What is the format of this security leadership event?

This event is a co-located conference, bringing together both CISO 360 and CSO 360 events.

Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania

Name: Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania
Start: 2027-05-10T00:00:00Z
End: 2027-05-11T00:00:00Z
Location: Singapore

May 10–11, 2027Singapore, SingaporeIn-person

Registration open

The Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania conference convenes in SGP, bringing together security leaders from across the Asia and Oceania regions. This event is designed to foster collaboration and knowledge exchange among Chief Information Security Officers (CISOs) and Chief Security Officers (CSOs), addressing the evolving landscape of cybersecurity and physical security threats. The conference provides a platform for high-level discussions on strategic security challenges, emerging technologies, and best practices. Participants will engage in dialogues aimed at enhancing organizational resilience and navigating complex security environments in an increasingly interconnected world.

Committees & topics

Topics
The Evolving Leadership Role, Mission and Purpose of the CISO/CSO · Artificial Intelligence and Enterprise Security · Machine Learning: Risk, Robustness and Adversarial Threats · Quantum Computing and the Post-Quantum Transition · Digital Innovation and Secure-by-Design Transformation · Cybercrime: Threat Landscape and International Response · Cybersecurity Governance and Board Accountability · Security Awareness and the Human Layer

Why it matters

In an era of escalating cyber threats and dynamic geopolitical shifts, the convergence of CISO and CSO perspectives is critical. This event acknowledges the interconnectedness of information security and physical security, recognizing that a holistic approach is essential for comprehensive organizational protection. The discussions will likely delve into topics such as integrated risk management, threat intelligence sharing, and the strategic alignment of security initiatives with business objectives.

The conference's focus on Asia and Oceania highlights the unique security challenges and opportunities within these diverse regions. As digital transformation accelerates across these economies, the need for robust security leadership becomes paramount. The insights shared and networks built at this event will contribute to strengthening the security posture of organizations operating within this vital global economic zone.

Furthermore, the event serves as a crucial forum for leaders to explore innovative solutions and adaptive strategies. With the rapid pace of technological advancement, security professionals must continuously update their knowledge and capabilities. This conference offers a focused environment for learning about cutting-edge security technologies and methodologies, ensuring that participants are equipped to address future security landscapes.

How to prepare

To maximize the benefit from this conference, delegates should consider reviewing fundamental concepts related to strategic security leadership and interdepartmental collaboration. Understanding the nuances of "what-is-stakeholder-mapping" and developing effective "engagement-strategies" will be particularly valuable when interacting with peers and discussing complex security challenges.

Participants may also find it beneficial to reflect on lessons such as "gender-dynamics-across-cultures" to better navigate the diverse professional environments represented at the conference. Preparing to discuss how security strategies can be adapted to various cultural and regulatory contexts will enhance engagement and learning outcomes. Considering the broader implications of "dynamic-analysis" in threat assessment can also provide a strong foundation for understanding advanced security discussions.

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Singapore

A leading hub for cybersecurity innovation and regional security cooperation.

Role in topic

As the host nation, SGP plays a significant role in fostering regional security dialogues and showcasing advanced cybersecurity infrastructure. Its strategic location and commitment to digital security make it an ideal venue for such a high-level conference.

Topics & background

The background behind each topic and the actors that shape it.

The Evolving Leadership Role, Mission and Purpose of the CISO/CSO

The Chief Information Security Officer role emerged in the mid-1990s, with Citigroup appointing what is widely cited as the first CISO in 1995 after a series of high-profile cyber intrusions. For two decades the function sat deep inside IT, framed narrowly around perimeter defence, compliance, and incident response. The parallel Chief Security Officer role grew from corporate and physical security traditions, often anchored in law enforcement or military backgrounds. Across Asia and Oceania, the two functions historically reported through different chains — CISOs to the CIO, CSOs to operations or legal — producing fragmented accountability for enterprise risk. The past decade has reshaped the mission. Mandatory breach-notification regimes (Australia's NDB scheme in 2018, Singapore's PDPA amendments in 2021, India's DPDP Act in 2023, Japan's APPI revisions), board-level cyber disclosure expectations from the US SEC and equivalents, and converged threats spanning ransomware, insider risk, supply chain compromise and geopolitical disruption have pushed security leaders out of the server room and into the boardroom. The SolarWinds, Optus, Medibank and MOVEit incidents underscored that security failures are now existential business events. Today the debate centres on what the security leader's purpose actually is: a technical control owner, a business risk advisor, or a fiduciary accountable alongside the CEO and CFO. Convergence of cyber and physical security, personal liability exposure (as seen in the Uber CSO prosecution), and the rise of resilience mandates such as the EU's DORA and NIS2 are forcing a redefinition of the mission from protection to enterprise trust and continuity.

Key players

Artificial Intelligence and Enterprise Security

Artificial intelligence as a security concern moved from theoretical to operational with the public release of large language models in late 2022. Within months, enterprises across Asia and Oceania faced a dual challenge: defending against AI-enabled attacks — deepfake-driven business email compromise, automated reconnaissance, and synthetic identity fraud — while governing the rapid internal adoption of generative tools that could exfiltrate sensitive data through prompts. The 2024 Arup deepfake fraud in Hong Kong, which cost USD 25 million, crystallised the threat for regional CISOs. Governments have responded unevenly. The EU AI Act (entered into force 2024) set the first comprehensive risk-based framework; the US issued Executive Order 14110 before its 2025 rescission and replacement; China implemented its Generative AI Measures in August 2023; Singapore released the Model AI Governance Framework and AI Verify; Japan adopted a softer guideline-based approach; Australia is consulting on mandatory guardrails for high-risk AI. The UN's Global Digital Compact and the Bletchley and Seoul AI Safety Summits have begun to converge on shared red lines. For security leaders, the unresolved questions are practical: how to inventory shadow AI use, how to assess model supply chain risk, how to apply existing frameworks (NIST AI RMF, ISO/IEC 42001) without stifling business value, and how to defend against adversarial machine learning when the threat actors are themselves AI-augmented.

Key players

Machine Learning: Risk, Robustness and Adversarial Threats

Machine learning has been embedded in security operations — spam filtering, anomaly detection, fraud scoring — for over two decades, but the scale and opacity of modern deep learning systems have transformed the risk profile. Adversarial machine learning research, beginning with seminal work on evasion attacks in 2013–2014, demonstrated that classifiers could be fooled by imperceptible input perturbations. Model inversion, membership inference, and data poisoning attacks have since been documented against production systems in finance and healthcare across the region. NIST's Adversarial Machine Learning taxonomy (AI 100-2, updated 2024) and MITRE ATLAS now provide common vocabulary, but enterprise adoption of ML security controls lags far behind ML deployment. In Asia-Oceania, ML powers credit decisioning at major banks, fraud detection at telcos, and surveillance systems in smart-city deployments, yet few organisations conduct red-teaming of their models or maintain ML bills of materials. The MITRE and OWASP ML Top 10 frameworks are emerging reference points. The core debate for security leaders is whether ML systems should be governed as software (under existing SDLC controls), as data assets (under privacy regimes), or as a distinct category requiring new assurance practices including continuous monitoring for drift, poisoning, and extraction.

Key players

Quantum Computing and the Post-Quantum Transition

Quantum computing's relevance to security is defined by Peter Shor's 1994 algorithm, which showed that a sufficiently large quantum computer could break RSA, ECC, and Diffie-Hellman — the asymmetric cryptography underpinning virtually all digital trust. Although cryptographically relevant quantum computers do not yet exist, the 'harvest now, decrypt later' threat model assumes adversaries are already collecting encrypted traffic for future decryption, making the migration timeline urgent for long-lived secrets. NIST finalised the first three post-quantum cryptography standards in August 2024 (ML-KEM, ML-DSA, SLH-DSA), with FALCON to follow. The US issued National Security Memorandum 10 in 2022 mandating federal migration; Australia's ASD published PQC transition guidance in 2023; Singapore, Japan and South Korea have launched national quantum-safe initiatives; China has invested heavily in both quantum computing and a parallel quantum key distribution backbone. The G7 and Quad have flagged quantum as a critical technology. For security leaders, the practical agenda is cryptographic inventory, crypto-agility, vendor pressure on hardware security modules and PKI providers, and managing a decade-long migration that touches every protocol, certificate, and embedded device in the enterprise.

Key players

Digital Innovation and Secure-by-Design Transformation

Digital transformation accelerated sharply during the COVID-19 pandemic, compressing multi-year cloud, mobile, and API migration roadmaps into months. Across Asia-Oceania, digital public infrastructure initiatives — India Stack, Singapore's National Digital Identity, Australia's Digital ID Act 2024 — and the rapid scaling of fintech, e-commerce, and superapps have reshaped the attack surface. Innovation pressure routinely outpaces security maturity, with DevOps pipelines, low-code platforms, SaaS sprawl, and now generative AI assistants embedded in code production. Regulators and standards bodies have responded with secure-by-design and secure-by-default expectations: CISA's 2023 secure-by-design principles (co-sealed by ASD, CCCS, NCSC-UK and others), the EU Cyber Resilience Act adopted in 2024, and Singapore's Cybersecurity Labelling Scheme for IoT. The OECD's work on digital security risk management and the UN Global Digital Compact frame innovation and security as complementary rather than competing objectives. The debate for security leaders centres on how to embed security into product and platform teams without becoming a brake on innovation, how to govern third-party and open-source dependencies (highlighted by the 2024 XZ Utils backdoor), and how to measure the security ROI of innovation programmes.

Key players

Cybercrime: Threat Landscape and International Response

Cybercrime has evolved from individual hacking through organised criminal enterprises to a professionalised ecosystem of ransomware-as-a-service, initial access brokers, and state-tolerated affiliates. The 2017 WannaCry and NotPetya incidents demonstrated systemic risk; the 2021 Colonial Pipeline attack and the 2022–2023 wave against Australian organisations (Optus, Medibank, Latitude) and Asian targets normalised double-extortion ransomware as a board-level concern. The FBI's IC3 reported losses exceeding USD 12 billion in 2023, and INTERPOL identifies cybercrime as the fastest-growing crime category in ASEAN. International response has consolidated around two tracks. The Council of Europe's Budapest Convention (2001), now joined by over 75 states including Japan, Australia, the Philippines and Sri Lanka, remains the principal mutual legal assistance framework. The UN General Assembly adopted the Convention against Cybercrime in December 2024 after five years of negotiation, though concerns persist over human rights safeguards and surveillance scope. Operational coalitions — the Counter Ransomware Initiative (50+ states), INTERPOL's Operation Synergia, and AFP-led regional task forces — have produced takedowns of LockBit, Hive, and BlackCat infrastructure. For security leaders, the questions are jurisdictional reach, sanctions exposure when paying ransoms, evidence preservation across borders, and the rising bar for incident reporting under regimes such as Australia's SOCI Act and Singapore's Cybersecurity Act amendments.

Key players

Cybersecurity Governance and Board Accountability

Cybersecurity governance has moved decisively from an IT control matter to a corporate governance obligation. The 2014 NIST Cybersecurity Framework (now CSF 2.0, released 2024 with a dedicated Govern function) codified governance as a peer to Identify, Protect, Detect, Respond and Recover. ISO/IEC 27001:2022, COBIT 2019, and the ASX, MAS, HKMA and JFSA supervisory guidance have all elevated board-level expectations. Regulatory momentum has accelerated since 2022. The US SEC's cyber disclosure rules (effective December 2023) require material incident reporting within four business days and annual governance disclosures. The EU's NIS2 Directive and DORA impose direct management liability. Australia's SOCI Act amendments, Singapore's CCoP 2.0, India's CERT-In six-hour reporting directive, and Japan's revised METI guidelines all push accountability upward. The Uber CSO conviction in 2022 and personal sanctions against executives in several jurisdictions have made personal liability tangible. The governance debate now centres on three issues: the appropriate reporting line for the CISO (CIO, CEO, CRO, or board), the composition of board cyber expertise, and how to translate technical risk into the language of enterprise risk appetite. Frameworks such as FAIR for quantitative cyber risk and ESG-linked cyber disclosure are reshaping how boards exercise oversight.

Key players

Security Awareness and the Human Layer

Phishing and social engineering remain the leading initial access vector in virtually every regional threat report, accounting for the majority of breaches tracked by the Verizon DBIR, ACSC Annual Cyber Threat Report, and ENISA Threat Landscape. The discipline of security awareness, formalised in the early 2000s through ISO 27001 Annex A.7.2.2 and PCI DSS Requirement 12.6, has matured from annual compliance e-learning toward continuous behavioural programmes, simulated phishing, and security culture measurement using instruments such as SANS' Security Awareness Maturity Model. Three shifts have transformed the field. First, generative AI has industrialised convincing phishing, deepfake voice and video, and localised lures in every regional language, eroding the traditional 'spot the typo' heuristics. Second, hybrid work has dissolved the office perimeter, making human judgement the dominant control for SaaS, BYOD and home network risk. Third, regulators in Singapore, Australia, Hong Kong and India increasingly require evidence of effective — not merely delivered — awareness training, with MAS TRM Guidelines and ACSC Essential Eight referencing user education explicitly. The contemporary debate is whether awareness should be reframed as 'human risk management,' integrating identity analytics, just-in-time nudges, and targeted intervention for high-risk roles, and whether responsibility for human error should sit with the individual employee, the security team, or the system designers who failed to make the secure path the easy path.

Key players

Resources

News, lessons, and country profiles to prep for Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania.

Recent reporting to ground your prep

Supreme Court Upholds Election Commission Dis

Ken Martin's DNC Autopsy Reveals Party Strugg

Election Commission's Bengal Crackdown

Kharge Calls Modi 'Terrorist', BJP Complains

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Crisis Management

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

The states in play, with the data that shapes their stance

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

By committee

Frequently asked questions

Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania

May 10–11, 2027Singapore, SingaporeIn-person

Registration open

Committees & topics

Topics
The Evolving Leadership Role, Mission and Purpose of the CISO/CSO · Artificial Intelligence and Enterprise Security · Machine Learning: Risk, Robustness and Adversarial Threats · Quantum Computing and the Post-Quantum Transition · Digital Innovation and Secure-by-Design Transformation · Cybercrime: Threat Landscape and International Response · Cybersecurity Governance and Board Accountability · Security Awareness and the Human Layer

Why it matters

How to prepare

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Singapore

A leading hub for cybersecurity innovation and regional security cooperation.

Role in topic

Topics & background

The background behind each topic and the actors that shape it.

The Evolving Leadership Role, Mission and Purpose of the CISO/CSO

Key players

Artificial Intelligence and Enterprise Security

Key players

Machine Learning: Risk, Robustness and Adversarial Threats

Key players

Quantum Computing and the Post-Quantum Transition

Key players

Digital Innovation and Secure-by-Design Transformation

Key players

Cybercrime: Threat Landscape and International Response

Key players

Cybersecurity Governance and Board Accountability

Key players

Security Awareness and the Human Layer

Key players

Resources

News, lessons, and country profiles to prep for Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania.

Recent reporting to ground your prep

Supreme Court Upholds Election Commission Dis

Ken Martin's DNC Autopsy Reveals Party Strugg

Election Commission's Bengal Crackdown

Kharge Calls Modi 'Terrorist', BJP Complains

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Crisis Management

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

The states in play, with the data that shapes their stance

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

By committee

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

Regional Outlook Forum 2026 – Confronting Chaos: The Future of International Order in Southeast Asia

Raffles Policy Dialogue 2026

International Conference on Privacy and Information Security Law (ICPISL)

IISS Shangri-La Dialogue 2026: Managing Regional Tensions Amid Global Competition

SISMUN Conclave 2026

International Conference on Public Policy, Globalization, and Democratic Rights (ICPPGDR - 26)

Frequently asked questions

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

Regional Outlook Forum 2026 – Confronting Chaos: The Future of International Order in Southeast Asia

Raffles Policy Dialogue 2026

International Conference on Privacy and Information Security Law (ICPISL)

IISS Shangri-La Dialogue 2026: Managing Regional Tensions Amid Global Competition

SISMUN Conclave 2026

International Conference on Public Policy, Globalization, and Democratic Rights (ICPPGDR - 26)

Frequently asked questions