3:30 pm

Registration

4:00 pm

Welcome & short introduction from Markus Günther, Security Consultant at TEMET AG

4:15 pm

Oliver Schmid, Chief Information Security Officer at University of Zurich

The False Best Practice in Cybersecurity Awareness
Why awareness should not simply be an IT task. Drawing on recent research, the talk challenges the common practice of treating awareness as a technical security problem. Secure behaviour is fundamentally human behaviour—and building a sustainable security culture therefore requires knowledge from psychology, behavioural science and organisational culture, not just IT expertise.

4:45 pm

Daniel Kaufmann, Cyber Security Specialist/CISO/DSB at Cyberfy Consulting

Catch of the Day: Phishing Sites and Security Culture
Check the sender. Hover over the link. Enable MFA. Everyone knows the rules. But what happens below the surface?

For more than two years, Daniel Kaufmann has been analyzing phishing attacks against his own company in his Phish Tales series: from a sloppy QR-code email to a tailored adversary-in-the-middle attack with seven redirects and the company’s own branding. What he found on the other end of the line says as much about security culture as about technology. Attackers iterate fast, learn from their mistakes and share their tools, yet their own defenses are sometimes surprisingly fragile.

This talk serves up the catch of the day: real phishing sites, what they reveal about the culture on both sides, and a plot twist that turns the most important awareness rule on its head.

5:15 pm

Short Break

5:30 pm

Monika Geitlinger, Information Security Awareness Officer at SRG SSR

Neuropsychological Insights and how our Brain influence Security Behaviour
Security awareness often fails not because of a lack of knowledge, but because of how our brains function under stress, distraction, and time pressure. Emotions influence our behaviour more strongly than rules or policies. Especially in security-critical moments, the amygdala - the part of our brain primarily involved in processing emotions such as fear and aggression, as well as in emotional learning – takes control, while rational thinking is limited.

This presentation shows how neuropsychological insights can help make security awareness more effective: learning requires emotional relevance, attention is limited, and fear impairs decision-making. Confidence in decision-making – and thus secure behavior – arises from psychological stability, a sense of purpose, and autonomy.

Instead of merely imparting knowledge or even running fear campaigns, we need awareness that fosters curiosity, trust, and confidence. Understanding the brain allows us to influence security behaviour in a sustainable way: humanely, effectively, and in a way that works in everyday life.

6:00 pm

Q & A and Open Discussion

6:30 pm

Apéro Riche & Networking till open end

Mark Barwinski
Founder at CyberOps Advisory

Marco Bertenghi
Senior Penetration Tester at Oneconsult