Bernhard Distl, Cyber Security Expert at SIX Group

A Cyber Threat Level specific to your Organization?
Some weeks at work just feel more “threatening” than others? Have you ever wondered about how to proactively approach concerned management requests regarding cyber incident news? Putting together what your CTI team collects & analyzes, allows you to create your very own organizational cyber threat level. This does not only improve communication with stakeholders, but also allows you to establish criteria on when to notify them about a change in the threat level and justify it. We will see which data you can use, where to get it from and how to turn it into a single, easy to understand, high level metric.

Samuel Rossier, Chief Specialist - Cyber Threat Intelligence at Department of Government Enablement Abu Dhabi

From Intelligence to Detection: Why CTI must lead the Charge
Threat intelligence isn’t just about consuming feeds, it should be the driving force behind modern detection engineering and threat hunting. Yet, in 2025, many organizations remain stuck at the lower levels of the *Pyramid of Pain*, struggling to move beyond basic IOC-based detection.

How do we bridge the gap between CTI and detection engineering? What does an intelligence-led detection pipeline truly look like? In this session, we’ll explore the challenges, opportunities, and mindset shifts needed to elevate CTI from an advisory role to the core of modern security operations.

Patrick Lodder, Senior Manager Threat Intelligence Service at NVISO Security

Integrating Threat Intelligence into Your Security Program
In this presentation, we address the critical challenges organizations face when incorporating threat intelligence, including resource constraints, data volume and complexity, integration issues, timeliness, accuracy, scalability, compliance, and converting data into actionable insights.

This session takes a pragmatic approach to managing and transforming information into intelligence that benefits organisations. Sharing our lessons learned on turning information into actionable intelligence that informs strategic, operational, and tactical decision-making. Real-world examples will illustrate how organizations have successfully identified and prioritized vulnerabilities, enhanced threat detection, streamlined incident response, supported threat hunting activities, and enabled proactive defence measures.

By the end of this session, attendees will be able to help their organisations reap the strategic, tactical, and operational benefits of integrating threat intelligence into their security programs, ensuring they are prepared for the challenges of tomorrow.

Martin Ebner, CISO/SIA at MoD AUT

Now we have a TI solution and what now?
The aim is to show the different layers in the TI and make them available to different systems for analysis or to get the data from systems into the TI. Is a bidirectional approach possible and how?

We will discuss some pitfalls such as: too many indicators, the correct interpretation and how to draw conclusions from it. Let’s discuss the different challenges on the way to a perfect TI solution.

Mark Schloesser, VP CAO Automation at CrowdStrike

Threat Intelligence Automation Challenges and Solutions (and some AI)
Every SOC and TI/TH team uses a lot of tools, systems and databases in their daily analysis. This usually means the accumulation of various APIs and UIs at different skill levels and experiences with sometimes conflicting objectives.

In addition, the incoming amount of data or events is usually very large and unsorted. I would like to share and discuss some case studies and experiences. This covers topics such as

We will dive into topics such as "Single Pane of Glass" and why it often fails, the importance of user experience and customization, Sandboxing in 2025, classification versus sorting and the usability of current LLMs and AI agents.

Samuel Rossier, Chief Specialist - Cyber Threat Intelligence at Department of Government Enablement Abu Dhabi

IOC Automation: The Devil in the Details
Everyone wants their IOCs to seamlessly feed security systems, automatically blocking and detecting threats. But few talk about the painful details that make this far from simple. Confidence, feed source, scoring, expiration, security system limitations, data formats, and alert context all play a critical role in making, or breaking, an effective IOC pipeline.

This session takes a deep dive into real-world IOC use cases, the technical challenges they present, and practical strategies to overcome them. The goal? To streamline IOC automation and free up valuable time to focus on the higher levels of the Pyramid of Pain, detection engineering and threat hunting.

Monika Atanasova, Global Head of Cyber Third Party Risk Management at Raiffeisen Group

Third & 4th Party Threat Intelligence Program
Let's discuss and interact on the following topics:

• What is key in a solid Cyber TPRM Program
• What is strategic Third Party Intelligence
• What are top cyber risks you should monitor
• Best practices & how to mitigate 3rd and 4th party risk with real-time, automated intelligence
• AI and their role within security assessments and threat intelligence