A risk-based approach to cybersecurity has been core to many organisations' attitude towards the evaluation of emerging technologies to fulfil a business need. However, with the recent advancements in applied AI and the resulting ways of working, we will share some of the observations how organisations both within and outside the financial services sector have been able to not only adjust, but to embrace these changes to create technical competitive advantage.

The next stage of AI - generative AI - promises unprecedented disruption of the financial services industry. Some use case, such as real-time automated threat detection are already well developed. As financial services firms incorporate these new applications across their IT systems and networks, they will need to be alert to the potential new threats these technologies bring. Cyber criminals, for instance, utilise the same technologies to exploit cyber vulnerabilities. They must also be aware of emerging regulations around the responsible use of AI the potential liability they carry for output bias, copyright infringement, fairness and privacy.  Financial services firms should prepare to identify and mitigate these risks, to protect their data, intellectual property and reputation.

• How will generative AI and other large language models (LLM) transform financial services, cyber risk and cyber risk management approaches?
• What does responsible use of AI from a cyber perspective look like - how do we achieve the right balance between security and innovation?
• How can we de-risk AI models? What governance structures and guardrails need to be put in place?
• In the AI arms race, who has the upper hand, attackers, or defenders?
• How are regulations such as EU AI Act and the US government’s Executive Order on Safe Secure and Trustworthy Artificial intelligence impacting approaches to AI security?

With the upcoming Digital Operational Resilience Act (DORA) set to reshape risk management in financial services, understanding supply chain vulnerabilities is more crucial than ever. Risk Ledger's webinar, “Identifying Concentration Risk and Securing the Supply Chain,” will provide valuable insights into how businesses can tackle concentration risk within their supply chain. Built on insights from our latest whitepaper, the session will guide you through practical steps to identify critical supplier dependencies, mitigate risks, and strengthen your supply chain's operational resilience. Join us to learn how to proactively secure your operations against disruptions, align with regulatory expectations, and ensure compliance with DORA's stringent standards for third-party risk management.

Developing a strong security culture within financial institutions is a critical challenge in today's threat landscape. Traditional security awareness programmes often struggle to drive lasting behavioural changes in the finance sector. This session explores the power and role of "nudges" – subtle environmental cues and design elements that can positively influence employees' security-related behaviours in financial organisations.

Changing behaviours is a challenging task, and transforming your organisational culture in the finance industry can be even more difficult. Understanding why social engineering works in banking environments, or how errors are so frequently made in financial transactions, requires a better understanding of oneself and the unique pressures of the sector. Grounded in the principles of behavioural economics and mindsets, attendees will learn practical strategies to educate, inform, nudge, and ultimately influence the culture of their financial workforce towards better security practices.

As investors and potential business partners seek new evidence of cyber risk from the companies they invest in or do business with, financial service companies are increasingly having to quantify the risk they hold, and attest that these risks are being mitigated, managed and governed. The recent US SEC Cyber Risk Rule, requiring that companies disclose and report material risk sets a benchmark for how disclosure regimes might develop in future. Compliance can bring business  value in terms of recognition as a partner of choice through adherence to sound business management practices.

• How are financial service companies integrating cyber risks in their ESG initiatives? How are rating agencies, prospective business partners, ESG and other investors viewing cyber risk into their analysis, decision-making and investment strategies?
• What are the challenges of meeting new cyber disclosure and reporting standards? How are financial institutions identifying, quantifying, and managing risk? What constitutes materiality with regards to cyber risk?
• How are the new metrics helping security leaders ‘speak the language of businesses’, and are they reaping the benefits in terms of enhanced senior management engagement in cyber security, financial support for cyber projects, or improved shareholder returns?
• How can we measure the success of cyber security initiatives? Should cyber leaders’ remuneration be tied to security goals, and what KPIs could underpin the targets?

We will begin by discussing how an event over two hundred years ago led to the inception of financial regulation and then go on to explore how we can ease the current burden of security compliance through automation and digital modelling.

AI is being adopted simultaneously into different digital platforms. In this new era of hyper-connectivity and digital transformation, once trusted traditional cyber security paradigms need a zero trust makeover. Therefore in this era of commoditised AI, there needs to be a rethink of what it now means to be secure and how to deal with both the advantages of AI and the risks to cyber resilience. This session will address:

• Signs of the times - the new risks
• Key challenges for CISOs and cyber managers
• How to overcome key challenges
• How to contain a breach
• How to plan for business continuity

AI has created a more powerful toolbox for cyber criminals. Almost every organisation wants to adopt AI, and more than 50% of organisations are already doing so. The challenge, however, is that the attack surface is increasing, and AI is turbocharging the speed and scale of cyber attacks.

The average organisation can no longer stop a breach. Organisations that developed a cyber strategy over ten years ago are still using traditional security incident and event monitoring solutions.

This presentation will discuss:

• Understand your business context for AI
• Ensure AI visibility and employee use
• Develop a company-wide AI policy aligned with regulations and laws
• Protect the AI supply chain

Drawing on our recently published Finance Sector Threat Report, Trustwave will examine the evolving threat landscape and the importance of an offensive security strategy and robust governance. This approach is not only vital for defending against emerging threats but also for fostering a proactive stance and ensuring compliance with regulations such as DORA. Trustwave want the audience to reflect: Are you actively driving your offensive security program and confident in its value and effectiveness?

As technology advances and geopolitical tensions evolve, the cyber threat landscape becomes increasingly intricate. The resilience of our organisations relies on strengthening our human defences. In this insightful session, Thomas Own (CISO, SoSafe) will share key findings from SoSafe’s ‘Human Risk Review 2024’, shedding light on the changing nature of cyber threats and presenting practical strategies for your organisation.

Thomas will discuss the inversion of the threat actor pyramid, illustrating how human risk has become a crucial element in addressing cybercrime. Attendees will learn how to move from basic awareness to meaningful behaviour change, fostering resilient cultures that empower employees to act as a vital line of defence against cyber threats. Join us to explore the potential of humans in enhancing cybersecurity.

In financial services, where data security and operational resilience are paramount, network security must evolve beyond traditional approaches. Micro segmentation has long been heralded as the final component of a Zero Trust framework—a critical defense against lateral movement and ransomware attacks. However, legacy micro segmentation solutions are often plagued by complexity, high costs, and lengthy deployment times, creating a significant barrier for many financial organizations.

This session will demonstrate how today's micro segmentation can be implemented in 30 days, leveraging automated rule creation and patented just-in-time MFA to secure privileged ports. By starting with an agentless, MFA-enhanced micro segmentation approach, organisations can bypass legacy obstacles, establishing a resilient zero trust foundation from day one. Protect your financial assets and operations while leaving attackers stranded and penniless.

Powered by rapid advances in generative AI, online manipulation tools including deepfakes using synthetic voices and images, and sophisticated disinformation campaigns are gaining in prominence. Deepfakes that consistently beat biometric-based authentication are becoming a reality, while credible seeming disinformation is eroding confidence in the legitimate data and communications that companies disseminate. Financial service firms will need to accelerate their innovation to keep pace.

• What is the impact of AI on financial fraud?
• How do we raise awareness among employees and customers, better enabling them to distinguish between authentic and false images, voices and narratives?
• How big a problem are these tools in reality – could we see fraudulent material trained and used at industrial scale?
• How are cyber technologies and tools, for instance ‘disinformation-as-a-service' of the cybercriminal in this space evolving?
• How are technologies such as watermarking and labelling, as well as deepfake detection tools and risk management strategies adapting to address the challenges?

Operational resilience is more critical than ever for financial institutions, especially as they prepare to meet evolving regulatory requirements like DORA. Richard Meeus, Senior Director of Security Technology and Strategy at Akamai will share how leveraging strategic visibility and advanced discovery tools can strengthen resilience by uncovering hidden risks across IT infrastructure, applications, and APIs. Attendees will learn how to identify and inventory digital assets, integrate visibility for better monitoring, and apply practical steps to continuously safeguard their operations. This session will provide actionable strategies to enhance security, ensure compliance, and maintain business continuity in today’s complex regulatory environment.

Despite best efforts at defence and prevention, serious cyber incidents are happening with growing frequency. Ransomware attacks, for instance, increased by 93% in 2023. Even with  payments made to their adversaries, some 56% of victims of these events failed to have their data fully reinstated by their attackers. Backups were also compromised during many of the reported incidents. With regulators and investors now placing greater emphasis on resilience and trust through enhanced reporting requirements, financial services companies will need to prepare, prioritise and test robust recovery plans that minimise the impact of an attack on customer trust, investor confidence and company reputation.

• How is the nature of cyber incidents - the players and the tactics - changing?
• What are the factors most commonly impeding an effective response to a material cyber incident and what are the key considerations for building a robust cyber response plan?
• What are the lessons and insights from recent cyber incidents? How do you navigate a road out of a ransomware attack?
• How is the regulatory landscape relating to cyber incidents evolving?