
The gathering of leaders to change the future of cyber risk management.

De-risk Your Business
Join us at ROCon Mumbai, the premier cybersecurity event where top security leaders and practitioners come to get cutting-edge strategies, insights, and discover new solutions that proactively manage and reduce cyber risk.
ROCon, The Risk Operations Conference, delivers thought-provoking keynotes, high-impact sessions, and hands-on workshops on threat detection, cloud security, automation, and risk-driven security strategies. You will discover how to streamline security operations, reduce noise, maximize ROI, and strengthen business resilience, and align security initiatives with your leadership. Don’t miss this opportunity to shape the future of modern cybersecurity and de-risk your organization.
Keynote Speakers
Featured Speakers
Agenda
Training Sessions
Conference Sessions
02:30 - 03:10
03:10 - 03:30

Debashish Jyotiprakash
Managing Director, India and ASEAN, Qualys
03:30 - 04:10

Dr. Sameer Patil
Director, Centre for Security, Strategy and Technology, Observer Research Foundation
04:10 - 04:55

Sumedh Thakar
President and CEO, Qualys
04:55 - 05:30
05:30 - 06:15

Shailesh Athalye
Senior Vice President, Product Management, Qualys
06:15 - 06:40

Bhagyashree Thorat
Principal Product Manager, Enterprise TruRisk Management, Qualys
As cyber threats become increasingly sophisticated and regulatory pressures intensify, security leaders face growing pressure not only to detect vulnerabilities but also to actively manage and communicate risk in real-time.The Risk Operations Center (ROC) is emerging as the strategic nerve center for proactive, data-driven risk reduction. However, operationalizing the ROC at scale means going beyond dashboards and alerts; it requires an intelligent, automated approach that unifies security signals, business context, and response workflows. In this session, we'll explore how Qualys ETM, powered by Agentic Al, enables organizations to shift from reactive security postures to continuous, measurable risk mitigation. Attendees will learn how Agentic Al autonomously correlates threat intelligence, asset criticality, and exploitability data to cut through the noise and spotlight the risks that truly matter.
Whether you're a CISO defining your strategic roadmap or a security leader optimizing existing processes, this session will deliver actionable insights on how to:
- Transform vulnerability data into prioritized, business-aligned risk signals- Automate triage and remediation at scale with context-aware playbooks- Build a unified risk narrative for executives and boards
06:40 - 07:10

Jonathan Trull
CISO & SVP Security Solution Architecture, Qualys
“Both strategy and execution at their core involve making choices under uncertainty, competition, and constraints.” - Roger Martin
Hindsight is always 20/20 after major cyber incidents. But what if you could peer into the future—imperfectly, incompletely, yet meaningfully? To do so, you must stretch your risk management mindset like a seasoned yogi. Embrace uncertainty without confusing it with unknowability. From this foundation, you can discern the realm of plausible loss scenarios and, critically, translate that understanding into measurable, actionable steps. This is the practice of Risk Yoga: flexing strategic insight into practical risk-driven action.
07:10 - 07:30

Himanshu Kathpal
VP, Product Management, Platform and Technologies, Qulays

Ashish Bapana
Senior Manager, LTIMindtree
Firewalls stop packets, not privilege abuse. With attackers bypassing perimeters and diving straight into Active Directory and Entra ID, it's time to make identity posture the new risk surface. In this session, discover a fresh way to strengthen your Risk Operations Center against today’s identity-driven threats. Key Takeaways Why identity is the new attack surface and how it's being exploited Learn how to unify visibility across cloud, hybrid, and on-prem identities See how to map identity risks to real-world threats through deep correlation across assets, misconfigurations, and vulnerabilities. Walk away with actionable steps to enforce least-privilege, reduce access risk, and boost compliance.
07:30 - 08:30
08:30 - 09:00

Jonathan Trull
CISO & SVP Security Solution Architecture, Qualys

Sudarshan Singh
Head - Cyber GRC, Capgemini

Dr. Aditya Khullar
CISO & DPO, Adani Group

Karthikeyan Dhayalan
AVP and Head - Global Cyber Operations, Cognizant

Muneer H KongaWani
AGM & CISO, J&K Bank
Cyber risk isn’t just a tech problem anymore - it’s a financial one. As boards and CFOs push for clarity on how security choices impact the bottom line, CISOs and security teams need a shared language that moves beyond dashboards and alerts. This panel will break down a practical, multi-stakeholder framework for cyber risk quantification one that ties threats, controls, and incidents directly to financial outcomes.
We’ll dive into how to model risk in dollar terms, measure potential loss exposure, and make security investments easier to justify, defend, and optimize. Through real-world examples and collaboration strategies, attendees will learn how to build cross-functional alignment with finance, audit, legal, and operations, and ultimately position cybersecurity not just as protection, but as a smart business decision that shapes enterprise value.
09:00 - 09:25

Lavish Jhamb
Sr. Product Manager, Compliance Solutions, Qualys

Padmanabh Sahasrabudhe
Senior Principal Product Manager, Remediation and Mitigation, Qualys

Amit Kumar
Sr. Director of Engineering, Paytm Money
Security finds the risks. IT gets stuck fixing them. The result? Security teams are buried in findings, IT teams are drowning in tickets, and progress on reducing exposure is too slow.Qualys Eliminate closes that gap. It connects detection to action with automated, prioritized remediation—so Security can assign the right fixes to IT, with the proper context, at the right time.
The payoff:
Clear, streamlined handoffs from Security to IT.
Fixing what matters first instead of chasing endless lists.
Automated workflows that cut exposure windows and keep both teams in sync.
Because spotting risks doesn't make you safer, eliminating them does.
09:25 - 09:45

Kunal Modasiya
Senior Vice President, Product Management, Qualys

Madhuri C
Principal SME, Qualys
Vulnerability management is evolving. It's no longer just about finding and patching flaws, but about understanding and reducing risk across your entire attack surface. With VMDR and Cyber Security Asset Management, you've already laid the groundwork, giving teams visibility, control, and scalable prioritization across complex environments. The Qualys Risk Operations Center (ROC) means moving past whack-a-mole scans and into strategic exposure management, driven by business impact and financial relevance. Leveraging prompt-driven Cyber Risk Agents, Qualys helps security teams navigate, analyze, and act on exposure data with context, speed, and accountability, transforming fragmented data into clear action.
In this session, you'll see how you can elevate your current VMDR and Cybersecurity Asset Management deployment and build an effective ROC to orchestrate unified risk insights and drive real-time, coordinated response at scale. We'll also explore how Al supercharges this journey, helping your teams work faster, smarter, and with greater impact.
09:45 - 10:00

Himanshu Kathpal
VP, Product Management, Platform and Technologies, Qulays
Organizations today are trapped in a perpetual game of "risk whack-a-mole," chasing thousands of raw vulnerability counts without a clear, strategic priority. This session deconstructs the modern threat landscape to reveal a reality starkly different from what traditional metrics suggest. We will expose how the common reliance on conventional approaches is not just irrelevant but dangerously misleading, as it causes security teams to overlook weaponized vulnerabilities that are actively fueling massive ransomware campaigns.
This keynote delves into the modern attacker's playbook. It exposes the industrialized nature of modern attacks, where an efficient ecosystem iterates on known weaknesses in automated campaigns rather than relying on novel innovation. Furthermore, we will reframe ransomware not as an encryption problem but as a data breach crisis characterized by multi-faceted extortion schemes that now include weaponizing regulatory compliance. This session moves beyond theory to expose the attacker's real playbook, sharing a framework that translates real risk telemetry into quantifiable business risk.
10:00 - 10:35

Kunal Modasiya
Senior Vice President, Product Management, Qualys

Anmol Parida
Lead SME, KCS & Web App & API Security, Qualys

Shubham Awasthi
SVP - Information Systems & Security, Axis Bank
Cloud environments drive innovation, agility, and growth; however, every advance brings new security challenges, ranging from misconfigurations and API exposures to the pitfalls of the shared responsibility model. As enterprises rapidly migrate workloads and modern apps to the cloud, the complexity of managing risk and compliance increases, and traditional siloed security strategies can't keep pace. Competitors may claim CNAPP coverage, but without deep application security integration and true code-to-cloud visibility, critical risks remain hidden
This session explores blind spots in multi-cloud and app security, exposes today's fragmented defenses, and shows how Qualys helps DevSecOps, CloudSecOps, and security leaders stop attack paths early—at the code and app layer—before they become costly incidents.
Key Takeaways — What You'll Learn:
How the Qualys Risk Operations Center for Cloud prioritizes vulnerabilities, misconfigurations, exposures, and exploitability to surface truly critical risks across cloud and app layers.
Why Attack Path analysis illuminates hidden lateral movement and privilege escalation routes—and how to disrupt them at the source.
How code-to-cloud tracing and DevSecOps integrations ensure app and cloud security controls align with modern CI/CD pipelines, fixing risks in-code.
How FlexScan and Application Security deliver continuous discovery and protection for multi-cloud, web apps, and APls with unified visibility.
How QFlow automation streamlines remediation and compliance processes to reduce tool sprawl and operational friction.
Stop guessing. Start securing. Gain a precise roadmap to cloud and app-native maturity, built on the pillars of visibility, automation, and intelligence that protect and power your digital future.
10:35 - 11:10
11:10 - 11:25

Shailesh Athalye
Senior Vice President, Product Management, Qualys

Shekhar Rana
Principal Subject Matter Expert, Compliance Solutions, Qualys
11:25 - 11:45

Vallabh Joshi
Senior Technical Product Manager, Qualys
11:45 - 12:00
12:00 - 12:10

Debashish Jyotiprakash
Managing Director, India and ASEAN, Qualys
12:10 - 14:30

Conference Highlights

Explore and secure the digital journey.
Dive into the profound impact of the digital journey and explore how to build in security automation from the data center to the cloud. Industry experts and Qualys leaders discuss automation strategies, preview product roadmaps, listen to your challenges, and answer your questions.

Get inspired
Engage with Qualys’ customer-facing teams and your peers around best practices and user case studies for applying security automation to real-world challenges.

Sharpen your expertise
One day of free training covers forward-looking strategies, best practices to improve effectiveness and productivity, and core and expanded product features to up-level your security program.
Who Should Attend

CIOs, CSOs and CTOs; directors and managers of network, security and cloud; developers and DevSecOps practitioners; Qualys partners and consultants; or any forward-thinking security professionals.
The Westin Mumbai Powai Lake
Mumbai, Maharashtra, India
The Risk Operations Conference will be held at the The Westin Mumbai.
The Westin Mumbai Powai Lake,
2 & 3B, near Chinmayanand Ashram, Kailash Nagar, Mayur Nagar, Morarji Nagar, Powai,
Mumbai, Maharashtra 400087
Conference Pricing
Attendance at ROCon is complimentary. This includes access to all general sessions, breakfast, lunch, breaks, and training.
Travel and hotel accommodations are not included with ROCon or pre-conference training.






