Day 1 — Threats & Detection
The opening day examines the evolving threat landscape facing oil and gas operators, from advanced persistent threats targeting industrial control systems to high-profile incidents at energy majors.
| Session | Focus areas |
|---|---|
| Opening & industry outlook | Setting the security agenda for upstream, midstream, and downstream operations. |
| Cyber threat briefing | ATP campaigns, virus propagation, and lessons drawn from incidents at Saudi Aramco and RasGas. |
| SCADA & ICS security | Architecture hardening, segmentation, and monitoring of operational technology environments. |
| Risk management | Aligning cyber risk with enterprise risk frameworks and tender requirements. |
| Networking | Structured sessions for delegates, speakers, and sponsors. |
Day 2 — Response & Resilience
The second day turns to response, recovery, and building long-term resilience across the oil and gas value chain.
| Session | Focus areas |
|---|---|
| Incident response | Detecting and containing breaches in industrial environments. |
| Security operations | SOC design, threat intelligence, and continuous monitoring of SCADA assets. |
| Workforce & culture | Security awareness, training, and cross-functional collaboration between IT and OT teams. |
| Tenders & compliance | Meeting procurement, regulatory, and supply-chain security obligations. |
| Closing discussion | Takeaways, sponsor perspectives, and delegate Q&A. |
Planning to attend both days?
Full conference passes cover both Day 1 and Day 2 sessions, exhibition access, and the delegate networking programme. Review the ticket options to register.
The agenda for the opening day is structured around the shifting threat environment that energy operators navigate, with a particular focus on the vulnerabilities introduced by connected industrial systems. Sessions examine how adversaries target upstream production, midstream transport, and downstream refining through coordinated digital campaigns, supply-chain compromises, and the persistent risks associated with legacy operational technology. Speakers discuss how threat intelligence is translated into practical detection priorities, and how organisations are reassessing their perimeter assumptions in light of recent incidents. The day blends strategic outlook briefings with technical deep-dives into architecture, segmentation, and monitoring practices, allowing attendees to move between leadership-level considerations and hands-on implementation guidance within a single programme.
Day two shifts attention from detection to response and recovery, recognising that resilience depends as much on preparation as on prevention. The programme explores how security operations centres are being adapted for converged IT and OT environments, including the cultural and procedural adjustments required when analysts must interpret alerts from both business systems and process control networks. Presentations cover incident response playbooks tailored to energy assets, crisis communications across joint ventures and regulatory bodies, and the coordination needed between cybersecurity teams and physical security counterparts. Case study discussions highlight how organisations have contained intrusions, restored operations, and shared lessons learned across the wider industry, reinforcing a community-wide approach to defending critical infrastructure.
Workshops running alongside the main agenda provide opportunities for smaller, interactive sessions on specialised topics such as threat hunting in operational networks, supply-chain assurance for industrial vendors, and the practical application of threat modelling frameworks. These sessions are designed to encourage discussion among peers facing comparable challenges, allowing participants to compare approaches to common problems. Facilitators guide attendees through exercises that translate abstract security principles into concrete steps suitable for adoption within their own environments. The workshop format also supports networking, giving delegates an extended period to exchange experiences that rarely surface in larger plenary sessions, and to build working relationships that continue beyond the conference itself.
A consistent theme across both days is the convergence of physical and cyber security considerations in the energy sector. Where these domains were once managed in isolation, the programme reflects how digital intrusions can now have direct physical consequences, and how physical security telemetry increasingly feeds into broader situational awareness. Sessions examine access control, insider threat programmes, and the protection of remote sites, alongside the digital measures that underpin them. Speakers address governance frameworks that bring together previously siloed teams, and the reporting structures needed to ensure that executives receive a unified view of risk. This integrated approach is framed as essential for organisations whose operations span continents and regulatory regimes.
The programme concludes by looking forward, examining how emerging technologies and regulatory developments are likely to reshape security priorities in the years ahead. Topics include the implications of greater connectivity in field assets, the evolving expectations of industry regulators and insurers, and the workforce skills required to manage increasingly complex environments. Discussions also consider how international cooperation and information sharing can strengthen collective defence against threats that recognise no organisational boundary. By closing on this forward-looking note, the agenda aims to leave attendees with a clear sense of the strategic direction the industry is taking and the practical steps they can take to contribute to it.