Registration, networking and exhibition

Day one opens

A welcome session for newcomers offering an opportunity to meet fellow delegates and the Jisc team, while providing guidance on how to maximise your experience both at the conference and within the community.In this ice-breaker session, for anyone new to the Security Conference or community, you’ll have the chance to meet the others attending the conference and the Jisc team. You can find out how to make the most of your time at the conference and in the community. When we defend as one we are stronger.

Community meet-up: welcome to Security Conference (for new attendees)

A welcome session for newcomers offering an opportunity to meet fellow delegates and the Jisc team, while providing guidance on how to maximise your experience both at the conference and within the community.

Bella Abrams, Jisc's group chief technology officer, welcomes you to Security Conference 2025 and provides an overview of what you can expect from this year's event.

Welcome to Security Conference

Bella Abrams, Jisc's group chief technology officer, welcomes you to Security Conference 2025 and provides an overview of what you can expect from this year's event.

David Batho, director of security at Jisc, provides this year's security strategic update.The Security Conference will focus on the key strategic challenges facing the sector amid an ever-changing cyber landscape from high-profile incidents to emerging risks that continue to shape how we operate. We will explore how the threat environment has evolved over the past 12 months and how Jisc and the wider community are responding to strengthen resilience, improve protection, and keep members better informed and prepared for the challenges ahead.

Jisc strategic update

David Batho, director of security at Jisc, provides this year's security strategic update.

An opening keynote on the topic of cyber resilience delivered by Major-General Jonathan Shaw, the first ever head of the Defence Cyber Security Programme at the Ministry of Defence.

Cyber resilience 

An opening keynote on the topic of cyber resilience delivered by Major-General Jonathan Shaw, the first ever head of the Defence Cyber Security Programme at the Ministry of Defence.

Morning break

Learn how Mimecast's comprehensive Human Risk Management platform protects collaboration regardless of the attack.AI is vital for business email compromise (BEC) defence, but it must be integrated with traditional methods to manage false positives and management tasks. Join us where we dissect the intricacies of BEC attacks, and find out how Mimecast's Human Risk Management platform provides actionable insights for targeted mitigation strategies. Mikey Molfessis, senior manager for sales engineering at Mimecast will share invaluable insights into safeguarding your organisation's email communications.

Why AI alone isn't enough to stop advanced attacks

Learn how Mimecast's comprehensive Human Risk Management platform protects collaboration regardless of the attack.

Attendees will leave with practical insights, peer experiences, and a forward-looking perspective on how to strengthen resilience in the face of AI-powered.The education sector faces mounting cyber security pressures, with adversaries becoming increasingly resourceful in exploiting gaps across people, processes, and technology. AI is accelerating this challenge, enabling attackers to scale operations, automate reconnaissance and evade detection in ways that are increasingly difficult to counter with traditional defences.In this session, CrowdStrike experts will share real-world stories from the front line, showing how adversaries are weaponising AI to strengthen their attacks. We will explore the evolving threat landscape, with a focus on multi-domain attacks that blend tactics such as phishing, ransomware, and supply chain compromise to disrupt universities and colleges.Alongside these insights, delegates will hear perspectives from the education community, including how collaboration with Jisc is helping to simplify cyber security procurement and support institutions facing these challenges.Finally, our session will showcase how AI-driven security can work for good, demonstrating how agentic AI within the CrowdStrike platform can reduce days or hours of work to minutes or seconds, allowing constrained security teams in HE/FE to operate more effectively with limited resources.Attendees will leave with practical insights, peer experiences, and a forward-looking perspective on how to strengthen resilience in the face of AI-powered.

Clash of intelligence: how AI shapes both attack and defence in education

Attendees will leave with practical insights, peer experiences, and a forward-looking perspective on how to strengthen resilience in the face of AI-powered.

Join members of Jisc's cyber security community steering group for informal table discussions.Jisc's cyber security community steering group brings a wealth of knowledge to our community. In this session, members of the group will each host a table discussion where you can ask them anything. Take this opportunity to speak with senior leaders in the sector in an informal setting.

Community meet-up: cyber community steering group take-over - ask me anything

Join members of Jisc's cyber security community steering group for informal table discussions.

A first hand account of a cyber incident at Loughborough College, with lessons learnt and recovery tactics.When a cyber incident strikes, chaos often follows, but resilience can rewrite the narrative. This session offers an account of how Loughborough College faced a cyber incident, detailing the immediate fallout, the co-ordinated response, the recovery achieved and lessons learnt for the future.

Cyber incident recovery: a college’s journey

A first hand account of a cyber incident at Loughborough College, with lessons learnt and recovery tactics.

Discover how ethical hacking events boost organisational resilience and nurture future security talent—inspiring scalable, collaborative adoption to turn vulnerabilities into a collective strength.This session shows how Jisc's sister NRENs SURF (the Netherlands) and Switch (Switzerland) leverage student talent to improve cyber security through ethical hacking events. Called HALON (Hack All of Education) and ROESTI (Reporting Open and Exploitable Security Threats and Issues), these initiatives pair students with volunteering institutions to identify vulnerabilities via coordinated vulnerability disclosure (CVD). This fosters skill development while strengthening institutional defences. Over four years, HALON and ROESTI have uncovered critical vulnerabilities, proving the model’s effectiveness. Beyond technical gains, the events spark enthusiasm among newcomers and allows experienced hackers to show their skills. They also promote CVD policies and security.txt adoption, part of a proactive, community-driven offensive security approach, turning institutional transparency into collective resilience while normalising ethical hacking as a force for good.

Making yourself vulnerable to become less vulnerable

Discover how ethical hacking events boost organisational resilience and nurture future security talent—inspiring scalable, collaborative adoption to turn vulnerabilities into a collective strength.

A session to explore scalable, practical approaches to software asset management (SAM) through centralising procurement, improving audit trails, and using tools for discovery and entitlement tracking.Software asset management (SAM) is not just an operational necessity, it's a strategic tool for reducing unnecessary spend, mitigating compliance risks, and improving visibility across complex estates. This session builds on Jisc’s new blog series and insights from institutions navigating fragmented software estates, shadow IT, and inconsistent licensing practices.We will explore scalable, practical approaches to centralising procurement, improving audit trails, and using existing tools for discovery and entitlement tracking. A key focus will be on licence compliance and the risks posed by non-compliance, with special attention to the often-overlooked challenge of ensuring software is used strictly within the rights granted by the End User Licence Agreement (EULA).For senior leaders, SAM provides a clear opportunity to align software oversight with institutional risk management and financial strategy. This session will highlight how incremental improvements can deliver measurable impact in cost control, compliance assurance, and operational resilience.

Software asset management: enhancing visibility, reducing vulnerability

A session to explore scalable, practical approaches to software asset management (SAM) through centralising procurement, improving audit trails, and using tools for discovery and entitlement tracking.

Learn cyber security processes through gamification. Booking required - a link to book will be sent to all in-person delegates.Cyber escape room 1: Stolen dataSensitive data has been stolen. Your mission: solve intricate puzzles, decipher hidden codes, crack passwords, and breach digital defences to stop a dangerous threat actor from leaking the stolen information onto the dark web.Cyber escape room 2: digital forensicsThe breach has already happened. Time is running out. Your mission: extract digital artefacts, reconstruct the timeline of the attack, and expose the threat actor before they vanish into the shadows. Every second counts—can you crack the case before it’s too late?

Jisc cyber escape rooms (booking required)

Learn cyber security processes through gamification. Booking required - a link to book will be sent to all in-person delegates.

This session explores how generative AI is introducing new cyber threats and why organisations must prioritise transparency, accountability, and proactive security strategies to manage emerging human risks.Generative AI is reshaping the cyber security landscape, introducing threats like deepfakes and automated phishing, which often rely on potentially sensitive data. This session highlights the need for transparency, fairness, and accountability, and underscores why organisations must equip security teams with tools and strategies to swiftly detect and address emerging human risks in the modern workplace, balancing innovation with protection.

Secure your workspace by getting more gAIn than pAIn from AI

This session explores how generative AI is introducing new cyber threats and why organisations must prioritise transparency, accountability, and proactive security strategies to manage emerging human risks.

Discover how threat intelligence is collected, refined and shared at Jisc to strengthen collective defence. Share feedback and help shape the future of our intelligence capabilities.Effective cyber defence relies not just on collecting threat intelligence, but on how that intelligence is shared, refined and applied across the community. In this session, we’ll explore our approach to intelligence collection, how we transform data into actionable insights and why collaboration is critical in strengthening collective resilience. We’ll also open the floor for feedback on our intelligence products to ensure they are meeting the real-world needs of our community. Join us to learn, share and help shape the future of our intelligence capabilities.

Community meet-up: effective cyber defence through threat intelligence

Discover how threat intelligence is collected, refined and shared at Jisc to strengthen collective defence. Share feedback and help shape the future of our intelligence capabilities.

Gain awareness of the ISO27001 and the resources required to implement and pass the certification.This session looks at how this standard and certification compares to others such as CE Plus. It looks at the processes required during implementation and who needs to be involved. From the perspective of implementing this within Milton Keynes College, we will look at how this has changed our approach to cyber security and the organisational benefits.

Benefits and resources required to implement and achieve ISO27001

Gain awareness of the ISO27001 and the resources required to implement and pass the certification.

Session coming soon

Lunch break

Discuss Jisc security service roadmaps and how future developments can align to your needs with Jisc security service owners.Meet with Jisc security service owners, to talk about the roadmaps and how each can develop in line with your needs. Services represented: <ul><li>DDoS mitigation services (critical service protection and foundation plus) including DDoS development</li><li>Development to the Jisc cyber security hub</li><li>Professional assurance services (including Pen Testing, Cyber Essentials (CE) and CE+, CSA)</li></ul>

Community meet-up: shaping Jisc security services

Discuss Jisc security service roadmaps and how future developments can align to your needs with Jisc security service owners.

Find out how exposure management empowers higher education IT.This lightning talk will explore how to implement an exposure management programme within a highly complex education environment.

Breaking down silos: how exposure management empowers higher education IT

Find out how exposure management empowers higher education IT.

Gain insight into how institutional infrastructure is viewed externally and why inviting open doors and windows could and should be closed and locked.Join Jisc’s cyber intelligence team as they unveil insights from recent sector-wide attack surface management (ASM) scans. Using .ac.uk domain data and Janet Network IP ranges as starting points, Jisc has built a comprehensive view of the sector’s exposed assets and potential vulnerabilities. This session explores how this work helps universities and colleges identify risks, reduce exposure, and strengthen collective resilience across UK education and research.

Understanding the sector's attack surface

Gain insight into how institutional infrastructure is viewed externally and why inviting open doors and windows could and should be closed and locked.

A look into the escalating threats facing academia, the risks posed by AI, and why fragmented defences are no longer sustainable.Higher education is facing a cyber "perfect storm". Ransomware, data theft and nation-state attacks continue to surge, while emerging technologies like AI are being weaponised to supercharge phishing, automate exploits and target valuable research. At the same time, universities are challenged by open networks, diverse user populations, and stretched IT and security resources—making them uniquely vulnerable.This session will cut through the noise to examine the escalating threats facing academia, the risks posed by AI, and why fragmented defences are no longer sustainable. Attendees will learn how a unified, consolidated security platform can deliver stronger protection, greater visibility, simplified operations, and reduced costs, helping institutions not just withstand today’s storm, but build lasting resilience.

Beyond firefighting: how universities can stay ahead of cyber threats with smarter, unified security

A look into the escalating threats facing academia, the risks posed by AI, and why fragmented defences are no longer sustainable.

Explore Jisc's security operations centre evolution, threat trends, integrated intelligence, sector insights, and future roadmap for enhanced cyber security resilience.This session explores the evolution of Jisc's security operations centre (SOC), from its inception through to the services delivered today. We’ll share key lessons and stories from the journey so far, highlight emerging threats and attack trends we are seeing across the sector, and discuss how integrated threat intelligence and the wider Jisc security ecosystem strengthen protection. Finally, we’ll look ahead to the future roadmap and how these insights will shape the SOC's continued evolution.

Inside the Jisc SOC: our journey, lessons learned and emerging insights

Explore Jisc SOC evolution, threat trends, integrated intelligence, sector insights, and future roadmap for enhanced cybersecurity resilience.

In an era where AI-driven automation is transforming industries, it's also redefining the threat landscape for web applications.This session explores the growing impact of AI scraper bots, sophisticated crawlers capable of bypassing traditional defences to harvest data at scale - and how to respond using innovative countermeasures.

Beating the bots: Are AI scrapers outpacing web application firewalls?

In an era where AI-driven automation is transforming industries, it's also redefining the threat landscape for web applications.

A real-world case study from The Manchester College and Cloudflare, revealing how malicious bots are targeting UK education institutions.In this session, learn about the evolving cyber threats facing higher education and the unique security challenges the sector must navigate. Discover how The Manchester College, in collaboration with Cloudflare, is protecting its network through a layered approach that enhances existing protections without duplication. This talk addresses critical cyber security gaps, helping budget-constrained institutions safeguard their data, infrastructure, and users more effectively.

Cloudflare and The Manchester College: proactive protection for education

A real-world case study from The Manchester College and Cloudflare, revealing how malicious bots are targeting UK education institutions.

Join the FE heads of IT regional forums for peer-led table discussions on key cyber topics, from user communication and delivering successful phishing campaigns to staffing, conversations with the board, and bot/content scraping.Our FE heads of IT regional forums are a space for peers to share challenges and problem solve together. In this session, participants will be able to choose from table discussions on a range of topics relevant to FE and cyber:<ul><li>Bringing the human element to security - how to communicate with users</li><li>Staff/student ratios and what staffing levels are needed particularly for multi-campus colleges</li><li>Delivering successful phishing campaigns, how to make them effective</li><li>Raising the level of conversation to the board – best practice on helping your board understand cyber threat</li></ul>

Community meet-up: FE focused cyber knowledge café - hosted by the FE heads of IT regional forums

Join the FE heads of IT regional forums for peer-led table discussions on key cyber topics, from user communication and delivering successful phishing campaigns to staffing, conversations with the board, and bot/content scraping.

In this presentation you will learn how to approach awareness as a process with examples on how to implement this process.Isolated awareness campaigns rarely lead to lasting behavioural change. That is why Dutch research and education institutions have teamed up with Jisc's sister NREN SURF (the Netherlands) to develop a new process-based approach to cybersecurity awareness campaigns. This process based approach ties in with the institution's Plan-Do-Check-Act cycle. Key to this approach is to structure and incorporate existing models like the SANS awareness maturity model and the COM-B model. We also put the process to the test with two proof of concepts in Dutch universities. In this presentation you will learn all about this process, how to implement it, and what it delivers.

From awareness to behavioural change: a structured approach to awareness 

In this presentation you will learn how to approach awareness as a process with examples on how to implement this process.

Learn how NCSC’s Share and Defend capability uses shared threat intelligence to block malicious domains, enhancing protection for users and supporting national cyber resilience. Discover how the NCSC is enhancing national cybersecurity through its latest capability, Share and Defend.This session explores how the NCSC collaborates with threat intelligence providers, security vendors, and internet service providers to identify and block malicious online infrastructure. By sharing real-time data on harmful domains and indicators, the initiative enables DNS-level filtering that protects users across the UK from accessing malicious content.Attendees will gain insight into how this proactive approach reduces exposure to online threats and strengthens collective cyber defence. Whether you're a technical specialist, policy lead, or industry partner, this session will highlight how shared intelligence can drive impactful protection at scale.

Share and Defend: disrupting malicious infrastructure at scale 

Learn how NCSC’s Share and Defend capability uses shared threat intelligence to block malicious domains, enhancing protection for users and supporting national cyber resilience. 

Learn how Jisc's CSTM service can provide all-important 24/7 threat monitoring.Discover how Jisc's cyber security threat monitoring (CSTM) service gives full visibility of your institution's cyber posture using the latest machine learning algorithms informed by the best threat intelligence. The session will show how CSTM helps repel attacks thanks to its clever design and features, including its integration with the Janet Network, log analysis and easy to understand alerts. Attendees will also find out how to access Jisc's CSIRT service for rapid incident guidance as part of the CSTM service.

Simple, straightforward 24/7 security management for education - Jisc's cyber security threat monitoring (CSTM) service

Learn how Jisc's CSTM service can provide all-important 24/7 threat monitoring.

Afternoon break

Bitdefender will share recent research on the most commonly exploited tools and outline proactive strategies to protect against LotL techniques.Living off the Land (LotL) attacks create opportunities for cybercriminals to leverage trusted, pre-installed system tools to carry out malicious activities without deploying traditional malware. Academic environments are especially vulnerable to these types of attacks given their vast, open networks and constrained budgets. Bitdefender will review how threat actors are exploiting common administrative tools like PowerShell, WMI, and Bitsadmin to evade detection and maintain a persistent presence within an organisation. We will examine what the most commonly exploited tools are based on recent research performed by Bitdefender – the results may surprise you. We'll also explore the critical shift from malware detection-based security, highlighting why legacy defences fail to protect against these fileless attacks. Our presentation will include proactive defence strategies to protect against LotL techniques such as:<ul><li>Behavioural monitoring: implementing extended detection and response (XDR) solutions to identify anomalous use of legitimate tools</li><li>Principle of least privilege: restricting user and process access to only what is absolutely necessary</li><li>Bitdefender’s own dynamic solution that prevents unauthorised use of native tools.</li></ul>By adopting a proactive, multi-layered, preventative-focused approach organisations can significantly reduce their attack surface and build resilience against this sophisticated and evasive threat.

Protecting against living off the land attacks

Bitdefender will share recent research on the most commonly exploited tools and outline proactive strategies to protect against LotL techniques.

Join discussion groups on engaging senior leaders in cyber security. Explore common communication barriers, effective strategies, and share experiences to support and influence leadership understanding and action.Come and join discussion groups with your peers about how senior leaders understand cyber security: What are the barriers that you encounter when communicating with senior leaders about cyber security? What tactics help to break down these barriers, deliver the right message and encourage support and action? Share your experiences and talk to others about what challenges they face and what is working for them.

Community meet-up: communicating with senior leaders about cyber security - hosted by the digital leadership and culture community

Join discussion groups on engaging senior leaders in cyber security. Explore common communication barriers, effective strategies, and share experiences to support and influence leadership understanding and action.

Understand the timetable, risks, dependancies and some examples of work already underway.This session will explore post quantum cryptography migration, the timetable, why it matters, and some early experiences in identifying systems and services that may be at risk.

Preparations for the post-quantum cryptography migration

Understand the timetable, risks, dependancies and some examples of work already underway.

How to implement a no-blame, ethics-first phishing programme that listens to staff feedback and build simple, but effective, phishing response automation.What happens when your phishing programme creates more problems than it solves? The Open University faced this exact challenge. A well-intentioned process of manually triaging all phishing reports had become a significant resource drain. Worse, traditional simulations intended to understand the culture backfired, causing severe staff backlash that eroded trust. This session details the remarkable turnaround, showcasing how our model, built on a mixture of open communications, empathetic engagement and automation - transformed a reactive process into a proactive defence. We will share our playbook for turning staff from a point of friction into valuable security assets, demonstrating how this approach dramatically improved both training uptake and the overall reporting culture.

From phish food to phish finders: how we built a phishing programme people actually liked

How to implement a no-blame, ethics-first phishing programme that listens to staff feedback and build simple, but effective, phishing response automation.

Explore Microsoft’s RAMP and Tiered Admin Model to enhance hybrid security with practical guidance on privilege structuring, threat reduction, and cloud-first Active Directory management strategies.This practical training session explores how Microsoft’s RAMP framework and the Tiered Active Directory Admin Model can be applied to strengthen hybrid security environments. Attendees will gain actionable insights into structuring administrative privileges, reducing attack surfaces, and aligning Active Directory management with cloud-first security best practices. The session will combine real-world scenarios with step-by-step guidance to help security teams adopt a tiered admin approach that balances usability, compliance, and resilience against modern threats.

Training session: Microsoft RAMP and the Tiered AD Admin Model for maximising hybrid security

Explore Microsoft’s RAMP and Tiered Admin Model to enhance hybrid security with practical guidance on privilege structuring, threat reduction, and cloud-first Active Directory management strategies.

Join us as Henry Hughes, Jisc's chief technology officer for security, offers closing thoughts from day one of the event, before opening the networking drinks reception in the exhibition space.

Closing thoughts

Join us as Henry Hughes, Jisc's chief technology officer for security, offers closing thoughts from day one of the event, before opening the networking drinks reception in the exhibition space.

Join us for a networking drinks reception taking place in the exhibition hall to close the first day of the conference.

Networking reception

Join us for a networking drinks reception taking place in the exhibition hall to close the first day of the conference.

Day one closes

Day two opens

This closed door workshop aims to identify gaps and future opportunities for reduced costs, better deals and compliant procurement and licensing solutions for our members.Education and research institutions face rising cyber risks, budget pressures, and regulatory scrutiny. In this closed-door workshop, exclusive for our members, attendees are invited to discuss the current challenges in the cyber security space around procurement compliance, licensing complexity, high costs and monopolistic software vendors.The session will be facilitated by Jisc colleagues from procurement, licensing and cyber threat intelligence. With a focus on the future of cyber security, Jisc is keen to understand how to support our members in delivering against compliance and regulatory pressures and in navigating budget constraints through aggregated demand.

Smarter procurement and licensing for safer institutions 

This closed door workshop aims to identify gaps and future opportunities for reduced costs, better deals and compliant procurement and licensing solutions for our members.

Simon Cooper, Jisc's head of security services welcomes you to day two of Security Conference 2025 and provides an overview of what you can expect from the second day.

Welcome to day two

Simon Cooper, Jisc's head of security services welcomes you to day two of Security Conference 2025 and provides an overview of what you can expect from the second day.

Jisc members from FE and HE share real cyber attack experiences, recovery lessons and resilience strategies in this insightful, practical keynote panel discussion.In this keynote panel, Jisc members from both further education and higher education institutions share their firsthand experiences of facing and responding to cyber breaches.This session offers honest insights into the challenges of dealing with a cyber incident, from technical recovery to leadership and communication. The panellists will discuss how they responded, what they learned and how they built resilience for the future.Whether you're in a strategic role, management, or support, hear what it’s really like to face a breach and how to come back stronger.

From breach to resilience: personal accounts of cyber attack and recovery

Jisc members from FE and HE share real cyber attack experiences, recovery lessons and resilience strategies in this insightful, practical keynote panel discussion.

This talk will explore the impact of AI on cyber security, looking beyond the hype to examine its defensive and offensive roles and how Sophos leverages AI to protect and educate.We’ve all heard that there’s a global shortage of cyber security professionals leaving organisations vulnerable. We’ve heard that criminal gangs are exploiting AI to better attack us, but how much of that is just hype? Is AI a serious player in defence or attack? In just ten minutes, we will highlight some of the positives and negatives of AI and how we at Sophos use it to better defend, educate and inform ourselves and our customers.

Source for the goose, source for the gander? AI and the cyber skills gap for attackers and defenders

This talk will explore the impact of AI on cyber security, looking beyond the hype to examine its defensive and offensive roles and how Sophos leverages AI to protect and educate.

Join Proofpoint as they present threat research on higher education that can help colleges and universities across the UK to better understand today’s advanced attacks.Cyber criminals have become adept at using social engineering techniques to target individuals with highly persuasive and personalised messages. It is no surprise that email remains the number one attack vector. It is more important than ever to safeguard your department, students and staff against increasingly sophisticated attacks with a human-centric security strategy. But what does that mean? All will be revealed as we dive into a vast pool of threat intelligence to determine the most prevalent cyberattacks experienced by colleges and universities today. Have you ever wondered what departments might be most targeted in your institution? Do you know where to prioritise your efforts in order to protect your staff, students and research? How has AI changed the tactics of attackers? Join us and you will leave with actionable intelligence that will help you to form a more resilient organisation.

Protecting colleges and universities: human-centric security for higher education

Join Proofpoint as they present threat research on higher education that can help colleges and universities across the UK to better understand today’s advanced attacks.

This is your community! Join us to discuss your cyber community and its activities.We would like to hear your views and work together evolving the community. How would you like to see the Jisc cyber community evolve? What are the key challenges you would like the community to support? How would you like to work together?

Community meet-up: shaping the future of Jisc's cyber community

This is your community! Join us to discuss your cyber community and its activities.

A working blueprint for the adoption of the Cyber Assessment Framework (CAF), reaping the benefits while avoiding pitfalls.In this session we will share London Metropolitan University's journey with the National Cyber Security Centre's Cyber Assessment Framework (CAF), including how we leveraged the CAF to build a roadmap, mature our university processes and improve our cyber security posture over time.

A journey into CAF and cyber security maturity

A working blueprint for the adoption of the Cyber Assessment Framework (CAF), reaping the benefits while avoiding pitfalls.

Reducing human risk, building resilience, and engaging teams in security awareness.Step into the hot seat and test your cyber savvy in “Who Wants to Be a Security Millionaire?”, a game show style session that’s as fun as it is eye opening. This interactive experience brings cyber awareness to life, highlighting the everyday choices that can make or break an organisation’s security. From phishing traps to password pitfalls, we’ll explore how human behaviour often becomes the weakest link and how the right training and awareness can turn it into our greatest defence.You’ll walk away with practical insights on reducing human risk, building resilience, and engaging teams in security awareness in ways that truly stick. Because when it comes to cyber security, knowledge isn’t just power, it’s protection.

Training session: who wants to be a security millionaire? A cyber awareness game show experience 

Reducing human risk, building resilience, and engaging teams in security awareness.

Universities must embed digital resilience—through unified visibility, automation, and proactive monitoring—to safeguard operations, reduce costs, and sustain innovation amid shrinking budgets and escalating cyber threats.Higher education faces familiar but intensifying pressures: declining international enrolments, shrinking budgets, and growing operational complexity. For many universities, maintaining basic services leaves little capacity for transformation. Yet sprawling tech estates, hybrid networks, and persistent ransomware threats demand greater efficiency and visibility. Resilience is now essential, not optional. Tool consolidation, integrated monitoring, and proactive insight safeguard operations, control costs, and protect reputation. Guidance from the NCSC Cyber Assessment Framework and OfS underscores that resilience must be designed in from the outset. A positive shift is emerging: collaboration. Once competitors, universities are beginning to co-develop secure, scalable platforms that enhance student experience while safeguarding data. Meeting these challenges means achieving unified visibility across on-prem, cloud, and SaaS; automating detection and response; turning compliance into a by-product of daily operations; and adopting shared service models that spread cost and expertise — protecting teaching, research, and innovation.

The future of cyber security in higher education

Universities must embed digital resilience—through unified visibility, automation, and proactive monitoring—to safeguard operations, reduce costs, and sustain innovation amid shrinking budgets and escalating cyber threats. 

Join our cloud community session for an informal discussion on integrating cloud and security, including topics like Azure Arc, Entra ID, Intune and more, supported by Jisc facilitators.Our cloud community is a trusted group that helps you leverage cloud capabilities on your digital transformation journey. Come to this session for an informal discussion, to exchange insights on how cloud and security work together. Supported by Jisc facilitators of the cloud community.For example, come and talk about Azure Arc, Entra ID, BOT scraping, Intune, setting up software for success defender support, and anything else relevant for you.

Community meet-up: cloud security community meet-up

Join our cloud community session for an informal discussion on integrating cloud and security, including topics like Azure Arc, Entra ID, Intune and more, supported by Jisc facilitators.

Gain understanding of the ransomware ecosystem, including practical tips for ransomware defence and ransomware operators insight.This session pulls back the curtain on the inner workings of modern ransomware groups, not just the tools they use, but the people, structure, and strategy behind the attacks.We will explore how cybercriminal organisations operate like professional businesses, complete with hierarchies, affiliate models, customer service, and even HR-like functions. From initial compromise to payment negotiations and data leaks, we’ll dissect the full lifecycle of a ransomware operation and the ecosystem that supports it.Whether you're defending networks or just curious how the digital underworld really works, this talk will leave you thinking differently about today’s cyber threats.

Blueprint for extortion: inside a ransomware syndicate

Gain understanding of the ransomware ecosystem, including practical tips for ransomware defence and ransomware operators insight.

A session sharing updates on Cyber Essentials.This session will discuss the 2026 update and an outline of the roadmap for 2027.

Cyber Essentials 2026 update

A session sharing updates on Cyber Essentials.

Explore GEANT’s 2025 cyber security campaign on mindfulness, being present and aware of technology use.GEANT’s cyber security campaign for 2025 has been looking at mindfulness, which is about being fully present and aware of how we use technology. This helps individuals respond more thoughtfully to digital threats, especially under stress.In this session the working group for the project will share materials and discuss how you can use these in your organisation.

Community meet-up: cyber mindfulness - staying present and safe in a digital workplace

Explore GEANT’s 2025 cyber security campaign on mindfulness, being present and aware of technology use.

Discover how using External Attack Surface Management can help you understand your risk exposure and the steps you can take to prevent unnecessary risks.Institutions face unique cyber security challenges: dynamic user populations, BYOD cultures and sprawling digital estates. These factors make them targets for both opportunistic threats and state-sponsored actors seeking intellectual property theft. In partnership with Jisc, we scanned the external attack surface of every university, college and research institution in the UK, to understand how exposed they are to these real-world threats. The results show encouraging progress: critical vulnerabilities have dropped year-on-year, and many institutions are actively improving their digital hygiene. However, significant risks remain, including expired TLS certificates, missing SPF records, and widespread use of insecure protocols. The NCSC now recommends continuous External Attack Surface Management (EASM) as a foundational control and this session will show how universities can adopt EASM easily. We will discuss the importance of benchmarking, share insights from the national scan, and highlight sector-wide trends. We will provide insight to help you take positive action.

How an attacker sees your IT estate: the sector's progress and where vulnerabilities remain

Discover how using External Attack Surface Management can help you understand your risk exposure and the steps you can take to prevent unnecessary risks.

Discover ways to embed security into institutional strategy without stifling innovation or academic freedom.In higher education the need to foster open collaboration global research and accessible digital services often sits in tension with the growing imperative to protect institutional data systems and reputations from evolving cyber threats. This session explores how universities can strike the right balance between openness and protection—embedding security into institutional strategy without stifling innovation or academic freedom. Drawing on real-world experiences from across the sector we’ll discuss how to align cyber security with institutional goals, enable secure-by-design practices and develop security cultures that extend beyond compliance. The session will also highlight practical approaches to stakeholder engagement sustainable governance and building resilience through risk-informed decision-making.Session takeaways:
<ul><li>Balancing openness and protection: a strategic approach to information security</li><li>Understanding how to align security strategy with the values and mission of higher education — ensuring protection enhances rather than impedes openness collaboration and academic freedom</li><li>Exploring practical ways to embed secure-by-design principles into digital transformation and service delivery — including working effectively with IT academic and research teams</li><li>Learning approaches for building a security-aware culture across staff students and leadership with a focus on communication awareness and behavioural change</li><li>Gaining insights into risk-informed decision making and sustainable governance models — enabling institutions to prioritise effectively and respond confidently to evolving cyber threats</li></ul>

Balancing openness and protection: a strategic approach to information security 

Discover ways to embed security into institutional strategy without stifling innovation or academic freedom.

This session will cover public cloud resilience for storage, compute, databases and more.One of the key goals of the security triangle is availability. Public cloud can help you achieve this with many built-in features to ensure your infrastructure is resilient within regions, countries or across the world. We'll dive in to what some of these technologies are and the best way to use them to your advantage.

Resilience in the cloud: how to build and take advantage of cloud's built-in resilience

This session will cover public cloud resilience for storage, compute, databases and more.

From handling media enquiries to managing staff and student welfare, this session helps senior leaders prepare for a real-life crisis and inform your business continuity plans.Senior leaders are responsible for maintaining business continuity and leading decision-making during a crisis. Drawing from real-world experiences from the sector, this session will highlight the key considerations and decisions that senior leaders will face in the event of a real-life cyber incident.

Executive decision making during ransomware incidents

From handling media enquiries to managing staff and student welfare, this session helps senior leaders prepare for a real-life crisis and inform your business continuity plans.

This session will demonstrate an example threat model and how the process can be tailored to each organisation enabling proactive identification of security risks.In this session we will take you through the basics of threat modelling and how you can use it to identify any gaps in your defences from the most common threat actors targeting the sector. By mapping the tactics, techniques, and procedures of relevant threat actors alongside your organisation's current security procedures and protections it is possible to clearly visualise areas that need improvements. We will demonstrate an example threat model and how the process can be followed to be tailored to your own organisation enabling proactive identification of your security risks.

Threat modelling 101: visualising threats so you can sleep worse at night

This session will demonstrate an example threat model and how the process can be tailored to each organisation enabling proactive identification of security risks.

This session presents Active Directory security best practices and Defender XDR guidance.We will discuss Active Directory security best practices, such as hardening privileged accounts and monitoring authentication, and key Microsoft Defender XDR configuration recommendations to strengthen visibility and detection. Attendees will learn the essential steps to ensure that their environments are aligned with Jisc's SOC requirements and be ready for effective threat monitoring and response.

Training session: Getting SOC ready - Defender and Active Directory best practice

This session presents Active Directory security best practices and Defender XDR guidance.

Learn how to identify, prioritise, and communicate with stakeholders during a cyber incident, balancing legal obligations, transparency, and collaboration for resilient, sector-wide incident response.When a major cyber incident unfolds, effective stakeholder communication isn’t just important, it’s essential. In this panel session, our panellists explore the critical role of stakeholder engagement during major cyber incidents. Drawing on practical experience and cross-sector collaboration, this discussion will explore topics that include:
<ul><li>Identifying stakeholders in a crisis – who counts as a stakeholder and which stakeholders to prioritise.</li><li>When, what and how to communicate evolving information.</li><li>Legal and regulatory considerations</li><li>Post-incident engagement and cross sector collaboration.</li></ul>

Bridging the gap: stakeholder engagement during major cyber incidents

Learn how to identify, prioritise, and communicate with stakeholders during a cyber incident, balancing legal obligations, transparency, and collaboration for resilient, sector-wide incident response.

Take this opportunity to share experiences of Cyber Essentials Plus with peers at different stages of the accreditation process.This conversation is for you whether you are working towards Cyber Essentials or Cyber Essentials Plus for the first time or want to talk about the latest developments impacting your recertification.Join one of the discussion tables for open conversation with support from Jisc experts.

Community meet-up: Cyber Essentials community clinic

Take this opportunity to share experiences of Cyber Essentials Plus with peers at different stages of the accreditation process.

An insight into Blackburn Colleges recent experience of a ransomware attack, highlighting the unexpected challenges that presented and what they would do differently. A walk through of what happened during Blackburn Colleges recent ransomware attack, how insurers, stakeholders, the media and staff reacted, and how they kept their business operational throughout.Covering all of the unexpected events and challenges that presented, helping you better prepare should it happen to your organisation.

A ransomware war story from an exec perspective

An insight into Blackburn Colleges recent experience of a ransomware attack, highlighting the unexpected challenges that presented and what they would do differently. 

Information sharing and collaboration between NRENs in Europe and globally including current activies and future plans.In this presentation we will highlight the developments from the GÉANT Project task focused on cyber threat intelligence, the value add to Jisc membership and how you can contribute.

Threat intelligence sharing in the GÉANT community and beyond

Information sharing and collaboration between NRENs in Europe and globally including current activies and future plans.

A discussion on cyber security for digital research infrastructures and cyber assessment framework assessments in a research context.In this session we will discuss the cyber security aspect of the UKRI Digital Research Infrastructure (DRI) programme, which is focused both on supporting the UK research computing community in improving its cyber security posture and developing broad security needs and requirements for that environment. We will also discuss key areas of work and the importance of collaboration and working with national and international partners.

DRI cyber security: research infrastructure cyber security and resilience

A discussion on cyber security for digital research infrastructures and cyber assessment framework assessments in a research context.

Learn cyber security processes through gamification. Booking required - a link to book will be sent to all in-person delegates.Cyber escape room one - stolen dataSensitive data has been stolen. Your mission: solve intricate puzzles, decipher hidden codes, crack passwords, and breach digital defences to stop a dangerous threat actor from leaking the stolen information onto the dark web.Cyber escape room two - digital forensicsThe breach has already happened. Time is running out. Your mission: extract digital artefacts, reconstruct the timeline of the attack, and expose the threat actor before they vanish into the shadows. Every second counts—can you crack the case before it’s too late?

Closing keynote session coming soon

Join us as Ben Chapman, Jisc's head of architecture and engineering for security, offers closing thoughts from this year's Security Conference.

Join us as Ben Chapman, Jisc's head of architecture and engineering for security, offers closing thoughts from this year's Security Conference.

Day two closes

Security Conference programme 2025

About Security Conference 2025

Why attend Security Conference 2025

Explore Security Conference 2025

Security Conference 2025 tickets and booking information

Accommodation for Security Conference 2025

Security Conference 2025 exhibitors

If you're planning to attend this year's event online, please note that only selected sessions will be available via live stream and recorded.

View the programme for Security Conference 2025.