CISO New Zealand schedule

With the rise of AI-driven threats and increasingly complex digital ecosystems, organisations are moving towards an assumed breach world where preventative controls alone are no longer enough. Drawing on the journey of strengthening cyber resilience in a critical infrastructure environment, this keynote explores the emerging reality of “micro-breaches” and how organisations can improve their ability to detect incidents early, contain impact quickly and continuously learn from disruption.

AI agents are poised to transform enterprise operations, but they also introduce unprecedented identity and security challenges. In this session, HashiCorp and IBM will discuss the emerging risks associated with agentic AI and share a framework for securing autonomous systems through modern identity, access, and governance controls. Discover how leading organizations are preparing to scale AI adoption while maintaining security, compliance, and operational resilience.

New Zealand is moving toward a single critical infrastructure cyber security system defined by shared minimum expectations, increased visibility, and coordinated oversight but built on sectors with very different maturity, capacity, and operational realities. This panel brings together a few critical infrastructure perspectives to discuss how the shift is actually being interpreted on the ground.

• Is a more coordinated cyber security regime seen as incremental uplift or structural change? Where are organisations already aligned?
• Where does coordination help vs create new friction?
• Is resilience still sector-defined, or is it becoming something defined at a system level?

Moderator:

Lee Wainwright Enterprise Account Executive, New Zealand Rubrik

Panellists:

Eli Hirschauge, Head of Info Security ANZ

Laura Ross, CISO One NZ

Speaking the language of business is often presented as the key to securing executive support. But what happens when the board understands the risk and still chooses another priority? This session explores the decision-making dynamics behind executive funding choices and how security leaders can move beyond explaining risk to influencing business outcomes. We’ll delve into:

• What separates funded initiatives from those that fail to gain traction
• Five questions security leaders can use immediately to diagnose why a cyber initiative is not progressing
• Techniques for building support before critical executive and board discussions
• Ways to maintain momentum when a proposal is rejected, deferred, or only partially approved

This plenary presentation explores how organisations can preserve their capacity to defend in an evolving threat environment whilst navigating regulatory complexity, competing priorities and rising expectations for accountability. It will examine the role of stronger partnerships between government, industry and security leaders, and how organisations can take a strategic, risk-based approach to resilience, governance and preparedness without allowing regulatory fragmentation to weaken their ability to respond effectively.

Traditional detection approaches often struggle when malicious actions mimic normal patterns or unfold slowly over time. This case study explores:

• Why detection failures occur in highly dynamic environments
• How insider-like and low-and-slow behaviours evade traditional controls
• Why defining “normal” has become a core detection challenge

Moderator:

Jason Wood Chair ISACA Auckland

Speakers:

Deepak Veerasamy Director of Information Security (Group CISO) Restaurant Brands

 Puva K CISO | Strategy, Governance & Transformation | OT & Critical Infrastructure 

This plenary explores how organisations can better understand and manage data risk across cloud and SaaS environments. As sensitive information becomes more distributed, leaders need greater visibility, clearer accountability, and stronger governance. The discussion focuses on turning data insights into informed decisions that reduce risk and support business objectives.

We will explore three relevant use cases to show "hard to stop" real-world data exfiltration and compliance violations. As organisations accelerate AI adoption, traditional security controls often lack the visibility to understand how sensitive information is being accessed, shared and used. This session explores how security leaders can identify AI-driven data risk, close governance gaps and strengthen control over both human and AI activity. Learn practical approaches to improving visibility, reducing data exposure and enabling secure, responsible AI adoption across your organisation.

As vulnerability volumes continue to grow, many organisations are finding that scanning more does not necessarily translate into reducing real risk. The challenge is shifting focus from identifying issues to actually driving meaningful remediation and prioritisation.

• Prioritisation versus volume-based scanning
• What does remediation reality look like in your environment?
• How are you applying exposure-based thinking to decision-making?
• What actually gets fixed in practice, and why?

As attack surfaces expand across cloud, hybrid environments and third party systems, visibility alone is no longer enough. The discussion looks at how security teams can detect high risk assets, prioritise what matters most, and accelerate remediation before threats are exploited. It also examines how continuous exposure management helps strengthen defensive posture and reduce the window of opportunity for attackers across the enterprise.

This session explores how modern email and collaboration attacks increasingly bypass traditional security controls by targeting people rather than systems. As phishing and impersonation techniques evolve, organisations need to identify subtle behavioural signals that indicate risk. The discussion focuses on how behavioural AI can surface early indicators of compromise in real time, improving detection accuracy and response across the human layer.

This structured debate looks at how AI is reshaping security in the software development lifecycle. With AI now supporting code generation, testing, and security automation, there is growing discussion about whether shift-left security remains the dominant approach, or whether control is shifting toward more continuous, embedded models across the SDLC. Panellists will explore both perspectives through structured opposing views.

Speakers:

Pubudini Prasanna Software Engineering Manager 2degrees

Tracey Bond Head of Engineering Operations NZME

This session explores how organisations can rethink software supply chain security as open source and containerised environments reshape modern development. As risk increasingly originates upstream, reactive patching is no longer enough. The discussion looks at how teams can build trust into the software lifecycle, reduce dependency risk, and adopt secure-by-default approaches through stronger provenance, build integrity, and earlier security integration.

AI is making phishing, impersonation and social engineering more convincing than ever, challenging traditional approaches to human-centred cyber defence. This session explores how one organisation has balanced secure by design principles with behavioural interventions, examining where technology can reduce exposure and remove reliance on human judgement, where people still play a critical role in defence, and how security leaders can build resilience against increasingly sophisticated threats.

Speakers:

Manuel Miguez Service Group Owner - Cyber Operations Westpac NZ

Antoinette Murray Information Security Consultant Westpac NZ

This session explores how organisations can detect and respond to increasingly sophisticated threats that evade traditional security controls. As adversaries use automation, AI and credential-based attacks, visibility alone is no longer enough. The discussion focuses on how security teams can identify subtle behavioural signals, detect early-stage compromise, and respond at machine speed. It also examines how unified endpoint, identity and cloud telemetry helps reduce dwell time and improve defensive effectiveness across increasingly complex and distributed environments.

As an organisation accelerates AI adoption across clinical and non-clinical functions, how can security keep pace? This session explores how to bring together AI for Security and Security for AI, while building a security culture that supports responsible adoption. It would be great if you could discuss how to measure security behaviours and culture in practice, identify meaningful metrics, and demonstrate the impact of awareness initiatives without reducing human behaviour to numbers.

This session explores how to keep messages clear, consistent, and credible under pressure, from briefing executives and coordinating teams to managing regulators and public statements. Learn practical techniques to maintain trust, reduce confusion, and keep everyone aligned when the stakes are highest.

Cyber incidents require fast, coordinated decision-making across leadership teams as organisations navigate uncertainty, operational disruption and competing priorities. Bringing together senior leaders, this session explores key dynamics in real-time incident response:

• How different executive roles frame risk and urgency during a live incident
• What triggers executive escalation and board involvement
• How decisions change as facts emerge and assumptions are challenged
• How leaders align internal and external communication strategies to maintain trust and confidence during a rapidly evolving crisis

Moderator:

Denise Carter-Bennett Co-Chair NZNWS

Panellists:

Catherine Buhler, CISO Fonterra

Shivali Kukreja Head of Risk & Compliance/CRO nib New Zealand

Julie Watson, CIO WorkSafe

Sharyn Reichstein Chief Risk Officer Tower Insurance

New Zealand was an early adopter of cloud services, driven by geography, scalability needs, and resilience expectations. While cloud has changed how enterprises operate, it has also redistributed risk across providers, platforms, and dependencies rather than reducing it.

• Where does cloud-first actually fail in practice: design, operations, or decision latency between teams?
• Which part of the stack is now hardest to secure in reality: identity, data, or the control plane and why?
• What risk are we systematically underestimating in cloud environments today that still doesn’t show up in reporting or dashboards?

Jamie Smith, Head of Architecture, Platforms, Cloud & Security The Warehouse Group

Andrew Meyer, Head of Cyber Security TVNZ

Cristian Ares, Senior Manager - Head of Cyber Security Governance & Compliance SkyCity Entertainment Group  

Matt Ramsey Senior Solutions Engineer Wiz

As executive mandates drive rapid Generative AI adoption, CISOs must safely unlock productivity without exposing sensitive enterprise data. Frontline guardrails alone cannot prevent data leaks if underlying permissions remain chaotic. This session explores the AI security paradox and demonstrates how Zscaler helps customers establish foundational data and identity controls for safe AI deployment.

Supply chain attacks are no longer isolated incidents but part of a broader geopolitical and cyber landscape. This keynote explores what today's threat intelligence is revealing about adversary behaviour, third party risk, and the strategic decisions CISOs can make to strengthen resilience before disruption occurs.

Zero Trust was designed for a world of defined systems, identities, and enforceable boundaries. The environments today challenge these assumptions through continuous change in applications, identities, and access paths.

• Is Zero Trust still a meaningful journey in dynamic AI-driven systems?
• What happens when systems and decisions are continuously changing?
• Can identity realistically remain the primary control plane in SaaS sprawl?
• Is Zero Trust becoming a mindset rather than an enforceable architecture?

Panellists:

Sam Johnstone, Group IT Security Manager Fulton Hogan

Adarsh Lal, Cyber Security Manager REANNZ

Reza Khaleghparast Head of Information Security Naylor Love

Nick Draper A/Head of Cyber & Architecture Foodstuffs South Island

As organisations embrace AI agents, automation, APIs and machine-to-machine workflows, non-human identities are rapidly becoming one of the fastest-growing elements of the digital attack surface. Johan Fantenberg from Ping Identity will explore the security risks created by unmanaged and overprivileged machine identities, from AI agents and service accounts to workloads and applications. Discover how organisations can gain visibility, establish governance and apply identity-centric controls to secure non-human identities, reduce risk and build a foundation of trust across increasingly autonomous digital environments.

A practical, peer-led discussion exploring whether increasing security complexity is actually improving outcomes, or whether organisations are losing focus on foundational controls. Join this interactive session to compare approaches, share your experiences and discuss where simplification could improve overall risk reduction.

• Where are basic controls failing in your environment?
• What security capability is actually reducing risk and what is just adding complexity?
• If you had to simplify your security programme, what would you strengthen first?

Moderator:

Andy Pace Head of Network & Information Security MediaWorks

Speakers:

Shivali Kukreja Head of Risk & Compliance/CRO nib New Zealand

Hassham Idris Manager Cyber Risk and Assurance Ministry of Justice NZ 

This keynote explores how IT and security teams are adapting to rising operational complexity across distributed environments, growing toolsets, and increasing service demands. Explore how teams can streamline workflows, improve coordination across tools and services, and ensure security outcomes remain reliable without adding unnecessary operational overhead.

Security strategy is shaped as much by what organisations choose not to do as by what they implement. This session explores real-world risk trade-offs made by security leaders under operational and resource constraints, and how these decisions influence risk exposure, resilience, and long-term security outcomes.

Enterprise data now flows through SaaS platforms that embed AI capabilities and introduce additional processing layers beyond the original system boundary. Visibility over how data is handled across these environments is increasingly limited. This panel delves into:

• How can organisations maintain visibility over how and where their data is processed?
• Does data sovereignty still hold meaning in AI-embedded SaaS ecosystems?
• How should accountability be assigned when data is processed across multiple third-party AI layers?
• Do current privacy and disclosure expectations (e.g. IPP3A-type obligations) reflect operational reality?

Moderator:

Jason Wood, Chair ISACA Auckland

Panellists:

Eric Troebner, CTO Tax Management NZ

Oleg Zavivaev, Data Security and Privacy Manager Les Mills International

Manuel Miguez, Service Group Owner - Cyber Operations Westpac NZ

This candid discussion explores how security leaders are adapting their workforce, skills, and operating models as humans and machines increasingly work side by side.

• How is AI changing your day-to-day work and expectations?

• Where is pressure increasing on judgment, accountability, and capacity?
• What does the future pipeline of skills, roles, and experience in cyber security teams look like?

Speakers:

Deepak Veerasamy, Director of Information Security Restaurant Brands 

Phil Ross, CISO Air New Zealand

This closing keynote explores how CISOs and security leaders can respond to expanding responsibilities across resilience, risk, workforce capacity, regulatory expectations and evolving threats, while navigating increasingly constrained operating conditions.

• How can leaders respond to growing responsibilities without simply adding more to the load?
• What enables effective decision-making and resilience under continuous pressure?
• How can security leaders foster greater shared ownership and collective action across their organisations?