Cybersecurity Summit: Financial Services, London 13th Edition 2026 ISMG%%sep%%Events ismg.events

Cybersecurity Financial Services Summit: London

September 10, 2026 | 8:30 AM ET - 5:00 PM ET

Hosted by BankInfoSecurity

Event Overview

ISMG’s 2025 Financial Services Cybersecurity Summit will tackle the sector’s most urgent cyber challenges. A keynote panel of leading CISOs will discuss how InfoSec leaders’ responsibilities now span IT, data, communications and operations, underscoring cybersecurity’s strategic role. Sessions will deliver insights on advanced threat intelligence, payment fraud prevention, AI’s impact on attackers and defenders, and leveraging cyber insurance in risk management.

The event concludes with the interactive Solution Room, a hands-on incident response workshop where participants face a high-stakes deepfake scenario to strengthen crisis planning and response.

Scott Tenenbaum

Head of Claims, North America, Resilience

Imran Khan

VP Cyber Security Transformation Lead, BNP Paribas

Seth Rose

Supervisory Special Agent Group 06, U.S. Department of the Treasury/Cyber Investigation Unit

David Anderson

Vice President, Cyber, Woodruff Sawyer

Vlad Brodsky

SVP, Chief Information Officer, OTC Markets Group

Kimberly Pack

Counsel, Thompson Hine LLP

Speakers

Thought Leaders on Stage Leading Deep-Dive Discussions

ISMG Summits bring the foremost thought leaders and educators in the security space to the stage, interactive workshops and networking events. Learn from the “who’s who” in Cybersecurity passionate about the latest tools and technology to defend against threats

Keynote Speaker

Moriah Hara

AI Risk & Security Expert, 3x CISO, Board Advisor, Author, CISSP, CISM, AWS Security, PCI QSA

Moriah is a 3x Fortune 500 Award Winning CISO at Wells Fargo Capital Markets, Interpublic Group and Bank of Montreal. She is a Board Advisor to several startups and a Cybersecurity Co-Author for the book, “The Perfect Scorecard: Getting An ‘A’ in Cybersecurity From Your Board Of Directors.”

She was named by Cybercrime Magazine as one of top 100 Fascinating Women Fighting Cyber, and has multiple, industry recognized security certifications such as the CISSP, CISM, CSSLP, PCI QSA and AWS Security and graduated from Harvard’s inaugural executive cybersecurity program.

Keynote Speaker

Moriah Hara

AI Risk & Security Expert, 3x CISO, Board Advisor, Author, CISSP, CISM, AWS Security, PCI QSA

Moriah is a 3x Fortune 500 Award Winning CISO at Wells Fargo Capital Markets,...

Interpublic Group and Bank of Montreal. She is a Board Advisor to several startups and a Cybersecurity Co-Author for the book, “The Perfect Scorecard: Getting An ‘A’ in Cybersecurity From Your Board Of Directors.”

She was named by Cybercrime Magazine as one of top 100 Fascinating Women Fighting Cyber, and has multiple, industry recognized security certifications such as the CISSP, CISM, CSSLP, PCI QSA and AWS Security and graduated from Harvard’s inaugural executive cybersecurity program.

Keynote Speaker

Hardik Mehta

Global Head of Risk and Regulatory Compliance, JPMorganChase

Security, Risk, and Compliance leader with 20+ years of global experience across Uber, Microsoft, and more. ..

Expert in building high-performing risk teams, aligning engineering and regulatory goals, and embedding risk into product development. Pioneered the world’s first cloud-native self-service compliance platform on Azure, automating 450+ controls with AI/ML. Skilled in FAIR, SOX, NIST, GDPR, and large-scale program delivery. Known for translating complex risk into actionable frameworks and driving cultural change across global teams.

Agenda

Given the ever-evolving nature of cybersecurity, the agenda will be continually updated to feature the most timely and relevant sessions.

7:30 AM - 8:30 AM ET

Registration & Breakfast

8:30 am - 8:35 am et

Opening Comments

9:00 AM - 9:30 AM ET

The CISO's Dilemma: Balancing Accountability, Regulations Reporting and Security in 2026

The CISO's role has not become less of a challenge since ISMG convened its 2024 Financial Services Summit.

This session will review the last year and explore where CISOs have made progress in defining and a strategizing about their mandates, communicating with management and company boards, quantifying and visualizing risk, building new security frameworks and influencing company culture, all while protecting their companies’ critical assets.

Panelists will discuss real-world scenarios and use cases that can help define the role of the CISO in 2026 while reducing burnout risk and insecure company posture.

Session Highlights:

How CISO’s responsibilities have changed re: risk management, data governance and business operations
Approaches that can align company stakeholders around cybersecurity objectives, fraud reduction, compliance and other risk domains
Strategies for engaging with company boards and executive leadership on cybersecurity risks and solutions
Measuring security programs’ value in financial terms to support informed decision-making

3:55 PM - 4:05 PM ET

Embedding Security at the Speed of Finance

As financial institutions push for faster digital innovation, security teams are often left playing catch-up - or worse, seen as blockers.

But a well-executed DevSecOps strategy can turn security into a business enabler, integrating controls directly into the software lifecycle without stalling delivery. This session focuses on what DevSecOps means for CISOs in financial services: not just shifting left, but embedding governance, risk, and compliance directly into development workflows.

We’ll explore how leading financial firms are implementing security guardrails in CI/CD pipelines, using policy-as-code to enforce controls, and ensuring that software shipped to production meets regulatory and resilience standards.

We’ll also discuss how to drive alignment across AppSec, DevOps, and GRC functions – especially in environments where infrastructure is increasingly ephemeral and APIs serve as critical product infrastructure.

We will cover:

How to establish DevSecOps as a governance model, aligned to compliance and operational resilience.
Real-world practices for embedding security guardrails into CI/CD pipelines.
Strategies to integrate SBOM validation, third-party component monitoring, and change control into Dev workflows.
Cultural and structural changes needed to align AppSec, DevOps, and GRC teams.

8:35 AM - 9:00 AM ET

Keynote Session: Panel Discussion

The role of the financial CISO is undergoing a profound evolution. No longer confined to protecting IT infrastructure alone, today’s CISOs are charged with safeguarding enterprise-wide data, communications, and even operational continuity.

Our Keynote will examine how cybersecurity leadership is expanding into a business-wide mandate – from compliance and privacy to fraud prevention and operational resilience. We will discuss the growing strategic importance of cybersecurity at all organizational levels and how CISOs must collaborate across risk, compliance, and business units to embed security into the company’s DNA. Attendees will hear how new regulations and rising board expectations are elevating the CISO’s accountability. Through real-world examples, we’ll explore strategies for breaking down silos, communicating cyber risk in financial terms, and aligning security initiatives with core business objectives to drive resilience and trust.

Key Takeaways:

How and why the CISO’s responsibilities now span enterprise risk management, data governance, and business operations;
Approaches to bridge communication gaps between cybersecurity, fraud, compliance, and other risk domains;
Effective methods to engage the Board and executive leadership on cybersecurity as a strategic business issue;
Strategies for measuring and conveying security program value in financial terms to support informed decision-making.

9:00 AM - 9:30 AM ET

Zero Trust in the Age of AI and What it Means - How Should Financial Organizations Think About the Risks of AI, and Where Does Zero Trust Fit In?

Businesses stand to benefit from AI in unprecedented ways, but only if IT and security leaders overcome transformation challenges.

This includes implementing a modern zero trust architecture to protect data and users, embracing AI while managing its risks, and handling the technical and financial implications of ever-expanding environments. A risk-based approach to security ensures CIOs and CISOs deliver a secure, phased transformation.
Join this session to:

Understand how zero trust and AI together, unlike firewalls, provide the strongest cyber defense by stopping threat actors from lateral movement within networks
Learn strategies for protecting AI applications developed internally for customers and employees, while preventing data leaks from public AI applications
Discover how AI is being leveraged for better cyber defense, in areas like segmentation, data classification and agentic operations

9:30 AM - 10:00 AM ET

The Path to a Password-Less Future

Eliminating passwords has the potential to improve customer experience and simultaneously take security to the next level.

The goal has been common to the financial industry for several years: What will it take to achieve it? This session will explore advances in biometrics, hard tokens, passkeys and also consider how these advances can improve – or impede – customer UX, and where more friction could be a requirement. Panelists will also discuss the implications of password-free security within financial organizations.

Session highlights:

Implications for the future of identity;
Potential password-less attack;
The role of data analytics and AI in supporting password-less security frameworks;
Impact on insider threat detection and internal system management.

10:00 AM - 10:30 AM ET

Top Recommendations from the Financial Services State of Software Security & AI Reports

Join Veracode Co-Founder and Chief Security Evangelist, Chris Wysopal, for a breakdown of the Financial Services State of Software Security Report.

The report analyzed 1.3 million applications to find the most significant risks that this sector faces.

Highlights include:

57% of financial services apps have at least one security flaw, progress on reducing flaws has stagnated since 2021;
Fixing issues takes 276 days on average—nearly a month longer than other industries;
77% of organizations carrying unresolved flaws over a year old, 63% of which are critical;
Most of the critical security debt (82%) comes from open-source code;
45% of AI assisted code completion tasks generate a flaw that must be remediated.

Join us to learn more about the key findings, best practices to fix them, and a discussion on where the industry will go next.

10:30 AM - 10:40 AM ET

Beyond the Endpoint: Why Network Detection and Response Is Critical in the Financial Industry’s Threat Landscape

Financial institutions are prime targets for advanced cyber attackers, yet the over-reliance on endpoint protection leaves critical blind spots that can jeopardize operational resilience and regulatory compliance.

As the attack surface continues to expand across cloud environments, OT devices, and third-party vendors, attackers have more opportunities to gain the initial access they need to launch attacks. Corelight’s NDR platform provides the essential telemetry and contextual intelligence required to identify and safeguard high-value assets, meet compliance demands, and empower security teams to detect and respond to sophisticated threats effectively in real-time.

10:40 AM - 11:05 AM ET

Networking Break

11:05 AM - 11:35 AM ET

Combating Insider Threats with Data Resilience and Endpoint Control

Insider threats both negligent and malicious pose serious risks to financial institutions.

This session explores how to detect, respond to, and recover from internal attacks. Learn how to strengthen your security posture with proactive monitoring, unified endpoint management, and resilient backup strategies that protect data, ensure compliance, and minimize damage from insider-driven incidents.

11:40 AM - 11:50 AM ET

From Roadblock to Growth Engine: Security’s New Role in Business Acceleration

Today, the real risk isn’t unauthorized tools, it's the speed at which competitors and threats move while your teams wait for approvals.

Next-gen security leads have flipped the script, becoming growth partners by creating controlled environments where high-risk work thrives, without limits. Learn proven patterns on how top orgs made the shift: enabling M&A in days not months, creating new product with dangerous data, and other examples turning security into a measurable business advantage.

11:55 Am - 12:25 pm et

Navigating 23 NYCRR 500 Compliance in Financial Services

In the evolving landscape of financial services, CISOs face a crucial mission: protecting critical systems like the mainframe, IBM i and others—now deeply interconnected with the broader infrastructure—while meeting the rigorous demands of New York State’s 23 NYCRR 500.

Join this session to address the unique challenges of critical system security within the framework of 23 NYCRR 500, including the latest November 1 deadline. We’ll break down each regulatory requirement, highlight why critical systems must be a central focus, and explore the tangible costs of non-compliance. From vulnerability management and penetration testing to MFA and surgical data recovery, we’ll provide actionable insights and a readiness checklist to help you take immediate steps toward compliance.

You will learn:

How to align critical system security, like mainframe and IBM i, with 23 NYCRR 500 requirements;
Phased approaches to minimize disruption and meet regulatory needs;
Practical steps for vulnerability management, MFA, and more;

Don’t miss this opportunity to gain clarity, reduce noise, and take control of your critical system security strategy.

12:25 Pm - 12:55 Pm et

Get Off the Assessment Treadmill. Take a Data-First, Questionnaire-Second Approach

The work never ends. Every year, we onboard more third parties—and every year, our assessment workload gets worse.

More resources? Not likely. Sound familiar? You’re not alone. We’ve been at this for years, yet the process continues to become more burdensome for your team and for the people in your company who rely on your third parties. It doesn’t have to be that way.

The newest risk exchange models are eliminating up to 80% of questionnaire requests by leveraging validated data. In this session, we’ll show you how to transform your third-party risk management program by incorporating smarter workflows and better data access.

What you’ll learn:

How to instantly perform inherent risk analysis across your entire vendor portfolio;
Ways to incorporate real-time risk data to reduce the number of questionnaires;
How to map your questionnaires to industry-standard frameworks or threat profiles to ask fewer, more targeted questions;
How to access assessment data on large, hard-to-assess third parties that don’t respond;
How to monitor 100% of your third-party portfolio not just your critical vendors.

12:55 PM - 1:40 PM ET

Lunch

1:40 Pm - 2:10 Pm et

The New Economics of Cyber Risk: Quantifying Exposure, Liability, and Resilience

The cyber risk conversation in financial services has shifted from data breach costs to full-spectrum liability.

Today, lawsuits can follow within days of a breach, insurers are tightening terms, and underwriters want proof of governance maturity and supply chain visibility — not just policies on paper.

This session explores how CISOs, legal teams, and insurers are redefining the economics of cyber risk. We’ll examine how financial institutions are quantifying exposures across data breaches, business interruption, privacy practices, and third-party dependencies — and how cyber insurance is evolving to keep pace with new forms of liability, litigation, and regulatory oversight.

We’ll discuss:

What’s measurable and what remains unpredictable in cyber risk quantification
The new wave of “non-breach” privacy and arbitration claims shaping insurance coverage
How underwriters and CISOs are aligning around resilience, governance, and transparency
The blurring lines between cyber, E&O, and crime coverage in financial institutions
Communicating risk exposure and resilience to boards in business terms

2:10 PM - 2:40 PM ET

EHLO World: Spear-Phishing at Scale using Generative AI

Insider threats both negligent and malicious pose serious risks to financial institutions.

2:40 PM - 3:40 PM ET

Solution Room -Trust Undermined: An Immersive Simulation of AI-Augmented Insider Threats

Join CyberEdBoard for this interactive tabletop exercise that places you at the center of a sophisticated insider threat scenario, driven by generative AI and psychological manipulation.

This expertly designed session challenges participants to respond to cascading disruptions across IT and operational systems, unraveling the role of AI-augmented tactics in exploiting insider vulnerabilities. With a multi-phase simulation highlighting the cross-industry impact of AI-augmented insider threats on IT and operational systems, attendees will collaborate to develop actionable strategies for containment, detection, and long-term defense.

What You Will Gain From This Experience:

Precision Threat Response: Master techniques for isolating compromised systems, analyzing hybrid network activity, and mitigating cascading disruptions caused by insider-enabled AI attacks;
Real-World Scenario Insights: Understand how AI-driven insider threats exploit IT-OT vulnerabilities, with lessons applicable to sectors reliant on interconnected systems;
Actionable Defense Playbook: Design advanced countermeasures, including micro-segmentation, AI-based anomaly detection, and evidence preservation for incident response and regulatory requirements.

3:40 pM - 4:00 pM ET

Networking Break

4:00 PM - 4:10 PM ET

Sponsor Showcase: Anvilogic

As financial institutions push for faster digital innovation, security teams are often left playing catch-up - or worse, seen as blockers.

We will cover:

How to establish DevSecOps as a governance model, aligned to compliance and operational resilience.
Real-world practices for embedding security guardrails into CI/CD pipelines.
Strategies to integrate SBOM validation, third-party component monitoring, and change control into Dev workflows.
Cultural and structural changes needed to align AppSec, DevOps, and GRC teams.

4:10 PM - 4:40 PM ET

The Hidden Risk: Securing the 80% of Data Most Organizations Overlook

In today’s financial institutions, cybersecurity strategies often focus on production systems—where customer transactions and core operations live.

But what about the other 80% of enterprise data that resides in non-production environments like development, testing, analytics, and AI/ML? These environments are rich with sensitive data, yet frequently underprotected, creating a massive blind spot for CISOs and cyber leaders.

Join Aaron Jensen, Director of Solutions Engineering at Delphix, as he unveils insights from the 2025 State of Data Compliance and Security Report, which found that 54% of organizations have already experienced data breaches in non-production environments, and 84% allow compliance exceptions that increase risk. With AI accelerating data sprawl and regulatory scrutiny intensifying, the stakes have never been higher.

This session will explore how Delphix helps financial institutions eliminate data risk without slowing innovation—using automated data masking, secure replication, and continuous compliance across hybrid and cloud environments. Learn how to secure the data that fuels development while meeting the demands of regulators, auditors, and your board.

Key Takeaways:

Why non-production environments are the new frontier for cyber risk;
How Delphix enables secure, compliant data delivery for DevOps and AI;
Strategies to align data protection with speed, agility, and innovation.

4:40 Pm - 5:05 pm et

Hidden Links, Big Fallout: Lessons From the New Wave of Supply Chain Attacks

Recent breaches have underscored that a cybersecurity failure at one of your vendors – or even at their vendors – can cascade into a major incident for your own organization.

In this session, we address the critical challenge of third-party and supply chain risk management in the financial sector. We’ll explore real-world case studies and cover best practices for due diligence, continuous monitoring, and incident response planning.

Key Takeaways:

Real-world impacts of supply chain breaches in finance• Methods to perform rigorous vendor due diligence and monitoring;
Tactics for managing fourth-party risk and systemic concentration;
Incident response considerations for third-party incidents.