www.nisc.org.uk – National Information Security Conference (NISC)

Monday 3rd November, 2025

19.30

Welcome Dinner, Megalithic Suite

Tuesday 4th November, 2025

09.45

State of the Art or Art of the State?: Are Teenagers Scarier than Governments? Auditorium: Megalith Suite

Gavin Holt
CISO, Amberwolf

“Scattered Spider” is a name currently echoing around boardrooms worldwide. Allegedly a group of teenagers, they have caused significant financial, operational and reputational damage to organisations across the globe. This impact has captured the attention of senior leaders across all types of organisation who are asking: “Are we vulnerable to Scattered Spider?”

Historically, the ultimate fear for organisations was so-called “Advanced Persistent Threat” (APT) groups, which appeared able to walk through walls to achieve their goals. Typically aligned to governments or acting as proxies for states, these groups are well resourced, patient and precise. Initially driven by intelligence collection, operational effects or geopolitics, some have become financially motivated in response to sanctions on their countries, moving their tactics closer to those of organised crime gangs.

More recently, true organised crime gangs operating from countries that protect them if they avoid domestic targets, armed with ransomware toolkits, enabled by initial access brokers and adopting double-extortion tactics, have been seen as the greatest risk to organisations. Now, many organisations perceive their biggest threat to be phone calls from teenagers, leading to the same operational disruption, reputational damage and financial cost previously associated with being targeted by states or criminal gangs.

This session will examine how these three different types of threat actor (APT groups, organised crime gangs and teenage collectives) operate. It will question why organisations appear to be faring worse against attackers with fewer resources than the previous generation, despite being armed with better defensive tools. Finally, it will suggest defence-in-depth activities that improve organisational resilience and impose costs on attackers, regardless of their resources.

11.15

Panel Session: Combating the AI Firehose: Prioritising Assets, Strengthening Defences Auditorium: Megalith Suite

Rois Ni Thuama
Governance Expert
Nick Truman

Head of Information Security, Nscale
Helen Faulds

CIO, Cora Health

Digital transformation isn’t just about adopting new technology — it’s about reshaping how organisations operate. Security transformation must do the same: updating governance, risk prioritisation, and defences so they can run at machine speed, not human speed.

In this panel session, security expert, Rois Ni Thuama set the scene with why assets should be the centre of your strategy and how to strengthen your defences. Rois will then be joined by fellow panellists while they debate the pros and cons of AI leaving delegates with practical, actionable insights to strengthen their defences.

20.00

Conference Networking Dinner, Megalithic Suite

Wednesday 5th November, 2025

11.15

The EU Cyber Resilience Act: Compliance Strategies for UK Organisations Breakout Room 1

Dr. Ryan Shah

DPO & Senior Security Consultant, Sapphire

The EU Cyber Resilience Act represents the most significant cybersecurity legislation to emerge from Brussels in recent years. Despite Brexit, UK businesses cannot afford to overlook this regulation - those with European customers, suppliers, or operations will find themselves directly affected when enforcement begins in 2027.

This session examines the Act's core requirements and explores what compliance means for UK businesses operating in an increasingly connected regulatory landscape. We'll focus on practical implementation challenges rather than theoretical frameworks, drawing from early industry experiences and regulatory guidance to provide actionable insights.

The discussion will cover three key areas: first, we'll dissect the Act's scope and requirements, identifying which products and services trigger compliance obligations. Second, we'll assess the specific implications for UK organisations across different sectors, examining how existing cybersecurity programs may need to evolve. Finally, we'll address the operational challenges many businesses are already encountering, from supply chain due diligence to certification processes, and discuss emerging approaches to managing compliance costs and timelines.

Participants will gain a clear understanding of their potential exposure under the Act and practical strategies for developing compliant cybersecurity practices. The session includes time for peer discussion and Q&A, recognising that many organisations are grappling with similar implementation questions.

11.15

Come and Meet the Most Dangerous Person on the Internet Breakout Room 3

Rob Vann

CEO & Founder, MXDR Ltd

In an age where artificial intelligence is becoming not just a tool but an agent, we are beginning to outsource more and more of our decisions, interactions, and even trust to systems that act on our behalf. These AI agents can send messages, make purchases, negotiate, and even mimic our voices and personalities. But with this new power comes a dangerous shift—when we hand them agency, we also hand over the risks that come with it.

Unlike humans, these digital agents don’t carry intuition, context, or moral hesitation. They can be deceived, manipulated, or repurposed with frightening ease. The same protections that would stop you from being tricked or coerced don’t exist in the same way for the algorithms acting in your name. And that gap creates a perfect opening for exploitation.

So when we talk about “the most dangerous person on the internet,” we’re not pointing to a criminal mastermind lurking in the shadows, we aren’t even asking each of you to look in the mirror —it’s something far more elusive. It’s the invisible, tireless, agentic AI, capable of acting, or being exploited to act as anyone and everyone. The real danger isn’t in the technology itself, but in what happens when we give it the keys to our identity, our judgment, and our actions.