Speakers & Contributors

A lot of apps look secure from the login screen. This session shows what happens once you get past it. Using Rozolo, our deliberately vulnerable banking app, we follow a single £1 payment through the API layer and watch it turn into exposed customer data and unauthorised transactions. The weaknesses on show are the ones a scanner or firewall tends to miss: broken authorisation, weak object-level access control, and data the API hands back without being asked for it. The API layer is now the softest part of most estates, and perimeter controls do little to defend it. We use the walkthrough to show where a modern API security strategy actually earns its place: visibility over what your APIs expose, authorisation enforced per object rather than per endpoint, and testing that hunts for logic and access flaws rather than known signatures.

Continuous compliance, automated guardrails, and container security patterns in large-scale multi-account AWS environments.

Building future infosec talent pipelines across Scottish schools and communities.

Demonstrating hardware and Bluetooth security vulnerabilities in connected consumer devices.

A practical, real-world framework for introducing AI safely into security operations without falling into the 'AI all the things' trap. Learn how to combine IaC, human-in-the-loop automation, agent constraints and AI Error Budgets to improve speed and coverage. Based on first-hand experience from an eight-person security team protecting a FTSE 350 SaaS platform across AWS and GCP.

Strengthening ties between Edinburgh, Glasgow, and Dundee cybersecurity ecosystems.

Practical strategies for streamlining alert triage and building resilient security engineering workflows.

False positives, misconfigured alerts, and real stories from round-the-clock monitoring.

Explores the rising threat of AI-powered cyberattacks on urban infrastructure and presents a practical framework for designing intelligent backup plans that can contain threats before they cause systemic disruption.

State of the nation update on UK Post-Quantum Cryptography (PQC) in 2026, exploring implementation pathways, crypto-agility, transition deadlines, and practical engineering readiness.

Breaking the stigma around burnout, impostor syndrome, and mental health challenges facing security practitioners.

The static control architecture we've built over the past two decades is about to die. SaaS is being pushed into a reformed middleware by the new agentic operating layer, forcing security functions to rethink how controls are designed to enable enterprise 5.0. Data-centric, context-based automation will be unavoidable if security functions want to keep pace with the high velocity business activity of the future.

The talk covers the basics of windfarms and their operations, diving into identified security threats and mitigations based on real-life assessments. Colin explores physical and remote access vectors, security hygiene gaps, and lessons from the recent 2025 Polish renewables attack. Key takeaways bust the myth that 'cutting off supply' is the primary danger, demonstrating practical cyber-physical vectors that can lead to actual physical equipment damage.

Leveraging CTFs, home labs, and open community resources to build practical offensive and defensive skills.

James has over 15 years specialising in Cyber/Information Security working with some of the largest Private and Public Sector organisations. He will provide an update on cybersecurity market trends, talent demand, and recruitment dynamics across Scotland and beyond.

Practical demonstrations of side-channel attacks, hardware hacking, and firmware reverse engineering.

Re-imagining practical lab exercises, virtual CTFs, and keeping student communities connected while campuses were shut.

Translating data privacy regulations into clear, ethical engineering practices and transparent customer consent models.

A frank, humorous, and sobering dive into social engineering, physical penetration testing, and human behavior in infosec.

Rapidly scaling secure telehealth services and safeguarding critical healthcare logistics against opportunist threat actors.

Managing critical clinical infrastructure when systems and procedures meet reality.

Modern penetration testing techniques, red team methodology, and what defenders need to know about post-exploitation activities.

Addressing the psychological toll of isolation, fatigue, and constant crisis response during nationwide lockdowns.

Opening Cyber Scotland Week 2026 with a celebration of grassroots initiatives, student mentorship, and cross-sector cyber resilience.

Strategies for breaking into infosec, continuous upskilling, and finding mentors across the global cyber community.

Behind the scenes of complex offensive penetration testing operations: lessons defenders rarely hear.

Phishing and spoofing have become much easier and much harder to detect at the same time. Authentication improvements are being rolled out by Microsoft, Google, and Yahoo, yet deepfakes and AI are changing the game.

Welcoming the community back in person after three years of pandemic disruption, detailing CSC's roadmap for regular regional meetups.

The vision behind merging two thriving Scottish infosec communities into an inclusive, regular, community-led platform.

Announcing the unification of regional Scottish meetups under Cyber Scotland Connect.

Inaugural remarks setting out the ambition to build Scotland's premier grassroots infosec community.

Inspiring female school students into computing science, cyber competitions, and addressing the early-stage gender gap in tech.

Securing hybrid cloud perimeters and applying zero-trust segmentation across modern enterprise infrastructure.

Navigating ethical responsibilities, privacy rights, and corporate transparency in the heat of a security crisis.

Exploring paths into GRC and security governance, bridging legal, business, and technological requirements.

This year I've tested nearly 50 models and used several of them to build real projects, from production software to PoC exploits. Over the course of the year agents have gone from novelty to everyday tooling, bringing new capabilities and a new attack surface with them. This talk is a practical guide from someone who's been hands-on all year. We'll talk about which models and tools actually deliver, how to get useful work out of agents, and where they fail, from confidently wrong output to security refusals. I'll also take a look at how to evaluate the constant stream of new releases without drowning in hype, so you leave with an approach that will still hold up when next week's model drops.

LLMs are fast becoming a fact of life in many organizations and one of the things we can use them for is.... Kubernetes! So that leads us to a question, if LLMs can do Kubernetes related tasks, can they do them securely and what in general do they know and not know about Kubernetes security? This talk will show the results of our research into how LLMs handle Kubernetes security tasks, how techniques like improved prompting can change the outcomes, and the places where they fall down.

10 years after its release, Kubernetes has become the pre-eminent way of orchestrating and managing containerized applications, with millions of clusters deployed across a wide variety of industries. This talk will look at its security architecture, talk about some of the surprising security choices made by the project, their consequences for security teams, and how we can fix (some) of them.

Strategic incident response insights and operational analysis following the global WannaCry and NotPetya waves.

Navigating regulatory expectations, GDPR compliance realities, and legal duties following serious security incidents.

Lessons from the cyber emergency trenches: ransomware extortion tactics, negotiations, and incident containment.

Demystifying entry-level recruitment in cyber: why attitude, curiosity, and problem-solving beat certification memorization.

Moving beyond passive alert monitoring to proactive threat hunting and intelligent adversary tracking.

When privilege escalation and IAM policies don't go according to plan.

Continuous compliance, automated guardrails, and container security patterns in large-scale multi-account AWS environments.

Actionable guidance on transitioning from adjacent technical or non-technical domains into frontline security analysis.

Why welcoming diverse backgrounds is essential to tackling Scotland's cyber skills shortage.

The overlooked flaws in development pipelines and third-party libraries.

Crisis decision-making, stakeholder communication, and technical recovery when core business infrastructure goes dark.

Practical strategies for embedding security champions and positive engineering engagement within fast-growing software organisations.

Have you ever wondered if it's possible to do a full AI model development and deployment lifecycle with open tools only? This session introduces a powerful CPU-based approach for local model inference, focusing on privacy-critical domains like healthcare, exploring the Llama.cpp inference engine and related GGML tools as alternatives to resource-intensive GPU or massive cloud deployments. The goal is to establish local, private infrastructure where continuous learning (fine-tuning) remains accessible and efficient.

Case studies from incident response trenches: common misconfigurations, lateral movement techniques, and practical remediations.

Modern penetration testing techniques, red team methodology, and what defenders need to know about post-exploitation activities.

How student cyber societies bridge academic training and industry demands through hands-on labs and competitions.

Opening Cyber Scotland Week 2026 with a celebration of grassroots initiatives, student mentorship, and cross-sector cyber resilience.

Reflections on regional growth, ecosystem partnerships with ScotlandIS and CyberScotland, and community roadmap.

Welcoming the community back in person after three years of pandemic disruption, detailing CSC's roadmap for regular regional meetups.

The vision behind merging two thriving Scottish infosec communities into an inclusive, regular, community-led platform.

Announcing the unification of regional Scottish meetups under Cyber Scotland Connect.

Balancing rapid startup velocity with essential security baselines.

Transitioning legacy VPN concentrators to zero-trust access brokers in weeks instead of years.

Inspiring female school students into computing science, cyber competitions, and addressing the early-stage gender gap in tech.

How a developer-targeted campaign used next.config.js and .vscode/tasks.json as execution primitives, and why config files deserve the same scrutiny as application code.

A candid panel exploring human errors, near-misses, and why acknowledging mistakes makes security teams stronger.