--- title: "CISO 2027 — Singapore | Model Diplomat" description: "Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania is a professional conference in Singapore, Singapore, May 10–11, 2027." url: "https://modeldiplomat.com/conferences/professional/security-leadership-6th-ciso-360-2nd-cso-360-asia-oceania-2027" --- # Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania May 10–11, 2027[Singapore, Singapore](https://www.google.com/maps/search/?api=1\&query=Singapore%2C%20Singapore)In-person [Registration open](https://www.pulseconferences.com/conference/co-location-security-leadership-ciso-360-cso-360-asia-oceania/) The Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania conference convenes in SGP, bringing together security leaders from across the Asia and Oceania regions. This event is designed to foster collaboration and knowledge exchange among Chief Information Security Officers (CISOs) and Chief Security Officers (CSOs), addressing the evolving landscape of cybersecurity and physical security threats. The conference provides a platform for high-level discussions on strategic security challenges, emerging technologies, and best practices. Participants will engage in dialogues aimed at enhancing organizational resilience and navigating complex security environments in an increasingly interconnected world. ## Committees & topics - Topics The Evolving Leadership Role, Mission and Purpose of the CISO/CSO · Artificial Intelligence and Enterprise Security · Machine Learning: Risk, Robustness and Adversarial Threats · Quantum Computing and the Post-Quantum Transition · Digital Innovation and Secure-by-Design Transformation · Cybercrime: Threat Landscape and International Response · Cybersecurity Governance and Board Accountability · Security Awareness and the Human Layer ## Why it matters In an era of escalating cyber threats and dynamic geopolitical shifts, the convergence of CISO and CSO perspectives is critical. This event acknowledges the interconnectedness of information security and physical security, recognizing that a holistic approach is essential for comprehensive organizational protection. The discussions will likely delve into topics such as integrated risk management, threat intelligence sharing, and the strategic alignment of security initiatives with business objectives. The conference's focus on Asia and Oceania highlights the unique security challenges and opportunities within these diverse regions. As digital transformation accelerates across these economies, the need for robust security leadership becomes paramount. The insights shared and networks built at this event will contribute to strengthening the security posture of organizations operating within this vital global economic zone. Furthermore, the event serves as a crucial forum for leaders to explore innovative solutions and adaptive strategies. With the rapid pace of technological advancement, security professionals must continuously update their knowledge and capabilities. This conference offers a focused environment for learning about cutting-edge security technologies and methodologies, ensuring that participants are equipped to address future security landscapes. ## How to prepare To maximize the benefit from this conference, delegates should consider reviewing fundamental concepts related to strategic security leadership and interdepartmental collaboration. Understanding the nuances of "what-is-stakeholder-mapping" and developing effective "engagement-strategies" will be particularly valuable when interacting with peers and discussing complex security challenges. Participants may also find it beneficial to reflect on lessons such as "gender-dynamics-across-cultures" to better navigate the diverse professional environments represented at the conference. Preparing to discuss how security strategies can be adapted to various cultural and regulatory contexts will enhance engagement and learning outcomes. Considering the broader implications of "dynamic-analysis" in threat assessment can also provide a strong foundation for understanding advanced security discussions. ## Country perspectives Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile. [Singapore](https://modeldiplomat.com/country/singapore) [A leading hub for cybersecurity innovation and regional security cooperation.](https://modeldiplomat.com/country/singapore) [Role in topic](https://modeldiplomat.com/country/singapore) [As the host nation, SGP plays a significant role in fostering regional security dialogues and showcasing advanced cybersecurity infrastructure. Its strategic location and commitment to digital security make it an ideal venue for such a high-level conference.](https://modeldiplomat.com/country/singapore) ## Topics & background The background behind each topic and the actors that shape it. 1 ### The Evolving Leadership Role, Mission and Purpose of the CISO/CSO The Chief Information Security Officer role emerged in the mid-1990s, with Citigroup appointing what is widely cited as the first CISO in 1995 after a series of high-profile cyber intrusions. For two decades the function sat deep inside IT, framed narrowly around perimeter defence, compliance, and incident response. The parallel Chief Security Officer role grew from corporate and physical security traditions, often anchored in law enforcement or military backgrounds. Across Asia and Oceania, the two functions historically reported through different chains — CISOs to the CIO, CSOs to operations or legal — producing fragmented accountability for enterprise risk. The past decade has reshaped the mission. Mandatory breach-notification regimes (Australia's NDB scheme in 2018, Singapore's PDPA amendments in 2021, India's DPDP Act in 2023, Japan's APPI revisions), board-level cyber disclosure expectations from the US SEC and equivalents, and converged threats spanning ransomware, insider risk, supply chain compromise and geopolitical disruption have pushed security leaders out of the server room and into the boardroom. The SolarWinds, Optus, Medibank and MOVEit incidents underscored that security failures are now existential business events. Today the debate centres on what the security leader's purpose actually is: a technical control owner, a business risk advisor, or a fiduciary accountable alongside the CEO and CFO. Convergence of cyber and physical security, personal liability exposure (as seen in the Uber CSO prosecution), and the rise of resilience mandates such as the EU's DORA and NIS2 are forcing a redefinition of the mission from protection to enterprise trust and continuity. Key players - [United States](https://modeldiplomat.com/country/united-states) [Origin of the CISO role and source of SEC cyber-disclosure rules shaping global practice](https://modeldiplomat.com/country/united-states) - [Singapore](https://modeldiplomat.com/country/singapore) [Regional hub for security leadership standards via CSA Singapore and MAS guidelines](https://modeldiplomat.com/country/singapore) - [Australia](https://modeldiplomat.com/country/australia) [Driving board-level accountability after Optus and Medibank breaches](https://modeldiplomat.com/country/australia) - [Japan](https://modeldiplomat.com/country/japan) [Advancing CISO mandates through METI cybersecurity management guidelines](https://modeldiplomat.com/country/japan) - [India](https://modeldiplomat.com/country/india) [Codifying security leadership duties under the DPDP Act and CERT-In directives](https://modeldiplomat.com/country/india) 2 ### Artificial Intelligence and Enterprise Security Artificial intelligence as a security concern moved from theoretical to operational with the public release of large language models in late 2022. Within months, enterprises across Asia and Oceania faced a dual challenge: defending against AI-enabled attacks — deepfake-driven business email compromise, automated reconnaissance, and synthetic identity fraud — while governing the rapid internal adoption of generative tools that could exfiltrate sensitive data through prompts. The 2024 Arup deepfake fraud in Hong Kong, which cost USD 25 million, crystallised the threat for regional CISOs. Governments have responded unevenly. The EU AI Act (entered into force 2024) set the first comprehensive risk-based framework; the US issued Executive Order 14110 before its 2025 rescission and replacement; China implemented its Generative AI Measures in August 2023; Singapore released the Model AI Governance Framework and AI Verify; Japan adopted a softer guideline-based approach; Australia is consulting on mandatory guardrails for high-risk AI. The UN's Global Digital Compact and the Bletchley and Seoul AI Safety Summits have begun to converge on shared red lines. For security leaders, the unresolved questions are practical: how to inventory shadow AI use, how to assess model supply chain risk, how to apply existing frameworks (NIST AI RMF, ISO/IEC 42001) without stifling business value, and how to defend against adversarial machine learning when the threat actors are themselves AI-augmented. Key players - [United States](https://modeldiplomat.com/country/united-states) [Home of leading frontier model developers and shifting federal AI policy](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Operates the most prescriptive generative AI regulatory regime](https://modeldiplomat.com/country/china) - [Singapore](https://modeldiplomat.com/country/singapore) [Regional standard-setter through AI Verify and the Model AI Governance Framework](https://modeldiplomat.com/country/singapore) - [Japan](https://modeldiplomat.com/country/japan) [Champion of the Hiroshima AI Process and light-touch governance](https://modeldiplomat.com/country/japan) - [Australia](https://modeldiplomat.com/country/australia) [Developing mandatory guardrails for high-risk AI deployments](https://modeldiplomat.com/country/australia) - [South Korea](https://modeldiplomat.com/country/south-korea) [Host of the Seoul AI Safety Summit and AI Basic Act passed in 2024](https://modeldiplomat.com/country/south-korea) 3 ### Machine Learning: Risk, Robustness and Adversarial Threats Machine learning has been embedded in security operations — spam filtering, anomaly detection, fraud scoring — for over two decades, but the scale and opacity of modern deep learning systems have transformed the risk profile. Adversarial machine learning research, beginning with seminal work on evasion attacks in 2013–2014, demonstrated that classifiers could be fooled by imperceptible input perturbations. Model inversion, membership inference, and data poisoning attacks have since been documented against production systems in finance and healthcare across the region. NIST's Adversarial Machine Learning taxonomy (AI 100-2, updated 2024) and MITRE ATLAS now provide common vocabulary, but enterprise adoption of ML security controls lags far behind ML deployment. In Asia-Oceania, ML powers credit decisioning at major banks, fraud detection at telcos, and surveillance systems in smart-city deployments, yet few organisations conduct red-teaming of their models or maintain ML bills of materials. The MITRE and OWASP ML Top 10 frameworks are emerging reference points. The core debate for security leaders is whether ML systems should be governed as software (under existing SDLC controls), as data assets (under privacy regimes), or as a distinct category requiring new assurance practices including continuous monitoring for drift, poisoning, and extraction. Key players - [United States](https://modeldiplomat.com/country/united-states) [Source of NIST AML taxonomy and dominant ML research base](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Largest operational deployer of ML in surveillance and fintech](https://modeldiplomat.com/country/china) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [AI Safety Institute leading model evaluation methodologies](https://modeldiplomat.com/country/united-kingdom) - [Singapore](https://modeldiplomat.com/country/singapore) [Operationalising ML testing via AI Verify Foundation](https://modeldiplomat.com/country/singapore) - [Israel](https://modeldiplomat.com/country/israel) [Major exporter of ML-based cyber defence and offensive capability](https://modeldiplomat.com/country/israel) 4 ### Quantum Computing and the Post-Quantum Transition Quantum computing's relevance to security is defined by Peter Shor's 1994 algorithm, which showed that a sufficiently large quantum computer could break RSA, ECC, and Diffie-Hellman — the asymmetric cryptography underpinning virtually all digital trust. Although cryptographically relevant quantum computers do not yet exist, the 'harvest now, decrypt later' threat model assumes adversaries are already collecting encrypted traffic for future decryption, making the migration timeline urgent for long-lived secrets. NIST finalised the first three post-quantum cryptography standards in August 2024 (ML-KEM, ML-DSA, SLH-DSA), with FALCON to follow. The US issued National Security Memorandum 10 in 2022 mandating federal migration; Australia's ASD published PQC transition guidance in 2023; Singapore, Japan and South Korea have launched national quantum-safe initiatives; China has invested heavily in both quantum computing and a parallel quantum key distribution backbone. The G7 and Quad have flagged quantum as a critical technology. For security leaders, the practical agenda is cryptographic inventory, crypto-agility, vendor pressure on hardware security modules and PKI providers, and managing a decade-long migration that touches every protocol, certificate, and embedded device in the enterprise. Key players - [United States](https://modeldiplomat.com/country/united-states) [Sets global PQC standards through NIST and mandates federal migration](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Leading investor in quantum computing and operational QKD networks](https://modeldiplomat.com/country/china) - [Australia](https://modeldiplomat.com/country/australia) [Issued ASD post-quantum transition guidance for critical infrastructure](https://modeldiplomat.com/country/australia) - [Japan](https://modeldiplomat.com/country/japan) [National quantum strategy integrating PQC and quantum hardware R\&D](https://modeldiplomat.com/country/japan) - [South Korea](https://modeldiplomat.com/country/south-korea) [Building national quantum-safe network with major telcos](https://modeldiplomat.com/country/south-korea) - [Singapore](https://modeldiplomat.com/country/singapore) [Operating the National Quantum-Safe Network testbed](https://modeldiplomat.com/country/singapore) 5 ### Digital Innovation and Secure-by-Design Transformation Digital transformation accelerated sharply during the COVID-19 pandemic, compressing multi-year cloud, mobile, and API migration roadmaps into months. Across Asia-Oceania, digital public infrastructure initiatives — India Stack, Singapore's National Digital Identity, Australia's Digital ID Act 2024 — and the rapid scaling of fintech, e-commerce, and superapps have reshaped the attack surface. Innovation pressure routinely outpaces security maturity, with DevOps pipelines, low-code platforms, SaaS sprawl, and now generative AI assistants embedded in code production. Regulators and standards bodies have responded with secure-by-design and secure-by-default expectations: CISA's 2023 secure-by-design principles (co-sealed by ASD, CCCS, NCSC-UK and others), the EU Cyber Resilience Act adopted in 2024, and Singapore's Cybersecurity Labelling Scheme for IoT. The OECD's work on digital security risk management and the UN Global Digital Compact frame innovation and security as complementary rather than competing objectives. The debate for security leaders centres on how to embed security into product and platform teams without becoming a brake on innovation, how to govern third-party and open-source dependencies (highlighted by the 2024 XZ Utils backdoor), and how to measure the security ROI of innovation programmes. Key players - [Singapore](https://modeldiplomat.com/country/singapore) [Regional model for secure digital government and IoT labelling](https://modeldiplomat.com/country/singapore) - [India](https://modeldiplomat.com/country/india) [Operator of the world's largest digital public infrastructure stack](https://modeldiplomat.com/country/india) - [Australia](https://modeldiplomat.com/country/australia) [Implementing Digital ID and secure-by-design co-sealing with allies](https://modeldiplomat.com/country/australia) - [United States](https://modeldiplomat.com/country/united-states) [Driving global secure-by-design principles via CISA](https://modeldiplomat.com/country/united-states) - [South Korea](https://modeldiplomat.com/country/south-korea) [Advanced digital government and 5G/6G innovation testbed](https://modeldiplomat.com/country/south-korea) 6 ### Cybercrime: Threat Landscape and International Response Cybercrime has evolved from individual hacking through organised criminal enterprises to a professionalised ecosystem of ransomware-as-a-service, initial access brokers, and state-tolerated affiliates. The 2017 WannaCry and NotPetya incidents demonstrated systemic risk; the 2021 Colonial Pipeline attack and the 2022–2023 wave against Australian organisations (Optus, Medibank, Latitude) and Asian targets normalised double-extortion ransomware as a board-level concern. The FBI's IC3 reported losses exceeding USD 12 billion in 2023, and INTERPOL identifies cybercrime as the fastest-growing crime category in ASEAN. International response has consolidated around two tracks. The Council of Europe's Budapest Convention (2001), now joined by over 75 states including Japan, Australia, the Philippines and Sri Lanka, remains the principal mutual legal assistance framework. The UN General Assembly adopted the Convention against Cybercrime in December 2024 after five years of negotiation, though concerns persist over human rights safeguards and surveillance scope. Operational coalitions — the Counter Ransomware Initiative (50+ states), INTERPOL's Operation Synergia, and AFP-led regional task forces — have produced takedowns of LockBit, Hive, and BlackCat infrastructure. For security leaders, the questions are jurisdictional reach, sanctions exposure when paying ransoms, evidence preservation across borders, and the rising bar for incident reporting under regimes such as Australia's SOCI Act and Singapore's Cybersecurity Act amendments. Key players - [United States](https://modeldiplomat.com/country/united-states) [Leads Counter Ransomware Initiative and major law enforcement actions](https://modeldiplomat.com/country/united-states) - [Russia](https://modeldiplomat.com/country/russia) [Jurisdiction harbouring many high-impact ransomware operators](https://modeldiplomat.com/country/russia) - [Australia](https://modeldiplomat.com/country/australia) [Operational regional leader through AFP and ASD joint operations](https://modeldiplomat.com/country/australia) - [Singapore](https://modeldiplomat.com/country/singapore) [INTERPOL Global Complex hub and ASEAN cybercrime coordination](https://modeldiplomat.com/country/singapore) - [Japan](https://modeldiplomat.com/country/japan) [Active Budapest Convention party and G7 cyber enforcement partner](https://modeldiplomat.com/country/japan) - [China](https://modeldiplomat.com/country/china) [Key driver of the UN Cybercrime Convention text and competing norms](https://modeldiplomat.com/country/china) 7 ### Cybersecurity Governance and Board Accountability Cybersecurity governance has moved decisively from an IT control matter to a corporate governance obligation. The 2014 NIST Cybersecurity Framework (now CSF 2.0, released 2024 with a dedicated Govern function) codified governance as a peer to Identify, Protect, Detect, Respond and Recover. ISO/IEC 27001:2022, COBIT 2019, and the ASX, MAS, HKMA and JFSA supervisory guidance have all elevated board-level expectations. Regulatory momentum has accelerated since 2022. The US SEC's cyber disclosure rules (effective December 2023) require material incident reporting within four business days and annual governance disclosures. The EU's NIS2 Directive and DORA impose direct management liability. Australia's SOCI Act amendments, Singapore's CCoP 2.0, India's CERT-In six-hour reporting directive, and Japan's revised METI guidelines all push accountability upward. The Uber CSO conviction in 2022 and personal sanctions against executives in several jurisdictions have made personal liability tangible. The governance debate now centres on three issues: the appropriate reporting line for the CISO (CIO, CEO, CRO, or board), the composition of board cyber expertise, and how to translate technical risk into the language of enterprise risk appetite. Frameworks such as FAIR for quantitative cyber risk and ESG-linked cyber disclosure are reshaping how boards exercise oversight. Key players - [United States](https://modeldiplomat.com/country/united-states) [SEC rules setting global benchmark for cyber disclosure and board oversight](https://modeldiplomat.com/country/united-states) - [Singapore](https://modeldiplomat.com/country/singapore) [MAS and CSA driving prescriptive governance for regulated sectors](https://modeldiplomat.com/country/singapore) - [Australia](https://modeldiplomat.com/country/australia) [SOCI Act and APRA CPS 234 imposing direct director accountability](https://modeldiplomat.com/country/australia) - [Japan](https://modeldiplomat.com/country/japan) [METI cybersecurity management guidelines mandating board engagement](https://modeldiplomat.com/country/japan) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [FCA, PRA and NCSC frameworks influencing Commonwealth practice](https://modeldiplomat.com/country/united-kingdom) - [India](https://modeldiplomat.com/country/india) [SEBI and CERT-In directives expanding listed-company cyber duties](https://modeldiplomat.com/country/india) 8 ### Security Awareness and the Human Layer Phishing and social engineering remain the leading initial access vector in virtually every regional threat report, accounting for the majority of breaches tracked by the Verizon DBIR, ACSC Annual Cyber Threat Report, and ENISA Threat Landscape. The discipline of security awareness, formalised in the early 2000s through ISO 27001 Annex A.7.2.2 and PCI DSS Requirement 12.6, has matured from annual compliance e-learning toward continuous behavioural programmes, simulated phishing, and security culture measurement using instruments such as SANS' Security Awareness Maturity Model. Three shifts have transformed the field. First, generative AI has industrialised convincing phishing, deepfake voice and video, and localised lures in every regional language, eroding the traditional 'spot the typo' heuristics. Second, hybrid work has dissolved the office perimeter, making human judgement the dominant control for SaaS, BYOD and home network risk. Third, regulators in Singapore, Australia, Hong Kong and India increasingly require evidence of effective — not merely delivered — awareness training, with MAS TRM Guidelines and ACSC Essential Eight referencing user education explicitly. The contemporary debate is whether awareness should be reframed as 'human risk management,' integrating identity analytics, just-in-time nudges, and targeted intervention for high-risk roles, and whether responsibility for human error should sit with the individual employee, the security team, or the system designers who failed to make the secure path the easy path. Key players - [Australia](https://modeldiplomat.com/country/australia) [ACSC Essential Eight and Stay Smart Online national awareness baseline](https://modeldiplomat.com/country/australia) - [Singapore](https://modeldiplomat.com/country/singapore) [CSA SG Cyber Safe programme and SkillsFuture cyber pathways](https://modeldiplomat.com/country/singapore) - [United States](https://modeldiplomat.com/country/united-states) [CISA awareness campaigns and NIST NICE workforce framework](https://modeldiplomat.com/country/united-states) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [NCSC Cyber Aware and behavioural research informing global practice](https://modeldiplomat.com/country/united-kingdom) - [Japan](https://modeldiplomat.com/country/japan) [NISC and IPA national cybersecurity awareness month coordination](https://modeldiplomat.com/country/japan) ## Resources News, lessons, and country profiles to prep for Security Leadership 6th CISO 360 + 2nd CSO 360 Asia & Oceania. Recent reporting to ground your prep [Supreme Court Upholds Election Commission Dis](https://modeldiplomat.com/story/supreme-court-keeps-election-commission-control-fight-alive) [Ken Martin's DNC Autopsy Reveals Party Strugg](https://modeldiplomat.com/story/ken-martins-dnc-autopsy-fight-exposes-party-weakness) [Election Commission's Bengal Crackdown](https://modeldiplomat.com/story/election-commissions-bengal-crackdown-a-game-changer) [Kharge Calls Modi 'Terrorist', BJP Complains](https://modeldiplomat.com/story/kharges-terrorist-remark-on-modi-triggers-bjps-eci-complaint) Lessons Bite-sized lessons to build the basics [Hidden Stakeholders](https://modeldiplomat.com/learn/lessons/hidden-stakeholders) [Engagement Strategies](https://modeldiplomat.com/learn/lessons/engagement-strategies) [Dynamic Analysis](https://modeldiplomat.com/learn/lessons/dynamic-analysis) [Stakeholder Mapping Workshop](https://modeldiplomat.com/learn/lessons/stakeholder-workshop) Courses Guided courses that go deeper on the topic [Crisis Management](https://modeldiplomat.com/learn/courses/crisis-management) [Advanced Negotiation](https://modeldiplomat.com/learn/courses/advanced-negotiation) [Multilateral Negotiation](https://modeldiplomat.com/learn/courses/multilateral-negotiation) [Policy Brief Writing](https://modeldiplomat.com/learn/courses/policy-brief) The states in play, with the data that shapes their stance [Singapore](https://modeldiplomat.com/country/singapore) [Country dossier](https://modeldiplomat.com/country/singapore) [United States](https://modeldiplomat.com/country/united-states) [Country dossier](https://modeldiplomat.com/country/united-states) [Australia](https://modeldiplomat.com/country/australia) [Country dossier](https://modeldiplomat.com/country/australia) [Japan](https://modeldiplomat.com/country/japan) [Country dossier](https://modeldiplomat.com/country/japan) [India](https://modeldiplomat.com/country/india) [Country dossier](https://modeldiplomat.com/country/india) [China](https://modeldiplomat.com/country/china) [Country dossier](https://modeldiplomat.com/country/china) [South Korea](https://modeldiplomat.com/country/south-korea) [Country dossier](https://modeldiplomat.com/country/south-korea) [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [Country dossier](https://modeldiplomat.com/country/united-kingdom) [Israel](https://modeldiplomat.com/country/israel) [Country dossier](https://modeldiplomat.com/country/israel) [Russia](https://modeldiplomat.com/country/russia) [Country dossier](https://modeldiplomat.com/country/russia) ## Frequently asked questions - - Free account Save conferences, research any topic with AI, build position papers, and keep your daily prep streak — free. [Create free account](https://modeldiplomat.com/sign-up?next=%2Fconferences%2Fprofessional%2Fsecurity-leadership-6th-ciso-360-2nd-cso-360-asia-oceania-2027) Already a member? [Log in](https://modeldiplomat.com/sign-in?next=%2Fconferences%2Fprofessional%2Fsecurity-leadership-6th-ciso-360-2nd-cso-360-asia-oceania-2027) Free account Save conferences, research any topic with AI, build position papers, and keep your daily prep streak — free. [Create free account](https://modeldiplomat.com/sign-up?next=%2Fconferences%2Fprofessional%2Fsecurity-leadership-6th-ciso-360-2nd-cso-360-asia-oceania-2027) Already a member? [Log in](https://modeldiplomat.com/sign-in?next=%2Fconferences%2Fprofessional%2Fsecurity-leadership-6th-ciso-360-2nd-cso-360-asia-oceania-2027)