Schedule

COSAC APAC 2027

Tuesday 23rd February

Tuesday 23rd
08:30-09:00

Registration & Coffee
Tuesday 23rd
09:00-09:20

COSAC APAC 2027 Chairman's Welcome
Tuesday 23rd
09:30-10:15
Can AI Replace A Security Architect?

Session 2A

Much of the momentum in technologies, plans and investment is being driven by the belief that Artificial Intelligence (AI) will either make our jobs easier or replace us. The role and responsibilities of the security architect, needs to adapt to the continuing and accelerating changes to the: evolving threats; business opportunities and partnerships; supply chains; service delivery; and all the technologies involved to achieve success.

The use of AI has become an integral part of doing business in many organizations with promises of becoming much more. How will AI impact the important work of the security architect? We asked AI this very question and received some interesting responses.

A Certified SABSA Security Architect has attained a recognized level of capabilities to leverage the SABSA methodology in solving business risk issues. Can AI be used to augment or in some cases be used as a substitute for some of these capabilities? Can AI be used to help a security architect attain some of these capabilities? We will answer these questions and use some real-world examples to illustrate what AI can, cannot and should not do to support a security architect. AI is appearing more often in SABSA Advanced exam submissions, but the results have so far not been what you might expect.

This session provides answers to the principal question from both AI itself and from practitioners and exam reviewers perspectives. When asked, AI has provided several interesting points on what AI can do to support or replace a security architect and what it cannot do. We will present and parse the responses and provide a consolidated analysis and summary for consideration. We will also provide several observations and analysis of instances where AI may have been a factor in SABSA advanced exam submissions and what the results have been. A main issue is that AI is very confident and convincing and does not know when it is wrong. We will identify the factors that inhibit AI from being effective in security architecture development and delivery. Understanding some of these limitations is essential to realize when AI may be leading you astray and when it hallucinates (it does). Although AI can be leveraged to very effectively support a security architect, it will not likely replace us now, or in the near future (if ever?).
Speaker(s)

Glen Bruce

Cybersecurity Consultant, GDB Cyber Security Consulting (Canada)

In his 50+ years of in-depth experience in IT and security consulting, systems management and technical implementations, Glen Bruce has focused on Security Frameworks, Strategies, Architectures, PKI and Governance supporting business and governments in their approach to managing information and cybersecurity risk. He has led many information/cyber security engagements, where he has helped clients establish effective strategies, governance, architectures, frameworks, policies, PKIs and infrastructure implementations in support of a wide range of business and technical requirements. Glen is the leader of the TSI SENC workgroup project and the Chair of the TSI SABSA Institute Testing Board (SITB).
Stairway to Heaven, Pathway to Vulnerability: Evolving Static Safety Frameworks for Adaptive Cyber Threats

Session 2B

In the quest to secure increasingly complex, software-driven systems, the cyber security industry has looked to established safety engineering frameworks for inspiration. In recent times, the giant leaps within artificial intelligence and in particular large language models such as Claude Mythos, which introduce unpredictable emergent behaviours and complex system-level risks, this need is ever more urgent.

System safety tools like Failure Mode and Effects Analysis (FMEA) and System-Theoretic Process Analysis (STPA) have long been the standards for identifying component failures and hazardous system interactions, making them highly appealing for mapping modern cyber-physical architectures. All that glitters is not gold, and so “gold standard” safety tools are not a silver bullet for cyber defence. However, this does not mean they should be overlooked or disregarded.

Naturally, this begs the question: How can these frameworks be enhanced to accurately map out and combat modern cyber security risks?

This presentation delves into the fundamental mismatches between traditional safety engineering and the realities of active cyber threats. While FMEA excels at mapping known, physical component wear-and-tear, it lacks the capability to anticipate an intelligent, adaptive adversary who actively exploits logical vulnerabilities. Similarly, while STPA shines at mapping complex system control loops, its static safety-control structure must be augmented with iterative threat modelling to prevent paralysing complexity and offer actionable security controls.

The session aims to dissect the core assumptions of both frameworks, demonstrating why they require a shift towards adversarial threat modelling to handle the unique paradigms of cyber security—such as the rapid velocity of exploit development, the asymmetry of defence versus attack, and the shift from “component failure” to “malicious intent”. Attendees will leave with a nuanced understanding of where safety and security overlap, why FMEA and STPA cannot simply be applied to cyber defence without accounting for adversarial adaptability, and how to integrate responsive risk methodologies to build more resilient, threat-informed security architectures.
Speaker(s)

Steven Kintakas

Practice Lead - Architecture, Astralas (Australia)

Steven is a cyber security professional with a career spanning over 24 years of experience across a range of industries including finance, energy & utilities, resources, transport, manufacturing, government, health, education, and telecommunications.

Practice Lead of security architects at Astralas, Steven is a practitioner and leader focused on building trust. In providing business-driven and outcome-based value to manage risk effectively, Steven has contributed to the improvement of cyber risk management across many ASX-listed companies and some of Australia’s largest organisations in fields such as security architecture & strategy, managed services, incident response, research and development, and technical solutions and controls.

Previously a Director and sector leader within Deloitte Australia’s Cyber practice, he has also held various leadership and technical positions at Computer Associates, CGI, Fujitsu Australia, Dimension Data, and Zimbani.

A Deakin University alumnus, having double-majored in computer science and information systems, Steven’s post-nominals include: SCF, CISSP, CCSP, CISM, CISA, and CDPSE.

Steven is Vice President of the ISACA Melbourne Chapter, a return speaker to the COSAC conference having previously presented in Ireland & Melbourne, and a regular speaker at AISA’s Australian Cyber Conference.

An avid supporter and member of the Geelong Football Club, he is passionate about enjoying good food & drink (in particularly wood-fired cooking) with his family and friends.
Tuesday 23rd
10:20-11:05
Beyond Secure by Design: The Agentic Security Architect

Session 3A

Security architecture has traditionally relied on experienced practitioners interpreting requirements, selecting controls, assessing risk, and guiding delivery teams through complex decision-making. But what happens when AI can perform much of that work automatically?

This session explores the emerging frontier of AI-driven security architecture and how organisations can move from manual, point-in-time architecture reviews to continuously operating, machine-assisted security decision engines. We will examine practical approaches for converting architecture standards, patterns, threat models, and control requirements into automation that can assess designs, identify gaps, generate recommendations, and provide real-time security guidance at engineering scale.

Drawing on lessons from large-scale security architecture and controls assessment programs, the session will explore where AI can genuinely augment architects, where human judgement remains essential, and how organisations can build trusted, governable automation without sacrificing risk management discipline.

Attendees will leave with a vision for transforming security architecture from a human bottleneck into an intelligent, scalable capability that accelerates delivery while improving security outcomes.
Speaker(s)

Ross Mackenzie

Head of Security Controls Asessment, Westpac Group (Australia)

Ross MacKenzie has over 25+ years of cybersecurity experience, which has included roles across security architecture & design, security governance and cybersecurity risk.

Ross is currently the Head of Security Controls Assessment within the Information Security Group at Westpac. This role is responsible for security consulting (secure by design), application security, penetration testing, and cyber hygiene (vulnerability and patch management). Prior to this role, Ross led the Security Architecture & Design function at Westpac that was accountable for both enterprise and solution security architecture across Westpac Group.

Ben Ley

Senior Manager - Secure by Design, Westpac Group (Australia)

Ben Ley currently leads the Secure by Design practice for Westpac Group, having spent time leading and being part of a diverse set of teams across various aspects of cybersecurity including security architecture, security engagement and coordination, and detection & response. His experience on the journey of developing and growing a cybersecurity function within a large organisation, Ben has a keen interest in how this growth has presented new challenges and opportunities to embed cybersecurity at the heart of each person when they come to work, and outside of work. When not at work, you’ll find Ben out on two wheels both on and off road, having participated in a number of charity cycling events to raise money and awareness for Cancer research with Tour de Cure, a cause close to his heart.
Digital Safety - Protecting Consumers Responsibly

Session 3B

At COSAC Ireland 2023 Andy Prow first introduced the concept of Digital Safety and argued that consumers of technology products should reasonably expect suppliers to be able to state that their products are verifiably Digitally Safe from the point of that product’s sale until its withdrawal from manufacture, supply and support.

COSAC speakers and delegates are well placed to explore this problem. Our conference has a rich history of highlighting the poor security practices identified in consumer systems, particularly IoT devices, such as revealed in the COSAC 2011 presentation “Can I trust my television?”. So, what defines products as Digitally Safe, and how can we measure it?

Prow’s further joint work with David Lynas presented at COSAC APAC 2025 Architecting Digital Safety, triggered the formation of a small multi-disciplinary team from the UK, EU and New Zealand to consider how we might practically measure Digital Safety. As a start point, we chose to
concentrate on Smart TVs and streaming systems. Our research journey has not always been straightforward* but we now have a practical structured approach that we have used to iteratively decompose a target of evaluation into key components and produce a dependency model that we can analyse and measure successfully.

Now we understand the art of the possible, we will propose the steps that responsible suppliers should follow to make consumers safer. While compliance with emerging national minimum cybersecurity standards is a step forward, having a published independent measure of a product’s
Digital Safety rating is a logical extension of our work.

*Full disclosure – we used some AI assistance along the way … we’ll let it explain in some detail how that worked out.
Speaker(s)

Andy Clark

Director, Primary Key Associates (UK)

Prof Clark is an acknowledged expert in Cryptology, Systems Engineering, Information Forensics and Cyber Security. He has worked in the field of Computer and Information Systems Security and Cryptology since 1984 and is a registered expert witness with more than twenty years’ experience of presenting computer and information systems evidence in a wide range of criminal & civil cases. He is a co-author of the SABSA Blue Book and was the first recipient of the COSAC award.

Steven Bradley

Consulting Security Architect, Cyber Enterprise Modelling (Belgium)

Steven is a Belgium-based independent security consultant at Cyber Enterprise Modelling (CEM) and has been a regular presenter at COSAC since 2018 on the topic of security by design through automation and modelling.

He is the principal author of the SABSA Institute / Open Group paper “Modelling SABSA with ArchiMate” and chairs the associated SABSA Working Group.

He holds several security, architecture and privacy certifications including both SABSA Chartered Practitioner certifications and a contributor to the forthcoming ArchiMate Next.

Nigel Hanson

Expert Cybersecurity Engineer, Caterpillar Trimble Control Technologies (New Zealand)

Nigel is a cybersecurity engineer specialising in OT/ICS product security for heavy machinery. He has over 20 years’ experience across product, systems engineering and security roles within the Trimble family; a path that runs from developing some of the world’s first machine guidance systems in the 1990s to securing the autonomous machines of today. He is a specialist in Software Composition Analysis, SBOM generation and management, and the practical application of the EU Cyber Resilience Act. He serves on a number of AppSec product advisory boards and is a founding member of the Digital Safety initiative (digitalsafety.org), which prioritises the remediation of vulnerabilities capable of causing physical harm.
Tuesday 23rd
11:05-11:25

Morning Coffee
Tuesday 23rd
11:25-12:10
The Approval Remains. The Judgement Has Moved

Session 4A

Our control models assume judgement forms where authority sits. Work moves through a process, someone forms a view, an approver decides, and controls attach to identifiable decision points. That model works because judgement, authority and observable action are expected to line up.

AI changes that.

By the time a human approves an AI-enabled recommendation, the interpretation, prioritisation, framing and options may already have been shaped elsewhere. The approval is still visible. The judgement may no longer be.

The issue is not simply whether we need more controls around AI. It is whether our security, governance and assurance models are still attached to the places where consequential judgement accumulates. When they are not, we place confidence in evidence that no longer reflects where judgement occurred, while constraining the capabilities we invested in AI to create.

I will put three propositions to the room:

The approval record may be the strongest evidence we hold, while documenting the point where the least judgement now occurs.

A control attached to the point of authority is not necessarily attached to the point of judgement.

Organisations pursuing AI-enabled outcomes while preserving pre-AI control anchors risk constraining the value they seek while creating gaps in the assurance they rely on.

The debate is not whether human accountability disappears. It is where control, authority and assurance need to sit when judgement no longer sits neatly beneath them.
Speaker(s)

Francine Hoo

Independent Advisor, Francine Hoo Pty Ltd (Australia)

Francine Hoo has more than 20 years’ experience across AI, data, governance, compliance, risk and transformation in highly regulated organisations. Most recently, as a Director at KPMG Australia, she co-created its Local Government AI Marketplace and designed Responsible AI, data and AI governance, and assurance approaches across superannuation, government, energy, mining, financial services and retail, including work with a multilateral development institution. Previously, Francine held enterprise data governance responsibilities and was a senior regulatory manager at ASX, leading major regulatory framework and transformation programs. She has also served as Head of Trustee Risk & Compliance and as a Board Director.

Her work now focuses on how organisations can realise the capabilities AI enables while redesigning the governance, operating models and controls needed to support them.
The "Hidden" Dependency: Mapping Space to SOCI

Session 4B

Modern critical infrastructure sectors—from energy to finance—rely on an invisible, high-altitude backbone: orbital assets. While the SOCI Act (Security of Critical Infrastructure) has expanded to capture essential services, our regulatory framework remains tethered to the ground, often treating space-to-ground infrastructure as a peripheral service rather than a primary critical asset.

This session challenges the assumption that our current legislative posture is sufficient to secure the orbital systems upon which our national sovereignty depends.

This session moves beyond theoretical compliance to address the real-world operational risks of space-based dependency. We will dissect the current legislative gaps in the SOCI Act and move immediately into a high-stakes workshop. Participants will be split into “Regulators” and “Space Operators” to draft a “Model Amendment” that mandates effective, pragmatic security requirements for space-to-ground links without stifling innovation.

This is not a lecture; it is a collaborative audit of our national resilience. Be prepared to argue, challenge the status quo, and help redefine how we protect the most critical infrastructure in the sky. If you are responsible for organizational risk or regulatory compliance, you cannot afford to miss this mapping of our most significant blind spot.
Speaker(s)

Sandeep Taileng

Director, Cyber In Space (Australia)

Sandeep Taileng is an accomplished cybersecurity executive and strategist with over 20 years of experience across finance, critical infrastructure, and government sectors. Currently, he serves as the Information Security Leader and CISO at State Trustees Limited in Victoria, Australia.

Recognized as a Top 50 CISO in 2024 and 2025 and a finalist for the Australian CISO of the Year in 2025, Sandeep’s career is defined by his commitment to technology risk management and information security. Previously, he held leadership roles at major organizations including EnergyAustralia, AMP, and Telstra.

Sandeep is a recognized specialist in space cybersecurity, focusing on the security of satellite constellations, ground systems, and orbital infrastructure as matters of global digital sovereignty. He is the founder and non-executive chair of CyberInSpace, a boutique consultancy bridging the gap between Australian space security and international defense markets.

Beyond his corporate leadership, Sandeep is a dedicated advocate for cybersecurity standardization, chairing key initiatives within the IEEE Standards Association, including the IEEE Global Hackathon. He holds honorary academic positions at the University of Melbourne and Monash University and is a passionate advocate for community-based cyber awareness, particularly through digital safety programs for senior citizens. Sandeep holds an educational background in electronics engineering and qualifications in enterprise risk management.
Tuesday 23rd
12:15-13:00
Beyond AI Generated Verbose Verbiage: Moving Vibe Proposals to Actionable Architecture Artefacts and Hopefully Implementable Designs

Session 5A

AI-enabled tools are making it easier to produce long, polished and persuasive proposals. Unfortunately, many of these proposals are “AI produced”: verbose, confident, difficult to trace, full of internal links or references that humans cannot easily follow, and light on actual solution detail.

For architects, this creates a new assurance problem. The issue is not whether the document reads well. The issue is whether the proposal can be converted into evidence, decisions, controls, risks, dependencies and actions that specialist teams can review.

Very much a work in progress, this explores how to combine and build workflows for converting AI-generated or AI-assisted proposals into structured architecture review artefacts. Using retrieval-augmented generation, vector search, specialist review agents and quality evaluation checks to extract the material needed by the proposers, architecture(s), business and BAU teams. Rather than asking humans to reverse-engineer flowery prose, the workflow asks: what is being proposed, what is missing, what is assumed, what decisions are required, what controls are implied, and who needs to act.
Speaker(s)

Darren Skidmore

Enterprise Security Architect, Toll Group (Australia)

Darren is a Security Architect at a Global Logistics Organisation. He has worked in Security Architecture and other Security roles with major Australian and International companies and the public sector. Darren has presented at local, and International conferences as well as authored academic papers on topics from Security Architecture, Law, value in Open Source and ICT evaluation. He is an active member within the Australian Security Profession, including the SABSA working Group: Modelling SABSA in ArchiMate, and SABSA TSI APAC.
From LockBit to Liquidation: What Happens When You Lose Someone Else's Data

Session 5B

In April 2023 a Brisbane telemarketer was hit by LockBit ransomware. The company was unremarkable. What made the breach matter was what it held: the donor records of more than 70 Australian charities, collected on their behalf and retained long past any purpose. Within months the data was on the dark web, the regulator was investigating, and the company no longer existed.

I ran infrastructure through that incident. This is not another breach narrative. It is an argument: that the controls our profession obsesses over (detection, EDR, response runbooks) would have changed almost nothing here, and the one control that would have, ruthless data minimisation and clear custody of third-party data, is the one nearly everyone treats as someone else’s problem.

I will walk the timeline and the decisions made under pressure, then make the uncomfortable case that senior practitioners are spending their attention in the wrong place. Expect to disagree. The session is built for argument, not applause, with most of the time spent testing the thesis against your own environments and the third-party data you are quietly accumulating right now.
Speaker(s)

Christian Kissane

Head of IT and Cybersecurity, Hypersonix Launch Systems (Australia)

Christian Kissane is Head of IT and Cybersecurity at Hypersonix Launch Systems, an Australian aerospace and defence company. He holds CISM and CISSP, is completing a Master of Information Technology at QUT, and is responsible for cybersecurity governance, IT operations, and compliance across a defence environment with NIST 800-171, DISP and ITAR obligations. Before Hypersonix he was IT Infrastructure Manager at Pareto Phone, where he was on the ground during the 2023 LockBit ransomware attack and the data breach that followed, affecting more than 70 Australian charities. His background spans incident response under pressure, third-party data governance, and building security capability in growing organisations.
Tuesday 23rd
13:00-14:00

Lunch
Tuesday 23rd
14:00-14:45
COSAC Risk Workshop: Using AI to Enhance Enterprise Risk Management

Session 6A

The purpose of the risk workshop is to explore the hard parts of understanding risk. We have previously conducted workshops in Ireland and Australia on how to understand and model risk, how to explain and display risk to stakeholders, and how to think like our adversaries to identify threats that we would otherwise miss.

This year we will discuss the emergence of AI and how it is being used as a tool by cybersecurity professionals as well as how it is being used by our adversaries. This will include discussion on the impact of AI on our ability to perform different enterprise risk management or Cyber Risk activities. For example, using AI to review logs, enhance the completion of risk assessment or review vulnerability information. There are many vendor based solutions now touting “AI”, but this discussion will focus more on how we can build an enterprise risk management strategy that capitalizes on different AI capabilities. This is not prompt engineering for generative AI, although that could be a component of the strategy. As a group we will discuss and develop an enterprise approach for leveraging AI capabilities to improve our ability to manage enterprise risk.

AI is a rapidly developing field that will likely have new capabilities available when we meet at COSAC that may not exist at the time of writing this abstract. Being aware of, and able to take advantage of these capabilities will allow us to make better use of them. Our adversaries are using AI, so should we.
Speaker(s)

William Schultz

Senior Director, Cybersecurity, Vanderbilt Health (USA)

Bill Schultz is a seasoned security architect with more than two decades of experience advancing cybersecurity, enterprise security architecture, and risk management disciplines. A SABSA Master–certified architect, Bill has built and led security and risk management programs, developed organizational and system level architectures, and guided enterprise wide security and risk initiatives. His work focuses on maturing security capabilities, effectively managing risk, and aligning technology decision making with long term business outcomes.

Jason Kobes

Sr. Staff Cyber Architect & Research Scientist, Northrop Grumman Corporation (USA)

Jason Kobes works as a Sr. Staff Cyber Architect & Research Scientist in Washington, DC for Northrop Grumman Corporation. Jason has over 25 years of experience concentrated in security digital transformation, systems engineering, information systems design analytics, business/mission security architecture, enterprise risk management, information assurance research, and using AI for automation. Jason has a Master’s of Science in Information Assurance (MSIA) and a Bachelor’s of Science in Computer Science from Iowa State University. Jason holds a SABSA Practitioner of Risk and Governance as well as Architecture. Jason’s areas of research include enterprise risk architecture, accountable anonymity systems and applying actionable enterprise security architecture.
Who Pays for the Robot Analyst? Drawing the Autonomy Boundary in the Agentic SOC

Session 6B

Most SOC automation debates start with trust: what can we safely let AI do? This session argues that trust is only half the boundary — and sometimes not the binding constraint. In agentic SOC design, autonomy is also an economic decision.

Some alerts justify deep agentic investigation; others are cheaper, safer, and more accountable when handled by analysts or
narrow automation. Early data from live agentic SOC work — spanning analyst-heavy and SOAR-assisted operations, initial AI deployments, and architectural modelling — suggests for a meaningful portion of the queue, the unit cost of full AI investigation can exceed the labour it
replaces.

This session introduces an Autonomy Boundary model for deciding where human, cheapautomation, and full-agentic handling should sit across alert criticality, evidence quality, blast radius, and unit cost. Get that boundary wrong and you do not just overspend; you manufacture
the very failure modes AI was meant to reduce: alert laundering, compensatory automation, and false confidence.

Participants will work a realistic alert mix with costed investigation paths, business criticality, and response risk. You will draw the boundary, defend it, and challenge everyone else’s. The debate: should SOC autonomy be governed by technical capability, risk appetite, or the
economics of investigation?
Speaker(s)

Dr. Pierre Tagle

Head of Digital Identity and Zero Trust, DXC Technology (Australia)

Pierre Tagle, Ph.D., is an esteemed Information Technology and Cybersecurity professional with over 20 years of experience encompassing extensive consulting, executive
management, and 24×7 operational roles across diverse sectors including government, financial services, manufacturing, not-for-profit and academia. Dr. Tagle is adept at
translating complex security concepts into actionable strategies for both business and technical stakeholders, and is recognized for his analytical acumen and innovative approach to cybersecurity. He holds a Ph.D. in Computer Science and numerous prestigious certifications such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, PCIP, and CDPSE.

In his current role as DXC Technology’s Head of Digital Identity and Zero Trust for Australia and New Zealand, Dr. Tagle leads a team that expertly balances business needs with risk mitigation and cost-effective security solutions. He leads team of close to 50 SMEs covers all four of DXC’s Security service pillars. This includes Cyber Risk & Compliance, Digital Identity, Infrastructure, App & Data Protection, and Cyber Transformation & Operations. Prior roles includes leading advisory and consulting teams in Secureworks and Sense of Security (now part of CyberCX).

His own direct work spans several critical areas including security strategy and roadmap development, compliance and maturity frameworks management, IT and OT security, and business continuity planning. Dr. Tagle’s leadership not only drives the strategic direction of security practices but also fosters a culture of accountability and continuous improvement within his teams.
Tuesday 23rd
14:50-15:35
You Don't Hate the 5x5 Matrix Enough - Quantification When You Must Use A Matrix

Session 7A

The 5×5 risk matrix is one of the most widely used tools in risk management and one of the most heavily criticised. Yet despite its shortcomings, many organisations continue to rely on it because governance loves simplicity, and boards love three colours.

This session isn’t another argument for abandoning the matrix. Instead, it explores how to make better risk decisions when you’re required to use one.

We’ll examine why the seemingly simple risk matrix can produce inconsistent and mathematically illogical outcomes. What you can do when you want a more quantitative decision made. How you can avoid some of these hidden flaws that can undermine confidence in the advice we provide to stakeholders. I’ll walk you through a practical approach to introducing quantification within an existing matrix-based framework, improving consistency and making risk decisions more defensible without changing your organisation’s established methodology.

Risk has a shape, it’s a triangle. You will see it can fit it into a 5×5 square hole.
Speaker(s)

Jade Hughes

Business Information Security Officer (BISO), The Lottery Corporation (Australia)

Jade Hughes is a BISO at The Lottery Corporation, with a background in security engineering and architecture, across financial services and consulting and now gaming. His current focus in his BISO role is working on bringing security to the table for the digital business unit, supporting and guiding their decision making from a risk and security perspective.
Beyond Zero Trust: Building the AI Trust Fabric for the Autonomous Enterprise

Session 7B

The advent of frontier AI has fundamentally transformed the cybersecurity landscape, enabling attackers to automate reconnaissance and exploit vulnerabilities at unprecedented speeds, collapsing threat timelines from months to mere minutes.

In this new era, traditional perimeter-based security is no longer sufficient, and the challenge of securing a rapidly expanding ecosystem of non-human identities – including machines, APIs, and autonomous AI agents – is paramount.

This session will explore how Zero Trust must evolve into a continuous, AI-native, identity-first trust, dynamically applied across every human, machine, and AI agent within the enterprise. We will introduce the concept of the AI Trust Fabric: a crucial architectural layer designed to sit between users, applications, and all AI models, ensuring secure, governed, observable, and compliant AI interactions. Learn how this fabric mediates all AI operations, enforcing identity-based controls, continuous verification, and proactive defense against emerging agentic threats, thereby transforming identity from a potential vulnerability into a strategic advantage for the autonomous enterprise.
Speaker(s)

Abbas Kudrati

Regional CISO - APJ, F5 (Australia)

Abbas Kudrati is the Regional CISO for Asia Pacific and Japan (APJ) at F5, where he serves as a trusted advisory partner to boards, CISOs, and executive leadership teams on securing modern application architectures, APIs, and AI systems. With over two decades of global cybersecurity experience—including past roles as the Regional Chief Identity & Security Advisor at Silverfort and Chief Cybersecurity Advisor at Microsoft Asia—Abbas has spent his career translating complex technological disruptions into secure, business-enabling strategies.

Abbas is a widely recognized expert in Zero Trust Architecture (ZTA), Security Architecture, and Governance, Risk, and Compliance (GRC).

He is deeply engaged in steering the industry through its next structural hurdles: the security of autonomous AI agents (establishing AI Trust Fabrics to govern inline prompt, API, and model interactions) and enterprise readiness for Post-Quantum Cryptography (PQC) (operationalizing cryptographic agility and hybrid-PQC to mitigate Q-Day risks)

A bestselling author, Abbas has published several industry-defining books with major publishers like Wiley and CRC Press. His titles include:

Threat Hunting in the Cloud: Defending AWS, Azure and Other Cloud Platforms Against Cyberattacks

Zero Trust Journey Across the Digital Estate

Securing Cloud Containers: Building and Running Secure Cloud-Native Applications

Managing Risks in Digital Transformation

Alongside his executive role at F5, Abbas serves as a Professor of Practice at La Trobe University and is an active advisor to HITRUST Asia, EC-Council Asia, and emerging cybersecurity startups.

A Fellow of the Australian Information Security Association (AISA) and a passionate neurodiversity advocate, he brings a unique, cognitive-led perspective to solving the industry’s most asymmetric defense challenges.
Tuesday 23rd
15:35-15:55

Afternoon Tea
Tuesday 23rd
15:55-16:40
Cyber Sea Trial: Tracing Risk Ownership with SABSA in Maritime Defence Shipbuilding

Session 8A

Supporting the future littoral landing craft fleet to enhance Australia’s capacity to hold adversaries at risk and secure strategic terrain. A practitioner's account from within maritime cyber, the practitioner explores what happens when cyber assurance intersects with Defence shipbuilding, where design is still evolving, systems are not finalised, risks are presented without business context, and accountability is absent.

The session refrains from the conventional query, ‘Are the controls implemented?’ and instead focuses on the authorisation challenge that arises when clear system boundaries, risk ownership, evidence, and accountability are lacking.

Utilising SABSA, the session:

Provides practitioners with a reusable method to expose and resolve cyber risk ownership gaps
in complex programs

Brings fresh thinking to the maritime shipbuilding sector, where cyber maturity is still
developing; addresses authorisation decisions as maritime designs, boundaries, ownership,
and evidence continue to take shape

Reframes the Authority-to-Operate process by integrating mission outcomes, stakeholder
concerns, business attributes, control objectives, evidence, and authorisation positions into a
single, traceable risk narrative

Presents a distinctive cyber sea trial scenario to evaluate the vessel’s cyber risk narrative,
where objective quality evidence must evolve alongside the design
Speaker(s)

Marcel Krawczyk

Cyber Security Principal, Bastion Defence Consulting (Australia)

Marcel Krawczyk is a Defence-aligned cyber security professional, security assessor, and architecture practitioner with extensive experience in delivering risk management, assurance, and accreditation outcomes across Australian Government and complex Defence environments. He currently works as a Cyber Security Principal at Bastion Defence Consulting, where he helps translate risk appetite, policy requirements, and mission priorities into practical security requirements and develop uplift strategies aligned with business outcomes.

Marcel has worked across some of Australia’s most sensitive and strategically significant environments, including Defence Cyber Command, Defence Digital Group, the Future Submarine Program, and the Australian Criminal Intelligence Commission. His experience includes producing security artefacts and authorisation briefs, conducting independent security assessments, guiding and advising system owners through an Authority to Operate process, and providing security architecture support through design assurance, control intent mapping, and risk acceptance. He has supported critical capabilities across cloud systems, Enterprise Resource Planning programs, Navy communications, Army operational simulations, drone development and Defence exercises.

A SABSA Chartered Architect with IRAP, CISSP, CISM, CRISC, and ISO 27001credentials, Marcel is recognised for translating complex cybersecurity concepts into practical, relatable insights for executives, engineers, and delivery teams alike. His work is grounded in real-world implementation, secure-by-design principles, and the challenge of embedding meaningful architecture and assurance into programmes where cyber maturity is still developing.
Must We Know Who You Are? Authorisation Without Identification for Humans, Machines & AI Agents

Session 8B

Modern security architectures increasingly treat identity as the foundation of trust. Yet every access decision that reveals, correlates or centralises identity also creates a surveillance surface, breach target and cross-domain dependency. The problem becomes sharper as non-human identities and autonomous agents multiply credentials, while post-quantum migration adds long-lived confidentiality and cryptographic-agility constraints.

This interactive session challenges the assumption that a requester must be identified before being authorised. It introduces Authorisation, a least-disclosure design method in which a human, workload or AI agent proves that it satisfies the policy for a specific action without exposing unnecessary identity attributes or creating a reusable tracking handle.

Participants will work through a cross-organisation incident scenario involving a human operator, machine service and delegated AI agent. Together, we will stress-test five design tensions: privacy versus accountability; unlinkability versus auditability; decentralisation versus governance; revocation versus anonymity; and cryptographic agility versus operational simplicity.

The audience will leave with an Identity Exposure Budget and policy-bound authorisation canvas that can be applied to zero-trust, multi-cloud and digital-ecosystem architectures. The goal is not to promote anonymity everywhere, but to identify where identity is genuinely required, where proof of authority is sufficient, and how investigation and control can be preserved when identity disclosure is deliberately minimised.
Speaker(s)

Ahmad Salehi Shahraki

Lecturer in Cybersecurity, La Trobe University (Australia)

Dr Ahmad Salehi Shahraki is a Lecturer in Cybersecurity at La Trobe University, where he chairs the Cybersecurity Industry Advisory Board and leads industry engagement in cybersecurity. He works at the intersection of academic research and industry practice, with a focus on privacy-preserving access control, digital identity, decentralised security, blockchain and Internet of Things security, and post-quantum readiness.

He has published more than 40 peer-reviewed works in leading cybersecurity journals and conferences. His current work addresses a practical challenge facing modern organisations: how to securely authorise employees, machines and autonomous AI agents across organisational boundaries without collecting or exposing more identity information than necessary.

His work translates formal security and privacy concepts into practical architectures, governance approaches and risk-based decision-making methods that can support organisations operating across cloud, digital ecosystem and multi-party environments.
Tuesday 23rd
16:45-17:30
Bridging Business and Cybersecurity: An Enterprise Security Architecture Journey in the Australian Energy Sector

Session 9A

As organisations navigate rapid digital transformation, increasingly sophisticated cyber threats, and evolving regulatory obligations, the need for a cohesive and scalable security architecture has never been greater.

This session presents the journey of an Australian energy company in establishing a practical, business-aligned Enterprise Security Architecture capability using the SABSA framework. It explores how SABSA has been leveraged as the strategic “glue” between business objectives, risk management, and technology delivery, enabling the organisation to address emerging business challenges while maintaining a resilient and adaptable security posture.

As new operating models, technologies, and energy market demands emerge, enterprise and security architects face growing pressure to deliver cybersecurity outcomes that are interoperable, reusable, risk-informed, and aligned to business priorities. Through practical examples and real-world artefacts, this presentation demonstrates how a SABSA-based approach has enabled the organisation to rapidly respond to:

Evolving business priorities, including the integration of Distributed Energy Resources (DER) and other emerging energy capabilities

The transition to a product-centric and agile delivery model supporting digital transformation initiatives

Alignment of digital products with industry standards and regulatory frameworks, including ISA/IEC 62443 and the Australian Energy Sector Cyber Security Framework (AESCSF v2.0)

Integration and synchronisation of security architecture artefacts across Business, Information, Application, and Technology architecture domains

An increasingly dynamic and complex cyber threat landscape

Attendees will gain practical insights into the artefacts, governance mechanisms, and architectural practices used to embed cybersecurity into enterprise decision-making and delivery processes. The session will demonstrate how SABSA can serve not only as a security architecture framework, but also as a strategic enabler that bridges business and cybersecurity, helping organisations achieve resilience, compliance, and innovation in complex and rapidly evolving environments.
Speaker(s)

Samuel Pinzon

Principal Cyber Security Architect, Western Power (Australia)

Samuel Pinzon is the Principal Cyber Security Architect at Western Power, a critical infrastructure provider in Western Australia’s energy sector. With almost two decades of experience in cybersecurity and enterprise architecture, Samuel specialises in aligning security strategies with business transformation initiatives, regulatory compliance, and operational resilience.

At Western Power, Samuel leads the development of a SABSA-based Enterprise Security Architecture, enabling the organisation to navigate the complexities of digital transformation while maintaining a risk-informed cyber security posture. His work focuses on creating reusable, interoperable cybersecurity artefacts that bridge the gap between business objectives and technical implementations.

Prior to join Western Power, Samuel worked for about 15 years in the Oil & Gas sector, where he supported the implementation of multiple cybersecurity solutions across both upstream and downstream operations as security architect. He also led programs to implement cybersecurity practices in operational technology (OT) environments, applying the standard IAS/IEC62443 standard.

Samuel holds industry-recognised certifications, including SABSA Chartered Foundation (SCF), ISA/IEC62443 Cybersecurity Expert, and TOGAF Foundation. He brings a pragmatic, business-aligned perspective to security architecture and is an advocate for using SABSA as a strategic enabler in complex environments.
Dropping the C-BOM: A Practical Playbook for Defusing the Post-Quantum Threat

Session 9B

This session presents a practical, tool-ready approach for identifying organisational exposure to post-quantum cryptographic (PQC) risk through enterprise architecture and cryptographic asset discovery.
The session shows how a canonical EA blueprint, utilising a cryptographic taxonomy specified in CycloneDX Cryptographic Bill of Materials (CBOM) format, can be used to create model of cryptographic material in the context an enterprise-wide IT landscape.

The model provides a top-level cryptographic inventory, revealing where quantum-vulnerable algorithms, unsafe cipher suites, and deprecated libraries reside in your technical estate: their proximity to exposes surfaces and which business assets most at risk.

Using dependency modelling and failure mode analysis, we demonstrate concrete, prioritized remediation and migration paths: where to apply hybrid or migration target algorithms, how policies and controls map to technical change, and how operational telemetry closes the loop between architecture and operations.

Attendees will leave with a reproducible method, PQC reference architecture patterns and a clear workflow for turning C BOM discovery into actionable PQC readiness plans.
Speaker(s)

Steven Bradley

Consulting Security Architect, Cyber Enterprise Modelling (Belgium)

Steven is a Belgium-based independent security consultant at Cyber Enterprise Modelling (CEM) and has been a regular presenter at COSAC since 2018 on the topic of security by design through automation and modelling.

He is the principal author of the SABSA Institute / Open Group paper “Modelling SABSA with ArchiMate” and chairs the associated SABSA Working Group.

He holds several security, architecture and privacy certifications including both SABSA Chartered Practitioner certifications and a contributor to the forthcoming ArchiMate Next.
Tuesday 23rd
17:40-18:40
Traceable to the Last Line of Earth

Plenary 10P

High Assurance is an art known or practiced by few globally, it’s a religion with five gods, and a game with ever increasing difficulty levels. This talk will walk through a fictional High Assurance submission and evaluation of technology found in a well known late 1900’s Sci-Fi TV show.

A cryptographic device that authenticates a one-way signal to open a blast-proof iris, where a failure in any human, physical, electromagnetic, time or quantum domain could lead to a catastrophic level event on Earth, and a false reject inadvertently kills the inbound team.

With the help of contemporary AI to speed up the mountain of documentation review, we will map and trace business risk attributes through a set of engineered security attributes down into logical security services, physical controls, then back up again for the completeness check that catches what everyone misses.

Attendees will leave with an enhanced appreciation of why systems engineering matters, why experience from all types of security professionals is required, and that even when you think you’ve met all the requirements – you may still be rejected without a reason.
Speaker(s)

Tarrant Marshall

Senior Executive, Department of Defence (Australia)

Tarrant Marshall is a senior leader in Australia’s prominent Government cyber security organisation. He has over 20 years experience in both private and public sector, delivering and securing technology systems. He has held roles across software and infrastructure engineering, solution architecture, enterprise architecture, and information security assurance.
Tuesday 23rd
18:45-19:15

Drinks Reception
Tuesday 23rd
19:15

Dinner

Wednesday 24th February

Wednesday 24th
09:00-09:30

Registration & Coffee
Wednesday 24th
09:30-10:15
What Happens When SABSA Meets "The Art of War"?

Session 11A

In this imaginative virtual conversation, SABSA co-creator David Lynas meets “Sunny”—Sun Tzu reimagined for the modern enterprise. Together, they explore what a 2,500-year-old philosophy of strategy can teach us about business-driven security architecture.

The session maps key ideas from The Art of War – knowing yourself and others, understanding terrain, shaping conditions, using intelligence, conserving resources and adapting to change, to SABSA concepts such as Business Attributes, Risk and Opportunity, Security Domains, Trust, Governance and Through-Life Management.

This is not an attempt to turn cybersecurity into warfare, nor to retrofit Sun Tzu into the SABSA Matrix. Instead, the conversation asks a more useful question: can Sun Tzu’s strategic wisdom help SABSA practitioners think differently about uncertainty, positioning and architectural advantage, and can SABSA give that wisdom structure, traceability and measurable business meaning?
Speaker(s)

Joshua Qwek

Director, Cyber Team One (Australia)

Joshua Qwek is a cybersecurity executive and independent advisor with more than 20 years of experience across government, financial services, higher education, and industrial environments.

He brings deep expertise in security architecture, cyber strategy, and executive advisory, alongside Governance, Risk, and Compliance (GRC) — with hands-on experience implementing and building cyber capabilities and developing architecture functions.

Through his independent advisory practice, he currently advises clients on security architecture, strategy, cyber capability uplift, and cyber operations.
The Divine Comedy of OT Anti-Patterns. Will My Saviour, DNS, Be Yours?

Session 11B

Where Dante had nine circles’ architects have built considerably more, mostly by accident.

In this talk, a confession dressed as a conference session, we’ll journey through the many circles of industrial network hell. Observe the eternal conflict of “IT vs. OT”, bear witness to identity and trust architectures dragged into environments seldom designed to survive within, uncover the fraud of “physical segmentation”, and the treachery of networks whose oath to serve their applications has been long broken.

Each circle is a pattern you’ve likely built, swore was a “temporary” fix, inherited, or defended in a design review. None born of malice, but convenience – the true devil of OT Hell.

This talk isn’t just a tour of damnation though. It’s a way out. Deep within the inferno hides a protocol whose name, if spoke, is a heresy! Will my savour, DNS, be yours?

Bring a sense of humour. You’ll need it.
Speaker(s)

Luke Snell

Systems Architect, ether-net (Australia)

Luke has been working in the Australian mining industry since 2015.

He is an accredited Functional Safety Engineer (TÜV Rheinland, SIS) where his career has seen him work across autonomous and traditional surface and underground
mining operations, ports, rail environments, utility and power (LV + HV), as well as water pipeline networks. Since 2020 he has focused on supporting critical infrastructure and major hazard facilities; where he is solving problems related to automation, edge compute, hybrid loud, and industrial data centers.

Luke frequently rides the Architect’s Elevator from the “engine room” to the “executivesuite”, is a firm believer in solving business problems with technology instead of
technical issues with products and tooling and is quite cheeky about challenging the norm.

Outside of technology you’ll find him engaging in all sorts of creative shenanigans be that improv theatre or trying to find unsuspecting people to indoctrinate into his
Dungeons & Dragons campaigns. He also co-coordinates SABSA World Perth.
Wednesday 24th
10:20-11:05
From Noise to Harmony: SABSA is Conducting the Orchestra of Security Nuances

Session 12A

Just as an orchestra transforms a musical score into a harmonious performance, SABSA turns strategic vision into a coordinated, measurable architecture. Both provide clear direction without micromanaging, enabling specialists to excel within a unified framework.

This session explores the powerful parallels between a symphony orchestra and the SABSA methodology, showing how both bring structure and harmony to complex environments. Attendees will discover how SABSA’s principles extend beyond security, and show-up within an Orchestra demonstrating agility, creativity, confidence, and resilience.

Participants will be encouraged to think like an Architect-Composer—orchestrating people, processes, and technology into a trusted, high-performing enterprise.
Speaker(s)

Rodney Anderson

Head of Information Security and Compliance, Barnardos Australia (Australia)

Rodney is an accomplished information security professional with more than two decades of experience across diverse industries including large corporate, telecommunications, energy, healthcare, and major financial sectors. Currently, he is dedicated to giving back to society, as the Head of Information Security & Compliance (aka CISO) at Barnardos Australia. There, he exercises thought leadership by crafting practical, risk-appropriate security visions and roadmaps through a commitment to continual improvement.
The Next Dot: Web 3.0 Domains

Session 12B

Web 3.0 domains ushers in a new business enablement model of allowing organizations to participate in the emerging Digital Assets and Decentralised Finance ecosystem.

For over four decades, traditional DNS has anchored web identity. The rise of Web 3.0 domains replaces centralized registries with blockchain based smart contract. This session will introduce the concept of Web 3.0 domains as the “Next Dot”, highlight its structural differences to normal DNS, illustrate applicable use cases by showing how cryptocurrency wallets connect to Decentralised Apps (dApps) via Web 3.0 domains.

As with any new business enablement model, Web 3.0 Domains may also introduce new risk. Session attendees will walk away with an adoption framework that entails Risk Assessment, Legal and Compliance, Adherence, and correct application to use case scenario’s to manage Web 3.0 brand exposure.
Speaker(s)

Mz Omarjee

Head: IT Client Security, Standard Bank Group (South Africa)

Muhammed Zubair (Mz) Omarjee, is a former Enterprise Security Architect providing advisory to leading banking institutions in South Africa and abroad. He is instrumental in crafting technology strategies as it relates to new digital assets adoption, digital transformation, mobile banking and cyber security. He plays a pivotal role in shaping information technology practices as a transformative business driven and risk-oriented discipline.
Wednesday 24th
11:05-11:25

Morning Coffee
Wednesday 24th
11:25-12:10
Building Capabilities That Bridge the Gap to Execution

Session 13A

Most organisations know where they want to be. The challenge is understanding what capabilities and decision-making are required to navigate the “messy middle” between intent and execution.

This creates a tension where two truths can exist at the same time: organisations can produce great security architecture and policy artefacts and still struggle to embed the behavioural change and accountability required to achieve meaningful uplift.

Projects end. Capabilities endure.

When people understand their roles, responsibilities, and the decisions they are empowered to make, they are better positioned to create the conditions for sustained progress. Drawing on a range of cyber uplift programs, this session explores practical examples of how capabilities were designed, challenges navigated, and lessons learned along the journey.

Ultimately, transformation is not defined by project deliverables, but by whether the organisation has the capability to sustain and evolve the security operating model.

This raises an important question: what does the “bronze medal” truly look like for your organisation’s cyber capability journey?
Speaker(s)

Andra Cimpean

Senior Cyber Security Specialist, Department of the Premier and Cabinet - Office of Digital Government (DGov) (Australia)

Andra Cimpean works as Senior Cyber Security Specialist at Department of the Premier and Cabinet – Office of Digital Government of WA, supporting cyber security transformational programs across State Government in alignment with the WA Cyber Security Policy.

Andra volunteers with SABSA World Australia and is the Deputy Chair for the Australian Information Security Association (AISA) WA Branch. As a former professional chess player, she brings in a unique perspective with her strategic and problem-solving skills. She holds a Master’s degree in Cyber Security and a Bachelor’s in Psychology along with accreditations such as CISM, SABSA Chartered Security Architect and ITILv4.
The OT SOC Illusion: The Detect–Decide–Do Challenge in Industrial Security

Session 13B

Many organisations are building OT SOC capability by deploying passive sensors, forwarding alerts into enterprise SOCs, and assuming visibility equals resilience. It does not.

Enterprise SOC models often assume that detection, decision and action can be tightly coordinated through one operating structure. Industrial environments break that assumption. In OT, the party that detects an anomaly may not understand the engineering consequence, own the operational risk decision, or have authority to execute a safe response.

This session introduces Detect–Decide–Do: a model for exposing where OT detection and response authority actually sits versus where it must sit. Many OT SOC programs create an illusion of control: they own the alert (possibly borrowed from a provider without deep OT expertise) but not the context, decision rights or safe action path required for resilience.

Drawing on controller design and OT assessments across a range of OT environments the session adds a Safe-Action Ladder, i.e., what an OT detection may trigger, from notify to contain, and the authority each rung requires.

Participants will pressure-test the model through an OT scenario involving incomplete evidence, competing priorities and operational risk. The debate: is an OT SOC without engineering authority a resilience capability — or just theatre?
Speaker(s)

Dr. Pierre Tagle

Head of Digital Identity and Zero Trust, DXC Technology (Australia)

Pierre Tagle, Ph.D., is an esteemed Information Technology and Cybersecurity professional with over 20 years of experience encompassing extensive consulting, executive
management, and 24×7 operational roles across diverse sectors including government, financial services, manufacturing, not-for-profit and academia. Dr. Tagle is adept at
translating complex security concepts into actionable strategies for both business and technical stakeholders, and is recognized for his analytical acumen and innovative approach to cybersecurity. He holds a Ph.D. in Computer Science and numerous prestigious certifications such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, PCIP, and CDPSE.

In his current role as DXC Technology’s Head of Digital Identity and Zero Trust for Australia and New Zealand, Dr. Tagle leads a team that expertly balances business needs with risk mitigation and cost-effective security solutions. He leads team of close to 50 SMEs covers all four of DXC’s Security service pillars. This includes Cyber Risk & Compliance, Digital Identity, Infrastructure, App & Data Protection, and Cyber Transformation & Operations. Prior roles includes leading advisory and consulting teams in Secureworks and Sense of Security (now part of CyberCX).

His own direct work spans several critical areas including security strategy and roadmap development, compliance and maturity frameworks management, IT and OT security, and business continuity planning. Dr. Tagle’s leadership not only drives the strategic direction of security practices but also fosters a culture of accountability and continuous improvement within his teams.
Wednesday 24th
12:15-13:00
Positioning Cyber Teams for Enduring Value in an AI World

Session 14A

In the age of AI-driven cybersecurity, teams must prove their ongoing value to the business. This session introduces a SABSA-based framework for creating cyber teams that thrive alongside AI by focusing on areas where human judgment remains essential: strategic risk interpretation, ethical decision-making, and business-aligned leadership.

By applying SABSA principles, security functions demonstrate measurable business impact and position themselves as strategic partners rather than expendable cost centres.

Three Key Takeaways:

Positioning for Sustainable Value: Structure teams to own high-value outcomes such as Governance, Risk, and Architecture where human accountability and context outperform automation.

Business-Integrated Security: Align security with organisational priorities using SABSA, proving direct contributions to resilience and trust.

AI as a Strategic Enabler: Transform non-deterministic AI into deterministic, repeatable processes for GRC, Security Architecture, Strategy, and other non-technical areas, improving speed, accuracy, and standardisation while freeing teams for strategic oversight.
Speaker(s)

Dan Schoemaker

CISO, Phoenix HSL (Australia)

Dan Schoemaker is Chief Information Security Officer at Phoenix HSL, where he leads the Group Security function. With over a decade of experience spanning IT infrastructure and enterprise security, his expertise covers security strategy, risk and governance, and enterprise security architecture. A hands-on technologist at heart, Dan is passionate about turning theory into measurable outcomes that improve business resilience.
AI Governance Theatre

Session 14B

Organisations are investing heavily in AI governance frameworks, policies, and ethical principles. Yet AI-related risks continue to surface in production, often in ways governance was intended to prevent. This disconnect highlights a growing challenge: governance exists on paper, but not consistently in practice.

This session explores “AI governance theatre,” where visible structures such as policies, committees, and risk frameworks create an impression of control without delivering meaningful oversight. For executives, this is not simply a compliance issue; it is a business risk. Ineffective governance can lead to reputational damage, regulatory exposure, and erosion of customer trust.

The session examines why this gap persists. Structurally, governance is often positioned too far from where AI decisions are made. It operates as a review function rather than an embedded capability, limiting its influence on design and delivery. Culturally, teams are frequently incentivised to prioritise speed and innovation, while governance is seen as a constraint rather than an enabler. Operationally, many organisations lack the mechanisms to translate high-level principles into clear, actionable requirements that can be consistently applied.

For executives, the key issue is not the absence of governance, but the lack of integration. Policies alone do not change outcomes unless they are embedded into workflows, supported by clear accountability, and reinforced through incentives. Without this, governance becomes performative, providing assurance without control.

This session moves beyond diagnosis to focus on practical leadership actions. It outlines how to shift governance from oversight to enablement by embedding it into existing delivery models. This includes aligning incentives across business and technology teams, clarifying ownership of AI risks, and ensuring governance is applied continuously rather than at isolated checkpoints. It also highlights the importance of measurable controls, such as standardised model documentation, risk-based decision thresholds, and ongoing monitoring.

Responsible AI is not achieved through more policies, but through better execution. This session equips leaders with a clear perspective on why governance efforts fall short and what it takes to make them effective in practice.
Speaker(s)

Bharat Bajaj

Professional Development Board Member, ISACA Melbourne Chapter (Australia)

Bharat Bajaj is a highly accomplished Technology Risk leader with two decades of experience navigating the complex landscapes of Artificial Intelligence, Cybersecurity and Privacy.

I have partnered with three of the “Big Four” Australian banks, delivering large-scale, transformative projects with robust technology risk mitigation strategies that enabled customer-focused outcomes. My approach blends deep industry expertise with strategic thinking, consistently delivering business value.

Currently, Bharat is leading the implementation and governance of Generative AI and AI Agentic systems. Bharat’s responsibilities cover the identification of technology risks and evolving compliance requirements, as well as the development and implementation of comprehensive guardrails.

As a dedicated Board Director at the ISACA Melbourne Chapter, Bharat is committed to enhancing the professional capabilities of our Melbourne technology community.

Reshma Devi

Data and AI Risk and Information Management Leader, Transurban (Australia)

Reshma is an AI & Data Risk specialist with experience in Security and Technology. She holds a Master’s Degree in Information Technology, is a Certified Data Privacy Solutions Engineer (CDPSE), and is a Graduate of the Australian Institute of Company Directors (GAICD).

With a passion for Data, AI, and emerging technologies, Reshma brings over 20 years of experience working in Australia and New Zealand. She is deeply committed to Data Security and addressing emerging AI challenges. Currently, Reshma serves as a Director at ISACA Melbourne and sits on the Advisory Board for other not-for-profits. Additionally, she contributes as a Subject Matter Expert Reviewer for ISACA’s CDPSE Manual and regularly writes for blogs, podcasts, and security magazines.
Wednesday 24th
13:00-14:00

Lunch
Wednesday 24th
14:00-14:45
Securing AI Supply Chain

Session 15A

Securing the AI supply chain is now a defining challenge for accountable security leaders, because every model, dataset, platform, and delivery partner introduces new dependencies that can amplify concentration risk and systemic exposure across government ecosystems.

When managed well, AI accelerates public‑sector outcomes; when unmanaged, it creates fresh attack paths, opaque vendor lock‑in, and loss of operational control. Effective governance and assurance must therefore extend across agencies, suppliers, data flows, platforms, and jurisdictions, ensuring shared controls rather than isolated safeguards. For business leaders, the core decisions now centre on responsible adoption, clear accountability, resilient architectures, and sustaining public trust in an environment where AI is both an opportunity and a threat. SABSA provides several tools and techniques to solve supply chain concerns for organisations.
Speaker(s)

Sarit Kannanoor

Head of Cybersecurity, Digital Frontier Partners (Australia)

Sarit Kannanoor is a senior cyber security and risk leader with several years of experience advising executives, boards, and public sector organisations on security governance and enterprise security architecture. Sarit is Head of Cyber Security and a Consulting CISO at Digital Frontier Partners, leading SOC operations and delivering strategic consulting and security architecture services across government and regulated industries, including financial services, critical infrastructure (water, transport), education, and health. Sarit provides vCISO services for hospitals, water utilities, aged care and other organisations. Sarit helps organisations design pragmatic security operating models, uplift controls and enablers, and embed risk-based decision-making that supports business outcomes. He leads ISO 27001 certification programs and advises on AI governance and security to enable safe, ethical adoption of emerging technologies. An accomplished presenter, he has delivered multiple presentations at COSAC, AISA and other conferences. Sarit is a SABSA Chartered Architect (Master), CISSP, and a member of ISC2 and ISACA. Sarit was the recipient of The SABSA Institute’s Matt Whelan Commemorative Award.
From Security Reviews to Security Engineering: Context-Aware AI in Practice

Session 15B

For decades, security assurance has largely relied on architecture reviews, standards, checklists, and manually interpreted control patterns. While these approaches helped organisations establish baseline governance, they are increasingly struggling to scale within modern engineering environments shaped by AI-assisted development, cloud-native platforms, infrastructure-as-code, Kubernetes, APIs, and highly automated CI/CD pipelines.

Today, many security failures emerge not because controls were absent, but because assumptions were wrong, trust boundaries shifted, deployment configurations drifted, automation behaved unexpectedly, or the implemented reality no longer matched the reviewed design.

At the same time, security teams are being asked to assess increasingly complex ecosystems with limited contextual visibility into what was actually built, deployed, interconnected, or exposed.

This session explores whether traditional review-centric security models remain sustainable in modern engineering environments, and examines how emerging AI-driven and context-aware approaches may help evolve Secure-by-Design into a more adaptive security engineering capability.

Rather than focusing on specific AI / security tools, the session will discuss how contextual understanding across architecture, cloud configurations, deployment pipelines, platform behaviour, and engineering workflows could help security teams better prioritise threats, validation efforts, and control assurance in increasingly dynamic ecosystems.

The session aims to challenge attendees to rethink how security assurance may need to evolve as software delivery, automation, and AI-assisted engineering continue to accelerate beyond the limits of traditional review models.
Speaker(s)

Prapurna Uppuluri

Product Security Manager, Bupa (Australia)

Prapurna Uppuluri is a cybersecurity practitioner with more than 17 years of experience spanning security architecture, cloud security, Secure-by-Design, governance, DevSecOps, and enterprise security transformation within complex technology environments.

Her work focuses on evolving security from static review-driven models toward more adaptive and engineering-aligned approaches capable of scaling within modern cloud-native ecosystems. She has a strong interest in APIs, Kubernetes, AI-assisted development, context-aware security controls, policy-as-code, CI/CD assurance, and practical security engineering patterns that can be operationalised by developers, architects, cloud teams, and security practitioners.

Prapurna is particularly passionate about bridging the gap between architectural intent and deployed reality, and exploring how AI and automation may help security teams better understand implementation context, prioritise threats, and improve assurance outcomes in increasingly automated engineering environments.

She regularly works across architecture, engineering, cloud, and security teams to help drive practical and scalable Secure-by-Design initiatives.

Areas of Expertise:

Secure-by-Design

Cloud & Kubernetes Security

API Security

Security Architecture

DevSecOps & CI/CD Security

AI-Assisted Security Engineering

Policy-as-Code & Control Automation

Threat-Informed Security Engineering

Context-Aware Security Assurance.
Wednesday 24th
14:50-15:35
Using the NIST CSF Attributes

Session 16A

The SABSA Institute (TSI) sponsored SABSA Enhanced NIST Cybersecurity Framework (SENC) workgroup project is developing various tools, techniques and guidance to help your organization put the NIST CSF to work the SABSA way. The SENC project has defined a collection of example Attributes and Attribute Profiles, based on the NIST CSF Functions, Categories and Subcategories to reference when integrating the NIST CSF into a SABSA Security Architecture.

An initial SENC project deliverable includes the requirements, method, process and examples for leveraging the NIST CSF based Business Attributes and Attribute Profiles to integrate the CSF into a SABSA security architecture that is tailored to your specific needs, and aligned to the risk appetite, of the business. The business attributes profiling process is one of the more important techniques to integrate the NIST CSF into a SABSA security architecture.

This session provides an overview and details of the SABSA Business Attribute Library for the NIST CSF and how to use the library to define the NIST CSF related Attributes for your organization. We will detail the Attribute Library contents, how to develop the NIST CSF focused Attributes Taxonomy and how to improve the quality of the selected Attribute Profiles. We use Attributes for Attributes to determine if the set of the Attribute profiles selected from the SABSA NIST CSF Attribute Repository pass the Attribute quality test when customized for the security architecture. The Attribute Profiles can be used to define measurement and reporting requirements to verify that the business goals for cyber risk management are being met and, if not, where interventions should be made. We will also work through an example illustrating how the Attribute Profiles can be used to aggregate Attribute measurements and metrics for reporting on NIST CSF compliance and effectiveness. We will also summarize what the SENC Project Team has accomplished to date and what is next for the project to apply and enhance the NIST CSF to help manage your organization’s business risk requirements.
Speaker(s)

Glen Bruce

Cybersecurity Consultant, GDB Cyber Security Consulting (Canada)

In his 50+ years of in-depth experience in IT and security consulting, systems management and technical implementations, Glen Bruce has focused on Security Frameworks, Strategies, Architectures, PKI and Governance supporting business and governments in their approach to managing information and cybersecurity risk. He has led many information/cyber security engagements, where he has helped clients establish effective strategies, governance, architectures, frameworks, policies, PKIs and infrastructure implementations in support of a wide range of business and technical requirements. Glen is the leader of the TSI SENC workgroup project and the Chair of the TSI SABSA Institute Testing Board (SITB).
The AI Change Looks Safe. Would You Sign Off?

Session 16B

AI is changing the SDLC, but the hard question is not whether it can produce code, tests or documentation. The hard question is whether leaders and practitioners can still make a defensible decision when AI has influenced both the work and the evidence that says the work is safe.

This session puts the release decision under pressure. What should be trusted? What should be challenged? What did the human actually approve? Where does accountability sit when AI has shaped the requirement, design, review, risk summary or test evidence?

We will move between executive judgement and security architecture: when AI should be allowed to act, when it should only advise, what kind of human approval still matters, and how assurance can avoid becoming theatre.

The aim is not to present a checklist or a fixed model. It is to test the assumptions behind modern SDLC controls as AI becomes part of design, development, review and release.

Participants should expect insightful discussions and practical trade-offs. You will leave with a sharper way to think about AI-enabled delivery: not “can we automate more?”, but “what evidence would make this decision defensible?”
Speaker(s)

Chirag Joshi

Founder and CISO, 7 Rules Cyber (Australia)

Chirag Joshi is a globally recognised cyber security and AI governance leader, author, and entrepreneur. He is the Founder of 7 Rules Cyber, a strategic cyber security advisory firm focused on helping organisations achieve defensible, efficient, and business-aligned security and AI Governance outcomes.

A multi-award-winning executive, Chirag was named Cyber Security Consultant of the Year (SME) at the 2025 Australian Cyber Security Awards, his second win in this category. He is also a recipient of the Excellence Award and has been listed on the CSO30 as one of Australia’s top cyber security executives for three consecutive years from 2022 to 2024. He is a Fellow of the Australian Information Security Association.

With global leadership experience across critical infrastructure, financial services, government, energy, healthcare, higher education, consulting, and the not-for-profit sector, Chirag has led major transformation programs, advised boards and executives, and guided organisations through mergers, regulatory change, operational technology risk, cyber resilience, and emerging AI governance challenges. His approach is pragmatic, commercially aware, and anchored in business priorities.

Chirag is the author of two bestselling books, 7 Rules to Become Exceptional at Cyber Security and 7 Rules to Influence Behaviour and Win at Cyber Security Awareness, which have shaped how leaders approach strategy, influence, and culture in cyber. His thought leadership has been featured by institutions including the Australian Institute of Company Directors, ISMG, and CSO Online, and he has contributed national media commentary on cyber safety, AI, and responsible technology adoption. He regularly shares insights as a keynote speaker at leading conferences worldwide.

He currently serves as President of ISACA Sydney, where he is driving growth, professional development, and thought leadership across the cyber, risk, AI, and governance community. He is also National Ambassador for the Critical Infrastructure ISAC Australia, strengthening collaboration and resilience across the nation’s most essential sectors.

Andrew Banderia

Security Strategy and Architecture Lead, Australian Payments Plus (Australia)

Andrew is a cybersecurity leader at Australian Payments Plus, specialising in security architecture, secure-by-design practices, and the safe adoption of emerging technologies.

He works closely with engineering, risk, architecture, and business teams to translate complex security challenges into practical controls that support innovation and delivery. His areas of focus include AI security, DevSecOps, software supply chain risk, cloud and API security, and embedding security throughout the technology lifecycle.

Andrew is particularly interested in improving how security teams collaborate with delivery teams, moving security beyond traditional governance gates and positioning it as an enabler of resilient products and services. He brings a pragmatic perspective shaped by the realities of operating in complex, highly regulated environments.
Wednesday 24th
15:35-15:55

Afternoon Tea
Wednesday 24th
15:55-16:40
SABSA Better Than Gallop?

Session 17A

SABSA has its genesis in the security risks to technical solutions and while some Masters papers have considered SABSA and soft systems, can SABSA be used to predict the success of a political system, where success is defined as the security of the nation.

The current US political machinery has been compared to that of President Reagan, including, a president with a larger-than-life public persona, changing international alliances as well as disruptive negotiating techniques.

For those of us that lived through the uncertainty of the end of the cold war, it was hard to predict that Reagan’s policies would have been as successful as history now views them. Can SABSA be used to predict the success or otherwise of Trump’s second term?

Whether it be through: what, why, who, where and when; unpicking the taxonomy of politisation; using the stakeholder views; political domain decomposition or risk and opportunity assessment, can the tools of SABSA can provide useful insights that help structure such a comparison.

While this presentation is not intended to fuel any more of David’s megalomaniacal tendencies, it aims to consider whether SABSA is a better predictor of political success than Gallop.
Speaker(s)

Kirren Hartas

Security Architect, On The Business Pty Ltd (Australia)

Kirren started his career in the Australian Department of Defence as a technical trainee in the mid 90’s and has worked across various elements of the Federal Government as a public servant, consulting engineer, project manager, security specialist and generalist.

Repeatedly Kirren has experienced that what people ask for in the context of security and what they actually need are somewhat divergent.

Carol Sutton

Retired, On the Business Pty Ltd (Australia)

Concept definition and early-stage acquisition for secure information and communications systems have been the focus of Carol’s career. Particularly in military aircraft platform acquisition, Carol has specialized in supporting systems such as command and control, training as well providing guidance on system security requirements for a range of other platforms.

With innovation in technologies, the need to be smart about how security is defined and implemented, Carol has taken the lessons identified earlier in her career to help develop holistic solutions including people, processes, data and infrastructure. This approach led to the successful implementation of a new specialist cell within Australia’s Air Operations Centre. Carol’s responsibility within the implementation team was the development of the security artefacts for certification of the systems.

Subsequently Carol was invited to create a ‘green field’ Operational Command and Control Centre for the fifth and future generation Royal Australian Air Force. Currently awaiting acquisition related information from a major ally, the capability management office is working to create an environment for a successful implementation and transition into service. Although in the early stages of the ADF’s capability lifecycle model, Carol’s legacy is a design that is secure, resilient and operational.
Architecting Governance Automation

Session 17B

Automation is a key driver for enterprise efficiency, but the increasing risk of developing siloes of discrete automated workflows willoffset any gains made through process improvement. This can be avoided by applying standard enterprise architecture principles to automation of governance.

Firstly, an automation workflow needs to be anchored in or having clear traceability back to a value chain. Secondly, exercising governance means shifting from periodic manual reviews to continuous, policy-driven verification. This requires establishing Policy-as-Code (PaC), using guardrails rather than stop-start approval gates, embedding observability into system design, and maintaining clear human-in-the-loop escalation paths. Finally, contemporary governance must cover both deterministic IT automation as well as non-deterministic agentic AI workflows. In this presentation, we provide an architectural approach to automating contemporary governance.
Speaker(s)

Dr. Malcolm Shore

Chief Architect, David Lynas Consulting (New Zealand)

Dr Malcolm Shore retired from the New Zealand Air Force to take on the role of Director of Infosec for the New Zealand Government, where he developed and managed the national information security programme. He has subsequently held a number of CISO and Technical Director roles in the telecommunications industry. As a part time academic, Malcolm developed and lectured in the Post Graduate Diploma in Forensics and Security at Canterbury University in New Zealand, helped launch the Certificate IV in Cybersecurity in Australia, and is now an Visiting Researcher at Deakin University in Melbourne. He is the author of numerous online cybersecurity and programming courses published through Linkedin Learning and Offsec.

Malcolm is currently Chief Architect at David Lynas Consulting.
Wednesday 24th
16:45-17:30
SABSA By Air - Using SABSA to Find Amelia Earhart

Session 18A

On a warm tropical morning in 1937, Amelia Earhart and Fred Noonan flew into history. They took off in a Lockheed Electra from New Guinea at 10am on the second
last leg of their groundbreaking around the world flight. 18 hours later, the Electra, Amelia and Fred had vanished without a trace.

Amelia Earhart is survived by her mystery – as an enduring role model who shattered gender stereotypes in aviation by fearlessly proving that women could pilot long-distance flights with the same skill and courage as men. She has inspired many generations of women to pursue careers in flight and chase their dreams without limits.

On the 88th anniversary of their disappearance we will use the SABSA Enterprise Security Architecture framework and methodologies to find Amelia, Fred and the Lockheed Electra 10E.

Putting SABSA’s engineering approach to work in finding Amelia, involves understanding the context of the flight, employing attributes, engineering SWOT, analysing risks, exploring logical domains and assessing physical domain consequence and impact.

We will leverage SABSA trust modelling to understand the contributing trust management issues on the ground and in the cockpit. We will employ SABSA dependency modelling to uncover the single point of failure (SPOF) that likely lead to the loss of the Electra 10-E and we will use security associations (SA) to unwrap the complex relationships between the logical security services that failed the flight that day.

Using the SABSA framework, we can finally comprehend the attributes of the flight that were not maintained, the domain boundaries crossed without support, the security awareness and training disassociations, the technology limitations and the changing risk environment that cumulatively describe the kill chain that led to the loss of the flight.

Armed with relevant information and the SABSA methodology attendees will be given the opportunity to determine Amelia’s location, and learn why your instruments on the ground are showing green while the ones in your cockpit are screaming “trust me bro” in red…

This unique presentation explores how to use SABSA methodologies in different environments to increase a SABSA professional’s skills and proficiencies with SABSA.
Speaker(s)

Robert Laurie

Security Architect, CipherShield (Australia)

Robert is an experienced Enterprise Security Architect with an information security career spanning more than 20 years in cyber security roles. Robert has a great deal of experience working with medium to large organisations in Government, Higher Education and Critical Infrastructure sectors.

Rob’s recent experience involves successful delivery of security projects with organisations in the education, finance, utilities and petrochemical sectors in Australia, Saudi Arabia, UAE, Vietnam and the United States.

Rob’s experience also includes high-profile roles such as Chief Information Security Officer (CISO) at the University of New England, leading multiple pivotal cyber security projects.

Rob is highly experienced in defining information security risk strategy, security architecture design and alignment with business processes, transformation and automation of security and architecture processes, as well as planning and integration of security services and mechanisms to clearly support business goals.

Rob is a certified SABSA, ISACA and (ISC)2 instructor and is committed to contributing to the wider information security community, currently sitting as the Chair of the Western Australia branch of AISA (Australian Information Security Association), Founder/Treasurer of the ISC2 Western Australia Chapter and Deputy-Chair of the ISC2 Chapter Regional Management Committee (CRMC) APAC.
From Shadow AI to Assured AI: A Practical Governance Framework for Enterprise Adoption

Session 18B

This session introduces DAVE (Discover, Assign, Verify and Evolve), a practical governance framework for organisations that need to bring informal, worker-led and vendor-embedded AI use into proper governance scope without stifling legitimate productivity.

DAVE is grounded in established standards, including the National Framework for the Assurance of Artificial Intelligence in Government, AS ISO/IEC 42001:2023, the Australian Government’s proposed mandatory AI guardrails, and ASIC’s regulatory expectations for AI governance in financial services. Rather than replacing these frameworks, DAVE addresses the governance gap that exists before they can be applied, when AI use is already occurring but has not yet entered formal visibility, ownership or assurance processes.

Discover: Making AI Use Visible

Governance cannot start with what is unknown. Discovery requires organisations to go beyond policy statements and conduct structured scanning of SaaS and cloud environments and regular reviews of vendor. It also requires safe disclosure channels so that workforce and contractor AI use surfaces rather than remains hidden.

Assign: Making Accountability Explicit

Visibility without ownership is observation, not governance. The Assign step requires a named governance owner for each AI use or class of use, supported by a cross-functional group spanning business, cyber, risk, legal, privacy and procurement. DAVE proposes a three-tier classification of approved, conditional and prohibited, applied consistently across employee-initiated, vendor-embedded and contractor-delivered AI use.

Verify: Applying Proportionate Assurance

Not every AI use warrants the same level of review. Low-risk productivity tools may justify lighter controls. Uses involving sensitive data, regulated decisions, public-facing outputs or automated downstream action require stronger assurance.

Evolve: Keeping Governance Current

AI capabilities change continuously through supplier updates, new use patterns, and increasing agentic functionality. Governance must be treated as a live operational discipline, not a one-off design exercise.

Takeaways

This presentation is designed to give the audience a clear understanding of one of the most immediate and under-governed AI risks facing modern organisations: AI that is already in use, but not yet properly visible, owned, or assured.

Attendees will leave with five key takeaways.

A clearer understanding of the real governance problem.

A practical framework they can apply.

A stronger understanding of how control failures occur in practice.

A way to connect practice to regulation and assurance expectations.

Immediate actions for leaders and governance functions.
Speaker(s)

Bharat Bajaj

Professional Development Board Member, ISACA Melbourne Chapter (Australia)

Bharat Bajaj is a highly accomplished Technology Risk leader with two decades of experience navigating the complex landscapes of Artificial Intelligence, Cybersecurity and Privacy.

I have partnered with three of the “Big Four” Australian banks, delivering large-scale, transformative projects with robust technology risk mitigation strategies that enabled customer-focused outcomes. My approach blends deep industry expertise with strategic thinking, consistently delivering business value.

Currently, Bharat is leading the implementation and governance of Generative AI and AI Agentic systems. Bharat’s responsibilities cover the identification of technology risks and evolving compliance requirements, as well as the development and implementation of comprehensive guardrails.

As a dedicated Board Director at the ISACA Melbourne Chapter, Bharat is committed to enhancing the professional capabilities of our Melbourne technology community.

Ravneet Kaur

Cybersecurity Leader, ISACA Melbourne Chapter (Australia)

Ravneet Kaur, CISM, Oxford-certified AI professional, is a senior technology, cybersecurity, and transformation leader with expertise in AI governance, risk management, cyber resilience, and secure enterprise delivery across regulated environments. Her experience spans government, banking, energy, telecommunications, and sovereign cloud. Drawing on work in cybersecurity uplift, enterprise governance, and quantum-safe encryption initiatives for critical infrastructure, Ravneet brings a practical, strategic perspective to governing innovation responsibly. She is recognised for translating complex technology and assurance challenges into business-aligned outcomes that build trust, resilience, and operational readiness.
Wednesday 24th
17:40-18:40
The COSAC Rump Session

Plenary 19P

The COSAC “rump” has for many years been a hugely popular plenary session at COSAC. The Rump is an informal rapid-fire session in which participants give very short presentations on recent results, work in progress, and any other topic of interest to the COSAC community. Presentations may be purely technical, entirely management oriented in nature, or of any combination of approaches or perspectives.

Those wishing to give a talk at the rump session must submit a short abstract, no more than one page long, according to one of the following procedures:

• Electronic submission: Send email to the rump session chair David Lynas at [email protected]
• Hardcopy submission at conference: Hand the submission to David Lynas at the conference before noon on Wednesday 24th February.

Submissions should include a requested amount of time for the presentation. An anticipated absolute maximum of four minutes will be allocated for each presentation.
Speaker(s)

David Lynas

Chairman, COSAC (Northern Ireland)

David Lynas is currently enjoying his 42nd year of experience in Information Security, during which he has been invited to provide strategic advice to governments and industry clients on every continent. A globally renowned Enterprise Security Architect, Security Strategist, and Thought-Leader, he is the co-author of SABSA (the world’s leading free-use, open-source Security Architecture Methodology), CEO of the SABSA Institute and CEO of David Lynas Consulting.
Wednesday 24th
18:45-19:15

Drinks Reception
Wednesday 24th
19:15

COSAC APAC 2026 Gala Dinner

Thursday 25th February

Thursday 25th
08:00-09:30
Thursday 25th
09:30-10:00

Registration & Coffee
Thursday 25th
10:00-17:45
7th COSAC APAC Security Architecture Design-Off

Masterclass M1

Returning for a 7th year, this design-off will present a new and engaging set of challenges. In the spirit of hack-a-thons, this competition was born out of a desire to provide a venue for security architects to apply their skills in a safe environment. This is a unique competition format that uses real clients, scenarios and deliverables to see which team will reign supreme! Whether you are a seasoned enterprise architect or security architect, or just looking to try something different to build and enhance your skills, this session will provide a unique opportunity to prove and hone your architecture chops.

Many practitioners come out of self-study or training armed with new skills, but struggle with applying them in complex situations and under tight time frames. Not to mention, there may be a limited number of practitioners in their organization (or region for that matter) to learn from. The primary goals for this session are to build relationships with other practitioners, to learn from each other on different ways to apply techniques to solve problems, and setup situations where we can creatively apply and adapt our skills. This is not a session where you will sit and listen to a presenter telling you how to do something.

The materials for the design-off and the final presentations are typically provided in electronic form so attendees should plan to bring a laptop or electronic device that can be used to review materials and work with their team.

Past attendees of the Design-Off have marked this as one of the highlights of the conference and we hope you will leave feeling the same way. Each year we feature a unique customer and problem set, so if you have attended in a previous year, be assured that this year will present a new and different challenge. This year we have several tweaks planned based on feedback from past attendees that we think will further enhance the experience!

Teams are made of people with different skill sets and skill levels, and team members will be actively engaging each other and trying to find the best way to meet the challenges. This is not a competition in using a specific formal methodology or framework (although they will definitely come in handy), but is meant to be an exercise in applying these techniques in a ways that most effectively meet the client’s needs. Each year’s winners proved their mettle through several challenges, demonstrating skills in listening to clients, applying risk management, demonstrating business value, and effectively communicating with the client. There can be only one winning team, however all participants will learn from the experience. Where else can you see how different groups of high level security practitioners apply their skills to address the same problem? That said, you will want to win this! The winning team members not only get bragging rights, but will be announced on the SABSA LinkedIn group, and each member will receive a personal acknowledgment on LinkedIn congratulating them on their achievement! Other spot prizes will be awarded by the moderators in addition to this to recognize outstanding efforts of participants.

A few of the hardest problems SABSA architects face are working alone, and getting started where there are challenges. These design workshops not only build teams from people who may have never worked together before, they challenge the groups to quickly overcome challenges to deliver actionable architecture quickly. It can be done; this activity proves it.
Speaker(s)

Jason Kobes

Sr. Staff Cyber Architect & Research Scientist, Northrop Grumman Corporation (USA)

Jason Kobes works as a Sr. Staff Cyber Architect & Research Scientist in Washington, DC for Northrop Grumman Corporation. Jason has over 25 years of experience concentrated in security digital transformation, systems engineering, information systems design analytics, business/mission security architecture, enterprise risk management, information assurance research, and using AI for automation. Jason has a Master’s of Science in Information Assurance (MSIA) and a Bachelor’s of Science in Computer Science from Iowa State University. Jason holds a SABSA Practitioner of Risk and Governance as well as Architecture. Jason’s areas of research include enterprise risk architecture, accountable anonymity systems and applying actionable enterprise security architecture.

William Schultz

Senior Director, Cybersecurity, Vanderbilt Health (USA)

Bill Schultz is a seasoned security architect with more than two decades of experience advancing cybersecurity, enterprise security architecture, and risk management disciplines. A SABSA Master–certified architect, Bill has built and led security and risk management programs, developed organizational and system level architectures, and guided enterprise wide security and risk initiatives. His work focuses on maturing security capabilities, effectively managing risk, and aligning technology decision making with long term business outcomes.
COSAC APAC International Round Table Security Forum

Masterclass M2

A lot has happened since we solved the information security problems of the world at COSAC APAC 2026. Just as we found out last year, with AI uncovering new and complex issues, some old problems either won’t die or put on new clothes to plague us from a slightly different direction.

Let’s attack these new and familiar issues with a phalanx of experienced, dedicated, resilient, professionals – you. There are no school solutions, so we strive for realistic, workable ones that don’t negatively impact productivity Often in seeking one solution, we discover new challenges. AI, quantum computing, machine learning, security staffing, privacy, compliance, incident handling, ransomware, … and that’s just a partial list from last year. The knowledge, experience even wisdom of delegates attending the Forum leads to sharing of ideas and techniques that don’t appear in textbooks, but get the job done. Forum delegates are rarely shy about sharing opinions and strategies, and committed to our profession.

The moderator (a security ancient) posits questions or comments on associated issues and related publications. Views differ based on prior experience, constraints, objectives, tools, techniques, hidden traps and final outcomes. The bottom line is we all learn from each other.

Come join us.
Speaker(s)

John O’Leary

President, O'Leary Management Education (USA)

John G. O’Leary, CISSP, is President of O’Leary Management Education. A computer security practitioner since 1977, he has designed, implemented, maintained, administered, broken, troubleshot, fixed, re-fixed, managed, consulted on and taught security for networks ranging from single-site to multi-national. Winner of the 2004 COSAC award, the EuroSec 2006 Prix de Fidelity, the 2011 ISC2 Lifetime Achievement Award and the first ever ISS Guardian Award in 2015, his background spans programming, systems analysis, auditing, project management, operations and quality assurance. John taught graduate school at the University of Texas at Dallas for 10 years (yes, there are universities in Texas, some of them even accredited). A few years ago he received breach notification letters from TJX and the VA in the same week. He is still waiting for OPM to reveal that the Chinese now have all his security clearance information. The Target “situation” got him new credit cards. He does not admit to knowing any Russians or CCP members. He completely missed out on early bitcoin gathering, but hasn’t lost anything in the latest wild fluctuations. He is firmly convinced that COSAC and COSAC APAC are the absolute best information security conferences on earth.
Governance of AI Architecture

Masterclass M3

This Masterclass will cover a practical approach to exercising delegated governance of an enterprise AI architecture. The presentations throughout the day will be supplemented with both exercises and hands on use of practical governance tools and templates.

There are no prerequisites to attending as attendees will be provided with a basic introduction to AI architecture and governance. The scope of the governance masterclass will be AI threat and risk assessment, ethical impact assessment, and architectural governance covering both LLMs and agentic AI. The masterclass will include demonstrations of AI threats and practical sessions on developing responsible AI system impact assessments and assessing ethical AI performance.

An AI security reference architecture with boilerplate AI security standards will be provided and, using case study examples of AI solutions, attendees will work in groups to complete a practical exercise in applying architectural AI governance.
Speaker(s)

Dr. Malcolm Shore

Chief Architect, David Lynas Consulting (New Zealand)

Dr Malcolm Shore retired from the New Zealand Air Force to take on the role of Director of Infosec for the New Zealand Government, where he developed and managed the national information security programme. He has subsequently held a number of CISO and Technical Director roles in the telecommunications industry. As a part time academic, Malcolm developed and lectured in the Post Graduate Diploma in Forensics and Security at Canterbury University in New Zealand, helped launch the Certificate IV in Cybersecurity in Australia, and is now an Visiting Researcher at Deakin University in Melbourne. He is the author of numerous online cybersecurity and programming courses published through Linkedin Learning and Offsec.

Malcolm is currently Chief Architect at David Lynas Consulting.
Thursday 25th
11:35-11:55

Morning Coffee
Thursday 25th
13:30-14:30

Lunch
Thursday 25th
16:00-16:20

Afternoon Tea
Thursday 25th
18:00-18:15

Conference Close - COSAC Chairman's Closing Remarks

COSAC
Patrons

A completely new COSAC experience pushing the boundaries of cybersecurity further than ever before. Smart people, inspiring guest speakers and a ton of passion. Become a COSAC Patron and gain access like no other.

Become a patron

COSAC
2026.

27th Sept - 1st Oct: Kildare, Ireland

More Info Register

Contact

Get in contact with us by email, phone or just stay social and connect with us on LinkedIn

COSAC APAC 2027

Tuesday 23rd February

Tuesday 23rd 08:30-09:00

Tuesday 23rd 09:00-09:20

Tuesday 23rd 09:30-10:15

Can AI Replace A Security Architect?

Session 2A

Speaker(s)

Stairway to Heaven, Pathway to Vulnerability: Evolving Static Safety Frameworks for Adaptive Cyber Threats

Session 2B

Speaker(s)

Tuesday 23rd 10:20-11:05

Beyond Secure by Design: The Agentic Security Architect

Session 3A

Speaker(s)

Digital Safety - Protecting Consumers Responsibly

Session 3B

Speaker(s)

Tuesday 23rd 11:05-11:25

Tuesday 23rd 11:25-12:10

The Approval Remains. The Judgement Has Moved

Session 4A

Speaker(s)

The "Hidden" Dependency: Mapping Space to SOCI

Session 4B

Speaker(s)

Tuesday 23rd 12:15-13:00

Beyond AI Generated Verbose Verbiage: Moving Vibe Proposals to Actionable Architecture Artefacts and Hopefully Implementable Designs

Session 5A

Speaker(s)

From LockBit to Liquidation: What Happens When You Lose Someone Else's Data

Session 5B

Speaker(s)

Tuesday 23rd 13:00-14:00

Tuesday 23rd 14:00-14:45

COSAC Risk Workshop: Using AI to Enhance Enterprise Risk Management

Session 6A

Speaker(s)

Who Pays for the Robot Analyst? Drawing the Autonomy Boundary in the Agentic SOC

Session 6B

Speaker(s)

Tuesday 23rd 14:50-15:35

You Don't Hate the 5x5 Matrix Enough - Quantification When You Must Use A Matrix

Session 7A

Speaker(s)

Beyond Zero Trust: Building the AI Trust Fabric for the Autonomous Enterprise

Session 7B

Speaker(s)

Tuesday 23rd 15:35-15:55

Tuesday 23rd 15:55-16:40

Cyber Sea Trial: Tracing Risk Ownership with SABSA in Maritime Defence Shipbuilding

Session 8A

Speaker(s)

Must We Know Who You Are? Authorisation Without Identification for Humans, Machines & AI Agents

Session 8B

Speaker(s)

Tuesday 23rd 16:45-17:30

Bridging Business and Cybersecurity: An Enterprise Security Architecture Journey in the Australian Energy Sector

Session 9A

Speaker(s)

Dropping the C-BOM: A Practical Playbook for Defusing the Post-Quantum Threat

Session 9B

Speaker(s)

Tuesday 23rd 17:40-18:40

Traceable to the Last Line of Earth

Plenary 10P

Speaker(s)

Tuesday 23rd 18:45-19:15

Tuesday 23rd 19:15

Wednesday 24th February

Wednesday 24th 09:00-09:30

Wednesday 24th 09:30-10:15

What Happens When SABSA Meets "The Art of War"?

Session 11A

Speaker(s)

The Divine Comedy of OT Anti-Patterns. Will My Saviour, DNS, Be Yours?

Session 11B

Speaker(s)

Wednesday 24th 10:20-11:05

From Noise to Harmony: SABSA is Conducting the Orchestra of Security Nuances

Tuesday 23rd
08:30-09:00

Tuesday 23rd
09:00-09:20

Tuesday 23rd
09:30-10:15

Tuesday 23rd
10:20-11:05

Tuesday 23rd
11:05-11:25

Tuesday 23rd
11:25-12:10

Tuesday 23rd
12:15-13:00

Tuesday 23rd
13:00-14:00

Tuesday 23rd
14:00-14:45

Tuesday 23rd
14:50-15:35

Tuesday 23rd
15:35-15:55

Tuesday 23rd
15:55-16:40

Tuesday 23rd
16:45-17:30

Tuesday 23rd
17:40-18:40

Tuesday 23rd
18:45-19:15

Tuesday 23rd
19:15

Wednesday 24th
09:00-09:30

Wednesday 24th
09:30-10:15

Wednesday 24th
10:20-11:05

Wednesday 24th
11:05-11:25

Wednesday 24th
11:25-12:10

Wednesday 24th
12:15-13:00

Wednesday 24th
13:00-14:00

Wednesday 24th
14:00-14:45

Wednesday 24th
14:50-15:35