• Examine the latest cyber threat landscape affecting public services
• Understand national priorities and policy developments
• Explore how collaboration is improving cyber resilience across government

• Balance innovation with robust cyber security governance
• Understand security-by-design principles
• Embed cyber resilience into digital transformation programmes

Richard Holland, Field CISO, Quorum Cyber

Andrew Collins, Cyber Security Manager, Harrow Council

This discussion will focus on shifting from a "checkbox compliance" mindset to a strictly risk-based approach to cyber security. Experts will share actionable methods for identifying and protecting an organisation's "crown jewels" (its most critical data and infrastructure) first. The conversation will cover the cost-effectiveness of automated security tools, the benefits of shared-services models across local authorities, and creative ways to upskill existing staff to bridge the skills gap without expensive external hiring.

Of the more than 25 million companies and public sector organisations in the UK, over 99% of them are SMEs. With few exceptions, the vast majority of these do not have dedicated cyber security resources or budget and do not actively monitor for or mitigate threats. This 99% also make up the supply chain of the top 1% of companies, government organisations, including our Critical National Infrastructure, and represent a very significant attack surface for those organisations. This talk will explore how we can get the smallest 99% to care about cyber security, and what they need to tangibly improve their cyber posture and reduce the cyber risk of the nation as a whole. 

• Examine how security can be embedded into digital services from the outset
• Explore the challenges of securing legacy technology while continuing to modernise public services
• Consider how government organisations can adopt emerging technologies securely without creating new vulnerabilities

• Explore the evolving role of human behaviour in public sector cyber security
• Examine how organisations can move beyond traditional awareness training to build a stronger culture of cyber security
• Consider the skills, behaviours and organisational approaches needed to create a genuinely cyber-resilient workforce

• Examine how cyber security can be positioned as a strategic organisational risk rather than solely an IT responsibility
• Explore effective approaches to communicating cyber risk and accountability at board and senior leadership level
• Consider how governance, risk appetite and investment decisions can translate into stronger cyber resilience across public services

• Explore the key priorities for strengthening cyber resilience across local government
• Examine why compliance alone is not enough to protect essential public services
• Identify practical approaches councils can take to improve preparedness, resilience and recovery despite resource constraints