Cloud Security Singapore schedule

Modern API attacks don't rely on a single exploit. They combine automation, business logic abuse and increasingly sophisticated bots to move through cloud-native applications, often without triggering traditional security controls.

Drawing on attack patterns observed across Fastly's global edge network during 2025 and 2026, this session walks through a modern API attack request by request, showing what each layer of the security stack sees, what it misses, and where defenders have the greatest opportunity to stop the attack. Attendees will leave with practical guidance for designing layered API defenses built for today's cloud-native threat landscape.

• Explore strategies for enforcing organisational security and compliance policies with third-party AI and cloud providers
• Understand the challenges of monitoring, auditing, and controlling external services in regulated environments
• Best practices for risk assessment, contractual controls, and vendor oversight
• Learn how to integrate external service governance into broader cloud security and AI governance frameworks

The Defender’s Advantage: Building AI Threat Readiness explores how organisations can prepare for an evolving threat landscape shaped by artificial intelligence. The session will examine how defenders can gain an advantage by improving visibility across their cloud environment, strengthening security foundations, and using AI to accelerate detection, investigation, and response—helping security teams move from reactive defence to proactive threat readiness.

• How can organisations design effective incident response for multi-cloud environments?
• How can AI and automation be leveraged to detect, respond, and recover faster?
• How can teams prepare for cloud-specific breaches, misconfigurations, or insider threats?
• As organisations adopt MCP and AI agents, how can they balance secure, least-privilege access with optimising AI usage and token costs?
• How can organisations strengthen incident security response by using identity and device context to detect and contain threats faster?
• What lessons can be learned from high-profile cloud incidents?

Moderator
Sanjeev Gathani Group Compliance Officer RV Health

Speakers
Frankie Shuai VP of Information Security Bitdeer
Roshan Sham Head of Solution Architecture and Delivery Jumpcloud 

AI is changing how software is built, reviewed, and shipped. While it helps development teams move faster, it also introduces new risks - from AI-generated insecure code to vulnerable open-source components and limited visibility across the software lifecycle.

This session explores why modern AppSec must move closer to code creation, not wait until production or runtime. It will highlight how enterprises can prevent risk earlier, validate every change continuously, and remediate vulnerabilities before they become business exposure.

The discussion will also cover the role of governance in the AI era - and why organisations need a unified AppSec approach that combines automation, visibility, prioritisation, and developer-friendly remediation from code to cloud.

• Explore real-world breaches caused by vulnerabilities in interconnected cloud services

• Understand strategies to assess, monitor, and mitigate third-party and supply chain risks
• Learn how to implement governance, contractual controls, and continuous monitoring for external partners
• Strengthen organisational resilience against multi-party threats while maintaining operational efficiency

“What actually gets exploited in AI, third-party, and supply chain — not what the reports say”

Every vendor report this year will tell you what security teams are worried about. I'm going to tell you what actually got exploited. Those are two different lists.

None of this was novel. No zero-days, no exotic AI attacks — just agents nobody inventoried, access nobody revoked, and grants nobody reviewed. The attackers aren't outpacing you. You're just not doing the boring stuff at scale. Fix the boring stuff.

• How has cloud resilience shifted from a technical concern to a board-level priority?
• How can cloud security initiatives be aligned with executive goals around continuity, risk management, and regulatory accountability?
• How do leaders translate technical security controls into outcomes executives actually care about?
• What does “resilience by design” look like in modern cloud architectures?
• How should security and technology leaders communicate cloud risk and readiness to the C-suite and board?

Moderator
Jannem Yong VP, Cyber Defence & Resilience MediaCorp

Speaker
Donald Ong Senior Assistant Director / Cloud Cybersecurity Programme Office
CSA 

The Scenario: To be announced on the day

In this interactive session, participants will be presented with a real-world cloud security scenario and asked to work in small groups to assess the risk and develop a practical response strategy.

Each group will consider technical, operational, and organisational impacts before agreeing on a mitigation approach. The exercise reflects real-world decision-making under pressure, uncertainty, and competing priorities.

Groups will then share their findings with the wider audience, enabling comparison

of approaches and encouraging discussion around different risk perspectives and response strategies.

Session Format

Part 1: Group Work (30 minutes)

• Participants will break into small groups (4–6 people per group) to:

• Analyse the scenario and identify key risks or vulnerabilities

• Define immediate containment and response actions

• Consider longer-term remediation and resilience measures

• Highlight any governance, compliance, or communication challenges

• Agree on a clear group response to present back

Part 2: Group Sharing (15 minutes)

Each group will briefly present:

• Their interpretation of the core issue

• Their proposed response strategy

• Key trade-offs or challenges they identified