CISO risk workshop - Paris
Date & Time: Thursday, November 26 | 14h00 - 17h00
Location: Carré Edouard VII, Paris
Qualys host an exclusive experience for CISOs as part of ROCon Connect Paris. This exclusive session, held directly after the main conference, is our Risk workshop. After delivering it in various countries in the world, this is the very first date in Paris. The risk workshop is a session dedicated for CISOs, a safe place where we encourage exchanges with your peers.
The number of seats is limited, and we review every registration before confirmation.
The Risk Operations Center Quantified: Mythos Measured & Managed
#1: Rethinking Risk Measurement
Most security programs measure activity and call it risk. This session challenges that assumption, laying the conceptual foundation for a Risk Operations Center built on measurement that is precise, quantified, and defensible.
#2: Arrival, Burndown, and Survival
How fast is exposure arriving? How quickly are you closing it? How long does it survive? These three questions, precisely measured, unlock your Average Window of Exposure and transform how you understand the scale and cost of risk in your environment.
#3: The Exposure Economics of Mythos
AI is quietly rewriting the math of cyber risk. This session puts hard numbers on what that means, using Average Window of Exposure to reveal the economic cost of your current burndown rate and making the case for hyper-prioritization and autonomous remediation as the only response that matches the pace of a modern threat.
#4: Presenting to the Board
Getting boards to act on cyber risk is one of the hardest things a security leader does. This session teaches you to translate your ROC's quantified exposure into narratives that frame investment decisions and build lasting executive confidence.
Measuring Frontier Model Impact:
Frontier models have put the threat on an hourly clock, but most security programmes still measure themselves once a year. Weaponisation now often happens before a fix exists, and exploited vulnerabilities have overtaken stolen credentials as the most common way breaches begin. Annual posture assessments, quarterly board packs and yearly penetration tests describe a system that has already changed by the time the results are presented.
This three-hour interactive session asks four questions every security leader will face in front of their board:
- Can you measure exposure?
- Can you defend posture?
- Can you calculate ROI?
- How do you report it all?
The session starts with one hour in the hot seat. You will play a live cyber risk game, making decisions under pressure as a scenario unfolds and seeing the consequences of your choices in real time.
The remaining two hours build on the game with an interactive presentation and open Q&A on cyber risk quantification.
Ivan Milenkovic, VP Cyber Technology Risk at Qualys and a former Group CISO, shows how to replace activity metrics with indicators that support decisions and stay meaningful while the threat moves: the Average Window of Exposure, Risk Mass, and coverage measured against known assets.
He also shows how to put a monetary value on a security control using a quantified risk register. You will leave knowing what to instrument first and how to prove to your board, over time and against targets set in advance, that security spending is making the business safer.
