Invited Speaker

The talk opens by defining cyber resilience as an organization's ability to keep operating during a cyber attack or a failed software integration. A hospital that loses its systems and must still admit patients serves as the example. The speaker links this to two 2024 events: a healthcare breach caused by missing multifactor authentication, and a worldwide outage triggered by a faulty security software update. Both pushed organizations to bring development, operations, legal and security teams together.

The middle section draws on survey data from her research at LevelBlue. It covers how AI makes phishing, voice calls and deepfake video more convincing, and how a group of young, English-speaking social engineers targeted help desks, UK retailers and a major car manufacturer. The data also shows that few organizations have a formal incident response plan or check cyber security during acquisitions, and that many have little visibility into their software suppliers, even though CEOs list the software supply chain among their top risks.

The closing section offers four steps: raise awareness of resilience, define what it means and who owns it, attach security metrics to every leader, and review third-party security practices on a regular schedule. In the question period, she advises reporting incidents to the board by business impact rather than every minor event, and says a codified response plan helps build the customer trust boards care about.