October 15, 2026
Agenda
All sessions are held in English.
Morning plenary
- 8:30 AM
Registration, Coffee & Community Zone Opens
Arrive, grab coffee, explore demos, and start connecting with the community.
Community Zone - 9:25 AM
Opening Welcome
Kick off the day with key themes, highlights, and what to expect.
- Jermain NjemanzeFiligran
Signal Room - 9:30 AM
Filigran Lens: Vision Behind the Build
Making security proactive, thread by thread: a look inside the founding bet behind Filigran, why intelligence, validation and response belong in one platform, and where that vision goes next.
- Samuel HassineFiligran
- Julien RichardFiligran
Signal RoomVote on the roadmap - 10:00 AM
Building Consolidated Threat Intelligence as the Foundation for CTEM at Scale
The vision, validated: a security leader shares, in his own words, how connecting intelligence across security operations changed the way his teams work, the wins, the trade-offs and what is still in progress.
- T. Ryan WhelanAccenture
Signal Room - 10:15 AM
A Strategic Approach to Improving Cyber Resilience with Threat Intelligence
The vision, validated: a CISO shares how threat intelligence became the strategic lever of his cyber resilience program, and what the shift really looks like in practice.
- Dexter CaseyCentrica
Signal Room - 10:30 AM
Networking Break
Meet peers, visit demos, and continue conversations across the community space.
Community Zone - 11:00 AM
Security's Next Chapter
A candid, unscripted panel with security leaders on where security operations are heading: how agentic AI and unified exposure management abstract away the complexity of disconnected tools, and what that shift looks like in practice.
- Samuel HassineFiligran
- Ivan FontarenskyThales Group
- Byron GrahamFBI
Signal Room - 11:40 AM
The Big Reveal
A new chapter for the XTM family. Filigran opens up the market problem it has been working on, then puts the answer on stage. Be in the room, then head to the Community Zone to see it up close.
- Jermain NjemanzeFiligran
- Jean-Philippe SallesFiligran
Signal Room - 11:55 AM
The Road Ahead: Top 5 Product Roadmap Highlights
The five roadmap items that matter most, and how to turn them into next steps. Continue the conversation at the demo pods in the Community Zone.
- Jean-Philippe SallesFiligran
Signal Room - 12:15 PM
Networking Lunch
Refuel, connect with attendees, and explore the community and demo spaces.
Community Zone
Leaders track
- 1:30 PM
CTEM in the Real World: What We've Learned So Far
Security leaders from Accenture, Centrica and Quadrum Advisors unpack their organizations' real stance on CTEM: what drives adoption, what is implemented versus still aspirational, where the rollout met friction, and the hard-won lessons that save others months.
- Neena SharmaFiligran
- T. Ryan WhelanAccenture
- Dexter CaseyCentrica
- Chris NovakQuadrum Advisors
Signal Room - 2:15 PM
Operationalizing Threat Knowledge and Resiliency
How to operationalize AI-powered threat intelligence, automation and resilient decision-making, with the CEO of Systema and the Filigran team.
- Ray HuangFiligran
- Rendy DarmawidjajaSystema
Signal Room - 3:00 PM
Afternoon Break
Take a break, reconnect with peers, and explore the Community Zone.
Community Zone - 3:30 PM
From Global Noise to Local Signal: How CI-ISAC Contextualizes Threat Intelligence for Australian Critical Infrastructure
CI-ISAC turns global threat noise into actionable, locally relevant intelligence for Australia’s critical infrastructure. Co-founder Scott Flower shows how OpenCTI filters and enriches global signals and feeds a member-facing portal with contextualized intelligence at scale, with real member stories of the shift from reactive defense to proactive, sovereign-driven resilience.
- Scott FlowerCI-ISAC Australia
Signal Room - 3:50 PM
Networking Break
Take a break, reconnect with peers, and explore the Community Zone.
Community Zone - 4:15 PM
From Victim to Strategist
How do you turn an attack into a lever for lasting improvement? Drawing on the military principle that intelligence drives decisions from the field up to command, Cédric Pradel, Executive Director of ACCYB, shows how to make CTI operational: scoring threats on real exposure, linking adversary traces to intent, and prioritizing strategically, from CERT and CSIRT teams up to the executive committee.
- Cédric PradelACCYB
Signal Room
Industry track
- 1:30 PM
Ahead of the Threat: Operationalizing Threat Intelligence with AI
Government roundtable, invitation only. Government agencies are drowning in threat feeds and reports. This closed-door session explores how AI is being deployed to cut through the noise and operationalize intelligence at government scale.
- Jake TaylorFiligran
- Byron GrahamFBI
Strategy Room - 2:15 PM
Hands-on Lab: Build Your Own Agent
Explore XTM One and build a custom agent from your own requirements, in small groups with the Filigran team. Bring your laptop.
- Romain DelelisFiligran
Strategy Room - 3:00 PM
Afternoon Break
Take a break, reconnect with peers, and explore the Community Zone.
Community Zone - 3:30 PM
CTEM Journey: Progress, Pitfalls, and What’s Next
Financial services roundtable, invitation only. OpenCTI practitioners from the sector share how they turn intelligence into operational impact: IoC dissemination, sharper priority intelligence requirements, exposure validation at scale, data retention, and the capabilities that changed day-to-day operations.
- Einat ArgonFiligran
- Emma MauryFiligran
- Eric BarnesAIB
Strategy Room - 4:15 PM
State-Sponsored Threats on Energy: From Espionage to Sabotage
Energy roundtable, invitation only. Energy infrastructure is a top-tier geopolitical target, from Ukraine to Taiwan-China tensions to cable and pipeline sabotage, and nation-states are pre-positioning inside critical infrastructure ahead of a crisis. Energy sector leaders discuss the deterrence and retaliation calculus, and what it means for defensive posture when the threat may already be inside the perimeter.
- Lucas GuiglioniaFiligran
- Jonathan ThompsonSA Power Networks
Strategy Room
Practitioner track
- 1:30 PM
From Intelligence to Action: Making TI Operational
Cyber threat intelligence is only as valuable as the decisions it drives. Three CTI leaders from global enterprises spanning aerospace and defense, luxury goods and high-end manufacturing unpack how mature intelligence teams move beyond collection and reporting into operational impact.
- Dave GilesFiligran
- Erwan Le BlavecDassault Systèmes
- Victor RocheronHermès
- Amanda CapobiancoRichemont International SA
Intelligence Lab - 2:15 PM
Closing the CTEM Loop: Execute the Intelligence Cycle with Filigran
Most security teams don’t lack threat intelligence; they lack a way to turn it into action before the window closes. A report gets enriched in one tool, turned into test scenarios in another and sent to remediation through a third, losing context at every handoff. This session shows how Filigran runs the whole CTEM cycle as one continuous loop, following a single threat from the first signal to measurable risk reduction.
- Enzo Queiros MartinsFiligran
- Lucas GuiglioniaFiligran
Intelligence Lab - 3:00 PM
Afternoon Break
Take a break, reconnect with peers, and explore the Community Zone.
Community Zone - 3:30 PM
Roadpick: Vote on What Filigran Builds Next
Filigran has always been community-first. Vote for the features that matter most to you and we commit to prioritizing the top-voted feature for each product.
- Adrien ServelFiligran
- Jean-Philippe SallesFiligran
Intelligence Lab - 4:15 PM
You Set the Agenda: The CTI Unconference
No pre-set agenda, no slides, no vendor pitches. Attendees propose the topics, the room votes, and short conversational sessions are led by whoever has a viewpoint. Bring a question you have not been able to answer anywhere else.
- Jermain NjemanzeFiligran
- Jason HarrisFiligran
Intelligence Lab
Closing & networking
- 5:00 PM
Garden Cocktail & Community Aperitif
Wrap up the day in the garden with an open bar, conversation and informal community networking.
Private Garden
Community Zone
OpenCTI · Fluent in STIX
From feed to intelligence. See OpenCTI up close and take the quiz: how mature is your threat intelligence program?
OpenAEV · Exposure therapy
Break your own defenses. Learn. Repeat. See OpenAEV in action and pick up the State of Threat Management report.
XTM One · Get my agent
Meet the agentic core of the XTM Platform, built to execute your CTEM programs autonomously.
XTM Hub · Learn, try, deploy
Your gateway to all Filigran add-ons. On us: a 30-day trial of the XTM Platform, Enterprise Edition.