Doors open, registration, networking, exhibition.

Day one opens

Doors open, registration, networking, exhibition

A welcome session for newcomers offering an opportunity to meet fellow delegates and the Jisc team, while providing guidance on how to maximise your experience both at the conference and within the community.In this ice-breaker session, for anyone new to the Security Conference or community, you’ll have the chance to meet the others attending the conference and the Jisc team. You can find out how to make the most of your time at the conference and in the community. When we defend as one we are stronger.

Community meet-up: welcome to Security Conference (for new attendees)

A welcome session for newcomers offering an opportunity to meet fellow delegates and the Jisc team, while providing guidance on how to maximise your experience both at the conference and within the community.

Heidi Fraser-Krauss, our CEO, welcomes you to Security Conference 2026 and provides an overview of what you can expect from this year's event.

Welcome to Security Conference

Heidi Fraser-Krauss, our CEO, welcomes you to Security Conference 2026 and provides an overview of what you can expect from this year's event.

Looking back at the past decade and forward to the next, this session explores how stronger partnerships can help shape a more resilient future for education and research security.As our Security Conference marks its tenth anniversary, this session reflects on a decade of progress in strengthening cyber security across the education and research sector. While celebrating the achievements of our community, it will also explore how the threat landscape has evolved, becoming more complex, sophisticated and fast-moving.Looking ahead, the session will examine why collaboration is more important than ever. With institutions operating in an increasingly interconnected global environment, effective cyber resilience depends on stronger partnerships across the UK, Europe and beyond. Through shared standards, coordinated incident response, threat intelligence, training and common working practices, the global education and research community can work together to meet emerging challenges and build a more secure future.

Jisc strategic update: a decade of progress, a shared future

Looking back at the past decade and forward to the next, this session explores how stronger partnerships can help shape a more resilient future for education and research security.

Following David’s opening reflection on a decade of progress, this keynote addresses what’s next: how the sector moves from talking about resilience to leading through crisis, recovering at pace, and protecting education and research through global action.Education and research have become a playground for threat actors: open, interconnected, data-rich and globally significant. The question is no longer if an institution will be targeted, but when, how quickly it can recover, and whether the sector can respond collectively.Attendees will leave with a leadership-focused view of how to prepare for the inevitable, respond with clarity and recover with conviction. The goal is not simply to survive the next incident, but to build the trust, collaboration and readiness needed to protect education and research, by changing and challenging mindsets.

Under attack, united in response

Following David’s opening reflection on a decade of progress, this keynote addresses what’s next: how the sector moves from talking about resilience to leading through crisis, recovering at pace, and protecting education and research through global action.

Morning break

This session will explore how software asset management (SAM) can enhance visibility and reduce vulnerability across a complex academic environment.After the packed session in 2025, we are back! Managing software assets in higher and further education is no easy task. With thousands of installations, multiple campuses, multiple software use cases/licence types and elevated privileges, visibility can be limited and that creates real risks.Our licensing portfolio specialist, Sonia Davies, and Andy Lyon, licensing manager, will hold a workshop on how software asset management can enhance visibility and reduce that vulnerability. The idea is to support knowledge exchange on practical approaches to SAM which would improve audit trails, unlock cost savings and provide long-term value.

Why strategic asset management (SAM) is critical for education institutions

This session will explore how software asset management (SAM) can enhance visibility and reduce vulnerability across a complex academic environment.

Join James Cook from Plymouth College and John Bayes from Hull College as they explore how to build a culture where cybersecurity is everyone's responsibility, not just the IT teams.Having gone through major digital transformation programmes, both colleges have learned that while investment in infrastructure and technology is important, the most significant and lasting change has been cultural. Through their experiences, they will demonstrate why effective cybersecurity depends as much on people, leadership, and governance as it does on technical solutions.This session will highlight the role of clear policies, strong operational standards, effective documentation, and meaningful staff and student engagement in creating a secure and resilient organisation.Attendees will gain practical insights into embedding accountability, collaboration, and digital confidence across their institution, helping to build a security-first culture that strengthens resilience, supports modernisation, and drives long-term cyber maturity.

Security starts with culture: building cyber resilience beyond IT

Join James Cook from Plymouth College and John Bayes from Hull College as they explore how to build a culture where cybersecurity is everyone's responsibility, not just the IT teams.

Most organisations manage technical risk with frameworks like the NIST Cybersecurity Framework (CSF) and MITRE ATT&CK, then handle the human side on instinct. That gap is where attackers get in. This session presents the missing connection between the technical and behavioural sides of security. We introduce SebDB, a free, open-source database of over 100 security behaviours already mapped to the standards you use, built by a consortium of practitioners and researchers. We then explore Project Nexus and its behavioural security ontology, one of the first to link behaviours to threats, vulnerabilities, incidents, controls, and interventions in a single foundational framework, and how you can help build it.

The missing framework: connecting behavioural science to cyber risk

Most organisations manage technical risk with frameworks like the NIST Cybersecurity Framework (CSF) and MITRE ATT&CK, then handle the human side on instinct. That gap is where attackers get in. 

Learn cyber security processes through gamification. Booking required - a link to book will be sent to all in-person delegates.Cyber escape room one: ransomware attackA ruthless ransomware gang has encrypted critical systems and stolen sensitive data. But the investigation has uncovered a shocking development: the attackers didn't act alone. Evidence suggests someone on the inside helped them gain access to the network.Cyber escape room two: rogue AIYour organisation’s artificial intelligence system has been breached and has gone rogue. Your mission is to investigate the incident, overcome the security challenges, and secure the shutdown code required to deactivate the hostile AI.

Cyber escape rooms (booking required)

Learn cyber security processes through gamification. Booking required - a link to book will be sent to all in-person delegates.

Even in a Cyber Essentials-compliant environment, unmanaged user personas can create overlooked identity security risks. This session explores how Birmingham City University has identified, mitigated, and secured these challenging access scenarios. Many institutions need to provide secure access for staff users who don't fit the standard managed-device model. This session examines the identity security risks presented by users who either don't have institution-managed devices or need to work from unmanaged ones, including external examiners, visiting lecturers, emeritus professors, technical practitioners, and researchers.Join Andrew Luck, assistant director of IT at Birmingham City University who will explore where these "awkward personas" can introduce attack vectors, the technologies and controls implemented to reduce risk, and the practical challenges encountered during deployment. Attendees will gain insight into balancing security, usability, and operational requirements when securing non-standard user populations.

Securing users beyond the managed device

Even in a Cyber Essentials-compliant environment, unmanaged user personas can create overlooked identity security risks. This session explores how Birmingham City University has identified, mitigated, and secured these challenging access scenarios. 

This high-level session will explore what good cloud security looks like, starting with the broader principles, best practices, and holistic approach needed to secure cloud environments effectively. We’ll then move from strategy into practice, looking at the key security capabilities and solutions available across Microsoft Azure and AWS.The session will cover how organisations can think about areas such as identity, data protection, network security, posture management, monitoring, and governance, before highlighting how these concepts translate into the native tools and services offered by each cloud platform.Designed as a 40-minute overview, the talk will focus on the key considerations and capabilities rather than deep technical configuration, providing attendees with a practical framework for approaching cloud security across Azure and AWS.

Cloud security fundamentals

This high-level session will explore what good cloud security looks like, starting with the broader principles, best practices, and holistic approach needed to secure cloud environments effectively. We’ll then move from strategy into practice, looking at the key security capabilities and solutions available across Microsoft Azure and AWS.

This session will be a space for peers to share challenges and problem solve together.Our FE Heads of IT regional forums are a space for peers to share challenges and problem solve together. In this session, participants will be able to choose from table discussions on a range of topics relevant to FE and cyber:<ul><li>Engaging with senior/exec leaders about cyber</li><li>Working with 3rd party supplier on their cyber posture, and how that influences yours</li><li>Managing cyber in a time of cost savings being a priority</li><li>Building cyber awareness with students/staff</li></ul>

FE focused cyber knowledge café

This session will be a space for peers to share challenges and problem solve together.

Lunch break

This session is an opportunity to share insight on how the FE technology landscape is changing in response to sector challenges.We will share benchmarking insights from the FES IT Survey 2026, with a focus on what the responses told us about FE technology, security and supplier challenges.The survey was not only a request for information. It was an opportunity to build shared sector intelligence. By contributing, institutions helped strengthen the evidence base that we can use to identify where collective negotiation, supplier engagement, market intervention or future framework development may deliver the greatest value. Early responses raised to the spotlight cost governance, supplier dependency, security, and long-term value.

FE IT survey 2026: what we’re learning across the sector

This session is an opportunity to share insight on how the FE technology landscape is changing in response to sector challenges.

Join us to learn, share and help shape the future of our intelligence capabilities.Effective cyber defence relies not just on collecting threat intelligence, but on how that intelligence is shared, refined and applied across the community.In this session, we’ll explore our approach to intelligence collection, how we transform data into actionable insights and why collaboration is critical in strengthening collective resilience. We’ll also open the floor for feedback on our intelligence products to ensure they are meeting the real-world needs of our community.

Effective cyber defence through threat intelligence

Join us to learn, share and help shape the future of our intelligence capabilities.

This session will be a space for peers to share challenges and problem solve together.In this session, participants will be able to choose from table discussions on a range of topics relevant to HE and cyber:<ul><li>Engaging with senior/exec leaders about cyber</li><li>Working with 3rd party supplier on their cyber posture, and how that influences yours</li><li>Managing cyber in a time of cost savings being a priority</li><li>Building cyber awareness with students/staff</li></ul>

HE focused cyber knowledge café

Many organisations have cyber incident response plans and playbooks, but opportunities to test them are often limited to annual exercises or real incidents.This session brings together two speakers from further and higher education to explore how regular, practical cyber incident rehearsals can turn documented plans into organisational muscle memory.Drawing on complementary experiences, the speakers will share how different approaches, from short, monthly incident rehearsals to larger “unplugged” exercises involving the loss of IT systems, can build practical response capability, strengthen relationships across teams and create a continuous cycle of learning and improvement.The session will explore how rehearsals are designed and delivered, how leadership support is secured, and how lessons learned are translated into meaningful updates to playbooks, communications, offline resources and recovery arrangements. It will also consider how organisations can involve people beyond cyber security and IT, including operational teams, teaching staff and students, so that resilience becomes a shared responsibility rather than a purely technical exercise. The podcast specifically highlights planning, leadership buy-in, cultural change, safeguarding, communication, offline resources and recovery processes as practical considerations when organisations test how teaching and operations would continue without access to IT.Attendees will gain practical insights into establishing a sustainable rehearsal programme, testing how their organisation would continue to operate during disruption, and using each exercise to improve both technical incident response and wider organisational resilience.

From playbook to muscle memory: building a culture of cyber incident rehearsal

Many organisations have cyber incident response plans and playbooks, but opportunities to test them are often limited to annual exercises or real incidents. 

A college’s cyber security transformation journey, from limited maturity and early challenges to a resilient, risk-aware organisation, using CSA services to strengthen security.Every organisation starts somewhere. In this candid fireside chat, hear how Runshaw College progressed from addressing fundamental cyber security challenges to building a stronger security culture and a more resilient operating environment. Through real world experiences, the discussion will highlight how CSA services supported the college in improving security maturity, managing risk, and embedding cyber security into everyday decision making.

From awareness to resilience: a member’s cyber security journey in education

A college’s cyber security transformation journey, from limited maturity and early challenges to a resilient, risk-aware organisation, using CSA services to strengthen security.

Afternoon break

Building on last year's conversations about engaging senior leaders with cyber security, this interactive session explores what organisational cyber resilience looks like in practice, what gets in the way, and what helps institutions turn security priorities into coordinated action across the organisation.Strong technical foundations are essential to cyber security, but resilience depends on more than technology. Leadership, organisational capacity, workforce capability, collaboration and connected ways of working all influence how effectively institutions can prepare for, respond to and recover from cyber threats.Participants will draw on their own experience to identify common patterns, challenges and enablers across the sector.

Beyond secure foundations: leadership and organisational cyber resilience

Building on last year's conversations about engaging senior leaders with cyber security, this interactive session explores what organisational cyber resilience looks like in practice, what gets in the way, and what helps institutions turn security priorities into coordinated action across the organisation.

Through personal experiences and community perspectives, panel members will discuss how the cyber community can better support, connect, and learn from one another.As cyber threats grow in scale and sophistication, the strength of our cyber community has never been more critical.This dynamic panel debate brings together community colleagues, frontline defenders, and community champions to explore the most pressing challenges facing the cybersecurity ecosystem today—from skills shortages and burnout to collaboration gaps and evolving threat landscapes.At the same time, the panel will spotlight the individuals, initiatives, and community opportunities driving positive change, fostering innovation, and building resilience across the sector. Expect lively discussion, diverse perspectives, and actionable insights on how we can collectively empower and elevate the cyber community for the future and drive collaboration."

Cyber community: challenges, champions, and the road ahead

Through personal experiences and community perspectives, panel members will discuss how the cyber community can better support, connect, and learn from one another.

Covering the initial scenarios which introduced the original protections, how the network is protected today and what we are building out to protect the future.This session will cover our approach to defending against DDOS attacks, covering the initial scenarios which introduced the original protections, how the network is protected today and looking forward what protections we have available and are building out to protect workloads of the future.

10 year anniversary for DDoS services: compare the landscape then, now and are we prepared for future years?

Covering the initial scenarios which introduced the original protections, how the network is protected today and what we are building out to protect the future.

This first session in our two-part attack and defence series focuses on initial access, demonstrating how attackers target identity to gain their first foothold within an organisation.Our red team will demonstrate a realistic Adversary-in-the-Middle (AiTM) phishing attack, showing how credentials, sessions and authentication controls can be targeted and bypassed. Alongside the offensive demonstration, our blue team will show how defenders can identify the attack through identity, endpoint and Microsoft 365 telemetry, and the detections and response actions that can be used to contain it.We will explore the identity controls that can prevent or significantly reduce the effectiveness of these attacks, including protections available across Microsoft 365 A3 and A5 environments, and demonstrate practical approaches to detection and threat hunting.Attendees will leave with a clearer understanding of how modern identity-based attacks achieve initial access, the evidence they leave behind, and how offensive and defensive security techniques can be combined to improve organisational resilience.Continue the attack chain in part two, where we assume the attacker has successfully gained access and demonstrate how they attempt to escalate privileges and move laterally through the environment.

Part one: breaking in - identity attacks and initial access

This first session in our two-part attack and defence series focuses on initial access, demonstrating how attackers target identity to gain their first foothold within an organisation.

Explore how our security operations centre has evolved into an integrated, intelligence-led service designed specifically for the needs of education and research. This session provides an inside look at how our security operations centre has evolved into an integrated, intelligence-led service designed specifically for the education and research sector. We will explore how monitoring and response, detection engineering, automation, threat intelligence, threat hunting, endpoint and identity response, and Janet-level network visibility combine to deliver a sector-focused SOC capability. We will share lessons learned as the service has matured, how member feedback and operational experience continue to shape its development, and the capabilities being developed next.Newcastle University will provide a unique member perspective, having worked with us from the earliest proof of concept, through BETA and into the live service. They will share their experience of helping shape the SOC and how it now supports their security operations and wider cyber resilience. Together, Jisc and Newcastle will reflect on the partnership and look ahead to the SOC’s continued evolution.

Inside the Jisc SOC: capability, learning and growth

Explore how our security operations centre has evolved into an integrated, intelligence-led service designed specifically for the needs of education and research. 

Join us as Paul Knee, deputy director of sector security, Jisc offers closing thoughts from day one of the event, before opening the networking drinks reception in the exhibition hall.

Closing thoughts

Join us as Paul Knee, deputy director of sector security, Jisc offers closing thoughts from day one of the event, before opening the networking drinks reception in the exhibition hall.

Join us for a networking drinks reception sponsored by SoftwareONE and Azul, taking place in the exhibition hall to close the first day of the conference.

Networking reception

Join us for a networking drinks reception sponsored by SoftwareONE and Azul, taking place in the exhibition hall to close the first day of the conference.

Day one closes

Registration, networking and exhibition

Day two opens

This session is an opportunity to share experiences relating to the costs associated with AI 'creep' across multiple tools and services.A closed door roundtable to share insights and experiences. AI costs are no longer limited to specialist AI platforms. They are appearing across productivity tools, cyber security, learning platforms, data tools, service desks and administrative systems. In many cases, the pricing model is not a simple licence fee. It may involve credits, tokens, premium features, rate cards, usage limits or third-party foundation models.

Beyond the licence: understanding the emerging cost of AI adoption and consumption

This session is an opportunity to share experiences relating to the costs associated with AI 'creep' across multiple tools and services.

Henry Hughes, our chief technology officer welcomes you to the second day of Security Conference 2026 and provides an overview of what you can expect from the day.

Welcome to day two

Henry Hughes, our chief technology officer welcomes you to the second day of Security Conference 2026 and provides an overview of what you can expect from the day.

Join one of the discussion tables for open conversation with support from Jisc experts.Take this opportunity to share experiences of cyber essentials (plus) with peers at different stages of the accreditation process. This conversation is for you whether you are working towards cyber essentials or cyber essentials plus for the first time or want to talk about the latest developments impacting your recertification.

Cyber essentials community clinic

Join one of the discussion tables for open conversation with support from Jisc experts.

Building directly on part one: breaking in, this second session assumes an attacker has successfully established an initial foothold and explores what happens next.Our red team will demonstrate techniques an attacker may use to escalate privileges, discover additional systems and identities, and move laterally through an environment, illustrating how an initial identity compromise can develop into a much wider security incident.At each stage of the attack, our blue team will demonstrate the defender’s perspective, using Microsoft Defender XDR and wider security telemetry to detect, investigate and respond to malicious activity. We will follow the incident response lifecycle from alert analysis and attack reconstruction through to containment, remediation and identifying the wider scope of compromise.
The session will highlight the importance of correlating identity, endpoint and other security signals rather than treating individual alerts in isolation, and show how effective detection engineering, threat hunting and response can disrupt an attacker before they achieve their objectives.Together, parts one and two provide an end-to-end view of a realistic attack chain, from initial access through to privilege escalation and lateral movement with our red and blue teams demonstrating both sides of the attack in action.

Part two: inside the network - privilege escalation, lateral movement and response

Building directly on part one: breaking in, this second session assumes an attacker has successfully established an initial foothold and explores what happens next.

Detection isn’t one tool’s job. This talk discusses why SIEM still anchors the SOC, how new technologies can make a lasting impact, and why people and processes are just as important as the technology.Every year the SIEM is declared dead by at least one vendor, superseded by the current trending technology. Yet most serious incidents will touch multiple systems, requiring a tool that is able to consolidate and correlate activity across your entire estate to detect and investigate the activity. This is where a SIEM comes in. We'll cover the technology, but also the people and processes that make a SIEM genuinely useful, rather than an expensive archive nobody reads. We’ll talk about how Jisc uses SIEM and SOAR in our SOC service for providing constant, repeatable responses to alerts.We’ll look at our roadmap and consider how AI is starting to be used in the detection rule lifecycle and its impact on supporting triage and threat intelligence.Experts will be on hand to answer any burning questions you have around SIEM and security automation.

Why a SIEM is a critical component of a SOC

Detection isn’t one tool’s job. This talk discusses why SIEM still anchors the SOC, how new technologies can make a lasting impact, and why people and processes are just as important as the technology.

This session will be a space for peers to share challenges and problem solve together.In this session, participants will be able to choose from table discussions on a range of topics relevant to research and cyber:<ul><li>Engaging with senior/exec leaders about cyber</li><li>Working with 3rd party supplier on their cyber posture, and how that influences yours</li><li>Managing cyber in a time of cost savings being a priority</li><li>Building cyber awareness with students/staff</li></ul>

Research focused cyber knowledge café

Explore how to filter noisy threat intelligence, streamline triage workflows, and tackle unique academic governance challenges ranging from decentralised stakeholders to unowned, compromised systems. Academic institutions face a unique challenge: balancing open, collaborative environments with robust, enterprise-grade security. For resource-constrained IT teams, Cyber Threat Intelligence (CTI) can feel out of reach, offering noisy, irrelevant data rather than actionable insight.This session aims to align threat theory and campus reality. The first half explores strategies for evaluating, filtering, and tuning both open-source and commercial CTI feeds to counter ransomware, credential theft, and research exfiltration.The second half is a hands-on triage workshop. Working with a simulated live feed, attendees will practise ingestion, deduplication, and relevancy filtering, alongside navigating complex governance challenges like stakeholder mapping and responding to compromised, unowned devices.

Who owns that box? Practical deployment of Cyber Threat Intelligence (CTI) in academic environments

Explore how to filter noisy threat intelligence, streamline triage workflows, and tackle unique academic governance challenges ranging from decentralised stakeholders to unowned, compromised systems. 

This session looks at how CAF works, draws on experience from across the sector of undertaking the assessment, and explores how this supports improvements in cyber resilience.The NCSC’s Cybersecurity Assessment Framework has long been mandated as a security programme for critical national infrastructure. Increasing interest in the framework has been emerging from the higher education and research sectors as a vehicle for working towards compliance but more so a platform for building cyber security resilience.

We need to talk about CAF: beyond compliance to cyber resilience

This session looks at how CAF works, draws on experience from across the sector of undertaking the assessment, and explores how this supports improvements in cyber resilience.

Our CTI service now detects malicious network traffic in near real time. Hear the latest on NetFlow visibility, the CTI sharing group, and what's next. Our cyber threat intelligence (CTI) service underpins our wider core security services, including the SOC. By combining sector-wide intelligence with visibility across the Janet network, CTI helps identify emerging threats, strengthen detection and response, and provide members with earlier warning of malicious activity.This session covers the latest developments in our cyber threat intelligence service, with a focus on improvements to NetFlow visibility across the Janet network. We'll walk through new proactive capabilities that allow us to detect and alert on traffic to known malicious IP infrastructure in near real time, and explain what this means for the value we can offer members in identifying compromise earlier. We'll also share our roadmap for further capability improvements in this area.Alongside this, we'll give an update on the CTI sharing group's progress, and how improvements to our intelligence tooling are strengthening how we track, report on, and visualise the threat landscape facing UK education and research. We'll finish with a broader look at what's next for the CTI service and what members can expect in the months ahead.

Seeing more, stopping more in Jisc's evolving CTI service

Our CTI service now detects malicious network traffic in near real time. Hear the latest on NetFlow visibility, the CTI sharing group, and what's next. 

Explore how Microsoft's Purview DSPM helps you monitor and control AI usage on your managed devices.Explore how Microsoft's Purview DSPM (Data Security Posture Management) helps you monitor AI usage, not just inside Microsoft 365. See what prompts your users are entering, monitor and control sensitive data being used in these services and even monitor for safeguarding purposes.

Monitor your AI usage using Microsoft Purview DSPM

Explore how Microsoft's Purview DSPM helps you monitor and control AI usage on your managed devices.

This session will discuss the impact of mandatory CE, the CE requirements and the Jisc licensing response in support of the sector.This session explores the challenges faced by FE institutions following the mandatory implementation of CE across the sector. Joy from the CE Team will provide an overview of CE and the challenges institutions have encountered, while Holly from Licensing will share how the licensing team has responded to support institutions through the transition.

Navigating mandatory Cyber Essentials: supporting FE through change

This session will discuss the impact of mandatory CE, the CE requirements and the Jisc licensing response in support of the sector.

What can the UK education sector learn from the approach to DMARC adopted by the UK Government in 2016, and the wider-reaching approach taken by the Dutch Government in 2019?This session will explore the practical and strategic value of adopting DMARC, from individual institutions through to a coordinated sector-wide approach. It will look at what DMARC is, what implementation involves, and how government-led adoption has helped shape approaches to email security.The session will cover:<ul><li>A practical introduction to DMARC and why it matters</li><li>The tools, tasks and timelines involved in implementing DMARC</li><li>The benefits of DMARC for individual education institutions</li><li>The potential benefits of a coordinated, sector-wide approach</li><li>Lessons from the UK Government's adoption of DMARC in 2016</li><li>The Dutch Government's broader approach to DMARC adoption</li><li>An overview of estimated current DMARC adoption across the UK education sector</li></ul>

DMARC: one for all, what would a sector wide implementation of Dmarc achieve

What can the UK education sector learn from the approach to DMARC adopted by the UK Government in 2016, and the wider-reaching approach taken by the Dutch Government in 2019?

Join us as David Batho, our director of security, offers closing thoughts from this year's Security Conference.

Join us as David Batho, our director of security, offers closing thoughts from this year's Security Conference.

Security Conference programme 2026