and focuses on reusable, strategic patterns for building human-centric resilience programs. Emphasis will be placed on architectural governance, lifecycle integration, and aligning with standards such as NIST SP 800-160, ISO 42010, and the Australian Government Protective Security Policy Framework (PSPF).

These factors have important consequences for how cybersecurity teams design and implement their governance, risk, compliance and assurance frameworks. We will argue that the new paradigm which is decentralised, where speed and accountability for decision-making are favoured over structures of centralised authority and control.

A pre-requisite of this kind of adaptive security is for decision making at all levels of the organization, which implies effective communications based on a common ‘source of‘truth’.

In this presentation, the speakers will present their experience of establishing a security architecture that reflects these aims and principles, based on control modelling, thresholds, and real-time security data.

The session should be of value to a wide range of delegates that may be facing similar challenges and would be interested in learning what an architectural approach can contribute to the solution.

This will be original content, being presented at conference for the first time.

Quite often left unattended these legacy systems or components may simply continue to work and that return on investment continues to pay off. Perhaps no longer with vendor support, scarce availability of parts (new or used), limited recovery methods or upgrade paths, lost expertise, or loaded with vulnerabilities with ever increasing risk (there it is again) as the environments and systems around them evolve and change. It’s a choice, and life isn’t always so simple.

There is another side to that coin. Those systems that today are considered the current norm, sometimes labelled ‘next gen’ or ‘cutting edge’. But where will they be in years or decades to come? Will they continue to work in isolation, can they be sweated as simply as those that came before? What of that lurking demon known as planned obsolescence?

When a button is pushed, or a key is turned the user expects something to happen. What happens when nothing now happens, all that presents is darkness, a blank screen, no sign of life, no change in state…this is the Fear of the Dark.

Pivoting from prior themes of a CISOs viewpoint through cinematic classics in previous COSAC presentations, your presenter delves into the societal problem that is largely being ignored in terms of longevity, resilience and risk.

This session will look at the unappreciated challenges faced by industry and society as time passes, where tech debt begins to transform into tech liability and sunken costs. At best impacting productivity, usefulness or choices, or at worst grinding operations to a halt and generating more and more waste with a material societal impact and significant financial cost.

The aim is to have a discussion with the audience on these ever-mounting issues in the short and long term, and how cyber security professionals and practitioners may manage these kinds of challenges in their own organisations, and within our broader personal lives.

In other words, can we find a way to reduce and navigate these lurking risks? Or will we keep “walking a dark road at night…a constant fear that something’s always near…fear of the dark….fear of the dark…”

As a former junior professional chess player turned SABSA enthusiast, I invite the audience to unpack the multifaceted aspects of architecting world class (chess) talent. Inspired by the Polgar sisters’ educational experiment which famously suggests geniuses can be made, this unique session explores how SABSA can model and sustain human potential.

The unique value proposition stands in the journey to understand how to measure intangible assets such as talent!!

Finally, is talent innate, or just a bunch of meticulously engineered factors? Join me as we dissect it, learn to measure it, manage risks around it and maintain it. Drawing on a decade of experience in competitive chess, I reveal successes, failures, lessons learnt and efforts to prepare for junior world championships and meticulous planning.

Getting it right the first time, while not impossible, requires more than just implementing a framework or methodology. Learn how to grow beyond just being a lean organisation, to one that is both Lean & Mean – making every resource/investment count and to move from being reactive to proactive in posture.

Those wishing to give a talk at the rump session must submit a short abstract, no more than one page long, according to one of the following procedures:

• Electronic submission: Send email to the rump session chair David Lynas at [email protected]
• Hardcopy submission at conference: Hand the submission to David Lynas at the conference before noon on Wednesday 25th February.

Submissions should include a requested amount of time for the presentation. An anticipated absolute maximum of four minutes will be allocated for each presentation.

Join us in person for an exciting dive into AI Architecture in 2026 and beyond. This forum is your chance to connect with passionate professionals, explore cutting-edge ideas, and get ahead in the AI game. Whether you’re a seasoned architect or just curious about the future, this event is packed with insights and discussions and networking you won’t want to miss.

Welcome to The SABSA Institute – SABSA World Forum – where minds meet and ideas flow! Join us in-person for a unique breakfast event at COSAC APAC 2026, that brings together experts from around the world to delve into the ever-evolving world of security architecture.

At the TSI Forum, The SABSA Institute (TSI) and the TSI Liaison Group (LG) will provide their latest updates.

Our special guest of The SABSA Institute will be SABSA Master Dr Malcolm Shore.

Dr Shore is the creator and trainer of the latest TSI-approved Security Architecture Course, “Architecting Secure AI” and an industry leader in SABSA, Cyber, Cloud and Enterprise Security Architecture.

Dr Shore has recently released a number of webinars and insights on AI Architecture and will be on hand to discuss the latest in developments and be available in an open floor session to answer your questions about Architecting Secure AI, the AI Security market evolution and latest developments, AI Training, AI Return on Investment and Securing Business Value and much more.

You can watch Dr. Malcolm Shore previously discuss AI Architecture here: https://youtu.be/5-qdiojay-s?si=lnZ6Cwatje8s_49c

Agenda:

• Introduction to TSI (for non-members)
• The SABSA Institute update
• Guest Speaker – Dr Malcolm Shore – AI Architecture 2026 and beyond
• Questions & Answers session
• Networking: Meet the SABSA Institute Board of Trustees and Liaison Group Members

Date:

Thursday Feb 26th 08:00 – 09:30 – Breakfast Event

Location:

Collins Square Business and Event Centre, Level 5, Tower 2/727 Collins Street, Docklands, Victoria, 3008

Eventbrite Registration:

https://www.eventbrite.com/e/the-sabsa-institute-forum-melbourne-ai-architecture-in-2026-and-beyond-tickets-1982206728685?aff=oddtdtcreator

Many practitioners come out of self-study or training armed with new skills, but struggle with applying them in complex situations and under tight time frames. Not to mention, there may be a limited number of practitioners in their organization (or region for that matter) to learn from. The primary goals for this session are to build relationships with other practitioners, to learn from each other on different ways to apply techniques to solve problems, and setup situations where we can creatively apply and adapt our skills. This is not a session where you will sit and listen to a presenter telling you how to do something.

Past attendees of the Design-Off have marked this as one of the highlights of the conference and we hope you will leave feeling the same way. Each year we feature a unique customer and problem set, so if you have attended in a previous year, be assured that this year will present a new and different challenge. This year we have several tweaks planned based on feedback from past attendees that we think will further enhance the experience!

Teams are made of people with different skill sets and skill levels, and team members will be actively engaging each other and trying to find the best way to meet the challenges. This is not a competition in using a specific formal methodology or framework (although they will definitely come in handy), but is meant to be an exercise in applying these techniques in a ways that most effectively meet the client’s needs.  Each year’s winners proved their mettle through several challenges, demonstrating skills in listening to clients, applying risk management, demonstrating business value, and effectively communicating with the client. There can be only one winning team, however all participants will learn from the experience. Where else can you see how different groups of high level security practitioners apply their skills to address the same problem? That said, you will want to win this! The winning team members not only get bragging rights, but will be announced on the SABSA LinkedIn group, and each member will receive a personal acknowledgment on LinkedIn congratulating them on their achievement! Other spot prizes will be awarded by the moderators in addition to this to recognize outstanding efforts of participants.

A few of the hardest problems SABSA architects face are working alone, and getting started where there are challenges.   These design workshops not only build teams from people who may have never worked together before, they challenge the groups to quickly overcome challenges to deliver actionable architecture quickly.  It can be done; this activity proves it.

AI, quantum computing, machine learning, security staffing, privacy, compliance, incident handling, ransomware, … the list goes on and on.  Forum delegates are always learning, willing to listen to and learn from others who’ve encountered things they might not have, definitely not shy about sharing opinions, strategies and techniques, and committed to our strange and but very necessary profession.

With moderating by a not-quite-extinct security dinosaur, you and your peers will experience a full-day immersion in the COSAC APAC way.  Moderator questions or comments on associated issues and related publications can produce very different reactions from the crowd. Participants cast their own light on raised topics based on constraints, objectives, tools, techniques, hidden land mines and final outcomes. We all learn from each other.

Come join us and help solve the current and maybe future information security problems of the world.

We’ll use the datasets to augment a standard Generative AI Large Language Model (LLM) and attendees will learn how to prepare the system prompts necessary to drive its operation. To conclude the workshop, attendees will prepare their augmentation dataset, select their preferred LLM, and use their AI Fast Track Agent to prepare a fast track deliverable for a project.

Attendees are encouraged to work in groups and participate hands on in each practical lab throughout the course of the workshop.