Conference of Technologies and Solutions for the HR Industry

Until recently, implementing MFA was considered a sufficient measure to secure access to systems. Today, in the era of Phishing-as-a-Service and AI-powered tools, cybercriminals are able to effectively bypass many commonly used authentication methods. Protecting user identities is becoming one of the most critical elements of an organization’s cyber resilience.

During this presentation, I’ll explain why the FIDO2 standard and passkeys are now considered the most phishing-resistant authentication method and how they eliminate the risks associated with passwords, SMS codes, and OTP apps. I will also explain why passkeys not only provide greater security but also enable faster logins, a better user experience, and lower operating costs.However, this won’t be purely theoretical. Participants will see a hands-on demo of the registration and login process using passkeys, and will learn how to implement modern authentication in existing environments without having to modify applications.

This presentation is intended for professionals responsible for cybersecurity, IT architecture, and identity management who want to prepare their organizations for the next generation of threats while simplifying the user login process.

A bonus for attendees: an interactive mini-guide to passkeys from Secfense.

Most organizations prepare for phishing, ransomware, and hacking attacks. Meanwhile, many cyberattacks are preceded by a lengthy reconnaissance phase in which the attacker does not use malware, but rather publicly available information and ordinary conversations. During this presentation, I will demonstrate how seemingly insignificant data-published on social media, in job postings, press releases, or at conferences-can be used to build a detailed picture of an organization. Drawing on many years of experience in auditing and information security, I will discuss how to foster a culture of security that protects an organization even before the first cyberattack occurs.

"Implementing AI in an organization today is not only a business decision but also a legal and regulatory one. A single contract with an AI provider can simultaneously fall under five regulatory frameworks: the AI Act, DORA, NIS2, GDPR, and the Data Act. Incorrect assumptions made during the contracting phase translate into real risks, including unwittingly assuming the role of an AI system provider, a lack of business continuity, a breach of data controller obligations, or dependence on a provider without a realistic exit strategy.

During the presentation, I will present a practical list of questions that an organization should ask its AI provider—as well as itself—before signing a contract. I will discuss examples of “red flags” in providers’ responses, mandatory contract elements required by specific regulations, and the division of responsibilities between the parties.This presentation is intended for CISOs, CIOs, compliance specialists, in-house counsel, and IT risk managers—particularly those in the financial sector and entities subject to the NIS2 regime."

For years, IT and OT environments were designed, managed, and monitored separately. This approach was justified by both technological and organizational factors; however, today more and more incidents begin in IT and ultimately impact the technological process.

During this presentation, I’ll demonstrate an example attack scenario that begins with the compromise of an account or VPN access, passes through an engineering workstation, and reaches the SCADA or PLC environment. Each team sees only a fragment of the event: the SOC monitors IT alerts, the automation team observes process issues, and the administrator sees an active service session. 

Without linking this information, the organization may fail to recognize the attack until the process is shut down.

I’ll also address the common claim: “Our OT network is completely isolated.” In practice, during audits, we find VPN connections for maintenance technicians, LTE modems, private access points, laptops used in both environments, and sometimes even gaming consoles or household appliances connected to the OT network.I will demonstrate why IT and OT monitoring should employ different methods—in IT, these include SIEM, EDR, and active detection mechanisms, while in OT, they primarily involve passive traffic analysis, IDS, and knowledge of industrial protocols. However, different telemetry sources should converge into a single incident view, a single timeline, and a coordinated response within the SOC.KSC will be presented as a catalyst for building true operational resilience, rather than as just another regulatory topic.

The main message of the presentation:“IT and OT may require different monitoring technologies, but they cannot have two different versions of the same incident.

Is spending on cybersecurity just a necessary evil and a drain on the budget?

 This talk invites you to shift your perspective. In an accessible way, we’ll look at IT security not through the lens of fear and threats, but through the lens of stability and growth. We’ll translate technical jargon into clear language that highlights business benefits. 

Together, we’ll discover how a wisely planned strategy becomes a reliable safety net that allows a company to operate with peace of mind, grow, and build a competitive advantage.

Cyberbullying—hate speech, doxing, and impersonation on digital platforms—is a topic that usually falls under the purview of HR or PR, not the security team. 

This is a mistake: the mechanisms it employs are classic attack vectors, except that they target people rather than infrastructure.

I’ll show that within an organization, this isn’t just a matter of culture and reputation, but a real operational and legal risk-with consequences extending to incident reporting obligations and management liability.

Where is the line between a “personnel matter” and a security incident? How can you build a response process that brings together HR, compliance, and the SOC—before everyone finds out about the problem from the media? 

The answers to these questions are the first step toward ensuring that cyberbullying ceases to be a surprise and becomes a risk that the organization actively manages.

The most effective way to teach responsibility is by example. The behavior of parents and caregivers in the digital world shapes the way children use social media, evaluate information, and build relationships. 

This lecture will explore how artificial intelligence and digital media affect brain function—including attention, emotions, decision-making, and susceptibility to manipulation and misinformation.

Practical strategies for fostering empathy, critical thinking, and accountability for one’s words will be presented to help children navigate the online and offline worlds safely and mindfully.

Implementing NIS2 is far more than just an IT project or a task for the security department. Organizational silos—characterized by a lack of cooperation, fragmented accountability, and limited information flow between departments—often prove to be the greatest obstacle. These silos hinder risk identification, incident management, and effective compliance with the Act on the National Cybersecurity System (uKSC). In today’s landscape, breaking down silos is not merely a "soft" topic from team-building workshops; it is fundamental to the survival of your critical infrastructure. During this presentation, we will demonstrate why establishing a "single source of truth" is essential for building cyber-resilience and how to create a collaboration model that supports regulatory compliance while genuinely strengthening the organization's security.

Budowanie odporności cyfrowej przestało być projektem IT - stało się problemem biznesowym, który wymaga wspólnego języka między zarządem, ryzykiem i technologią. Krzysztof Pulkiewicz, CEO BCMLogic i były Chief Security Officer CEE w AXA, pokaże, jak agenci AI stają się praktycznym narzędziem domknięcia tej luki: nie jako chatboty, lecz jako nowe "osoby" w zespole - prowadzące oceny dostawców, monitorujące zmiany w rejestrze ryzyka i raportujące odchylenia bez angażowania analityków. Prezentacja skupi się na trzech obszarach: automatyzacji TPRM w reżimie DORA i NIS2, wsparciu dialogu biznes-IT przez AI generujące zrozumiałe dla zarządu syntezy z danych technicznych, oraz budowaniu ciągłości działania, gdzie system sam identyfikuje zależności krytyczne. Uczestnicy zobaczą, jak - korzystając z dostępnych dziś narzędzi - dział ryzyka, cyber lub compliance może wdrożyć pierwszego agenta AI bez wielomiesięcznego projektu transformacyjnego. Prezentacja jest przeznaczona dla CISO, CRO i dyrektorów compliance, którzy chcą wiedzieć, od czego zacząć - i czego nie delegować maszynie.

What if I told you that evaluating results (KPIs) alone isn't enough to reward people fairly, and that calculating bonuses in Excel is costing you your best talent? Rewarding employees solely for hitting "numbers" often fosters a toxic brand of efficiency, while spreadsheet chaos creates a perception of arbitrary decision-making. Join this session to see how HRcode clients consolidated dozens of scattered files into a single system. Learn how to integrate goals, competencies, and potential assessments into one transparent process—and put an end to the endless misunderstandings between employees and managers.

The presentation will be held in English.

AI is redrawing the line between human work and machine work, just like the steam engine did two hundred years ago. Same fears, same hype, one difference: steam had generations, we have quarters. And no company gets to pick which work the machines will take. What a company does control is how quickly its people take on the work that stays. Milan Rataj, co-founder of the HR platform Sloneek, explains why that speed is decided by competencies, why most companies have no real picture of what their people can do, and how getting that picture unlocks bold business moves instead of another round of panic hiring.

It is not external hackers, but rather trusted, competent administrators with excessive privileges who represent the most common vector for actual security incidents. In this presentation, we will demonstrate why a professed "Zero Trust" approach often stops short at the local administrator account, and how to practically restrict and audit privileged access before a security incident forces the issue.

The battle for talent. Turnover. The pressure to be an employer valued by top specialists. HR departments in Poland have been grappling with these issues for a long time.

We identified a paradox here. We say that data is the gold of the 21st century, yet we collect some of a company’s most valuable data every day—only to forget about it once the payroll is approved. We are referring to time and attendance data. 

And yet, this data holds the answers to questions that keep management teams up at night:

Why do our best people leave? 

Why do we spend so much on overtime?

Why are some of our employees chronically overworked?

Does our working time model actually make sense?

The audit isn't the end. Hidden NIS2 requirements and how to meet them effectively and affordably

 Most companies treat NIS2 compliance as a documentation exercise—audits, policies, and procedures—and stop there. However, the amended Cybersecurity Act also mandates continuous event monitoring, incident reporting within 24 hours, and the designation of points of contact for national cybersecurity system entities—obligations that cannot simply be filed away in a binder. In this 30-minute session, I will highlight the requirements most often overlooked during implementation and explain what they actually entail for an organization that lacks an in-house SOC or a dedicated security role. You will leave with a checklist to review before October 3rd and practical strategies for meeting these obligations at the lowest possible cost.

The presentation highlights that the human factor remains a key challenge for organizational security. Every day, employees make decisions under the pressure of time, emotions, and ingrained habits—vulnerabilities that cybercriminals are increasingly adept at exploiting. Phishing remains one of the most effective attack methods because it primarily leverages psychology and human behavioral patterns rather than relying solely on technical flaws. 

 The talk focuses on how to genuinely build employee resilience against phishing and manipulation, moving beyond superficial "cyber awareness" programs. It demonstrates how to foster the right behaviors, design effective attack simulations, cultivate a security culture, and measure the effectiveness of these initiatives.

The amendment to the Act on the National Cybersecurity System (KSC) has imposed obligations on thousands of "essential" and "important" entities, requiring them to implement an information security management system by April 2027. Far less attention is paid to the "second wave"—the tens of thousands of suppliers to these entities. While not directly subject to the Act themselves, they will begin receiving security questionnaires, contractual clauses, and requests for evidence. Most are companies lacking dedicated security departments, for whom ISO 27001 certification entails a disproportionate investment of time and money. 

This presentation outlines the practical intermediate layer: the open ShieldNet standard, comprising 48 controls across five operational areas. Each control is presented with a business rationale, a list of required evidence, and a direct link to specific provisions within NIS2, GDPR, the Cyber ​​Resilience Act, or the AI ​​Act. The session will also cover the self-declaration model, the use of the standard in supplier assessment, and the role of SMEs and integrators as implementation channels.

In an era of mounting threats to critical infrastructure, organizations too often rely on "paper security"—procedures and implementations that look impressive in audit documentation but fail completely when faced with a real ransomware attack or hardware failure. This presentation will discuss why robust, low-level engineering and sound system architecture are the deciding factors in an organization's survival. We will also provide a practical guide for B2B executives and boards on how to distinguish between genuine infrastructure architects and providers of mere "paper compliance." - Agenda (key presentation points):  

● Theory vs. Reality: How over-reliance on theoretical models and outdated dogmas cripples critical infrastructure. 

● A Quick Audit of the Implementer (a guide for non-technical decision-makers): Red flags and simple screening questions that allow the board to identify—in just five minutes—a "paper" auditor or an integrator selling nothing but compliance on slides.

● The Architect’s Ethics and Rigor: Why soft skills take a back seat in cybersecurity, while uncompromising code and architectural quality form the absolute foundation.

● Shattering the Illusion of Security: How new standards are being shaped at the European level—through ETSI technical committees (including Cybersecurity and Quantum groups)—to weed out flawed architectural designs from the market. 

● Designing for Survival: Practical insights from building Business Continuity & Disaster Recovery (BCDR) systems capable of withstanding worst-case scenarios.

Hands-on TeskaLabs AI SIEM Demo & Live Q&A

During his presentation, Iwo will show what a modern recruiter’s workday might look like in 2026—free from chaotic spreadsheets, manual data entry, scattered notes, and endless follow-ups. Using the Recruitify recruitment system as an example, he will demonstrate how automation and artificial intelligence (AI) can streamline the entire recruitment process: from candidate sourcing, screening, and presentation to the client, all the way to finalizing the engagement.

Employee engagement in Poland is among the lowest in Europe, and its decline leads to tangible losses: lower productivity, burnout, demotivation, and rising absenteeism. In this presentation, I will demonstrate—using concrete examples—how business games and team sessions effectively boost engagement, reduce demotivation and absenteeism, and translate into improved business results.

Punkt Ster is a workshop system created by Punkt Wiedza for leaders who want to strengthen their control over decisions, energy, and their response to pressure. We work based on data, physiology, and real-world experience—not slogans.

• Which leadership qualities will be crucial in the coming years – innovation, self-awareness, openness to change, or effectiveness in action?
• Why doesn’t the organizational reality always align with the model of the “ideally agile leader”?
• How can Learning Agility Talent be used to understand a manager’s profile and match it to a specific role and business situation?
• Does every manager need to be highly agile to manage effectively?

• Why is information gathered during recruitment so rarely used in onboarding?
• What data regarding competencies, potential, motivation, and fit should be carried over to the next stage?
• How can recruitment results be used to personalize onboarding and identify skill gaps more quickly? 
• How can data on organizational culture, competencies, and learning agility support an employee's ongoing development? 
• How can data continuity be maintained while ensuring ethical use?
• How can the gathered information be utilized for succession planning and internal mobility?
• How can a feedback loop be established to verify the accuracy of the initial hiring decision?

While as many as 95% of HR professionals use AI, only 15% rate its effectiveness as very high. In this session, you will learn how to move from simple tool adoption to genuine efficiency—safely and in compliance with the law. During the presentation, you will discover: 

The source of the effectiveness gap: 

How recruiters use AI versus how candidates use it. What "human-in-the-loop" means in practice and how to avoid the risks of Shadow AI

The limits of automation: What constitutes legitimate support versus strictly prohibited practices

Real-world results of AI implementation: Examples of companies that have cut CV screening time by up to 50%.

At the trade fair, Michał will present Cyber ​​BOX—an interactive team game inspired by the escape room format that teaches participants to recognize cyber threats, fosters collaboration, and demonstrates that cybersecurity education can be both effective and engaging.

In an era of AI expansion, automation, and information overload, mental well-being is becoming a key factor in organizational success, directly translating into innovation, adaptability, and the cognitive performance of employees. 

Research shows that spending time in a natural environment lowers stress levels while simultaneously stimulating creativity.

 In her presentation, Sylwia Łuszczyńska will demonstrate how to integrate nature into a daily well-being strategy. It is a simple way to soothe the overloaded nervous systems of teams and build a stable organizational culture—one that is rich in creativity and ready for innovation.

How can artificial intelligence be used to develop communication skills in a practical, engaging way based on real-world professional scenarios? 

During this presentation, you will see a live demonstration of a conversation practice session with a realistic AI avatar, showing how detailed feedback is received and how the same scenario can be re-attempted using developmental recommendations. Artur Olszewski and Magdalena Pióro will demonstrate how organizations can create their own simulations based on standards, communication models, and specific business challenges. They will also show how training data supports employee development, managerial work, and organization-wide decisions regarding professional growth. 

This is a practical demonstration of a solution that functions like a flight simulator for business communication, allowing users to safely practice conversations before they take place in reality. The presentation offers an opportunity to explore a modern approach to skills development and the use of AI in training, onboarding, sales, customer service, and team management.

How is the work environment changing in the age of digital technology and artificial intelligence?

Why are traditional well-being programs increasingly failing to deliver the expected results?

The most significant challenges facing modern organizations in the areas of mental health, well-being, and employee engagement.

The neuroscience of stress and mental resilience.

Psychosomatics-how the brain, nervous system, and body form a single integrated system. 

Why mental health affects performance, relationships, and team functioning. Neuroplasticity and microhabits-how lasting change occurs.

Why the future belongs to solutions tailored to individual needs.

How digital technologies support daily behavioral change and the development of healthy habits.

The role of data, feedback, and micro-interventions in supporting mental health.

From universal wellness programs to personalized support for individuals.

HARI profiles as a tool for assessment and personalization.

The HARI digital ecosystem as a tool for supporting daily micro-practices and lasting change.

Examples of implementation in organizations.

Micro-interventions to support stress management, concentration, and recovery.

Exercises that can be implemented in 2–3 minutes.Inspiration for designing modern initiatives to support employees’ mental health and well-being.

Discussion and Q&A session.

AI implementation rarely fails because of the technology. It often fails “because of people.”

Management approves the project, the tool works as intended—and yet the change still doesn’t take hold. And usually, no one knows why.In this panel, we break down AI implementation into three layers—business, people, and technology—and show where it most often breaks down.

We’ll discuss the five mistakes that recur in nearly every transformation and the leadership competencies that truly determine whether an organization can handle the change.

No slides about “the potential of AI.”

 A conversation among practitioners about what really works—and what to do if it doesn’t.

For nearly forty years, we have known that simply providing knowledge does not change people’s behavior at work. Baldwin and Ford described this mechanism in 1988, and decades of subsequent research have only confirmed it. Despite this, organizations continue to seek answers in tools: first in more precisely designed development programs and competency models, then in coaching, mentoring, and leadership academies, followed by e-learning, microlearning, and gamification, and today in LXP platforms, personalized learning paths, learning analytics, and artificial intelligence.Each of these approaches was valid and each genuinely expanded development opportunities, but none solved the fundamental problem. Once back at their daily work, people revert to old habits, and their knowledge erodes. The paradox is that the more ways we have to deliver knowledge, the clearer it becomes that something else is the deciding factor.

During this presentation, we return to the fundamentals of behavioral change and answer the question of what truly causes a person to start acting differently—and to stick with it. We also demonstrate why new technologies alone are not enough if we consistently overlook the implementation conditions that have long determined the success of change within an organization.

The workers’ compensation premium is one of the employment costs that employers can effectively influence through their actions. During the presentation, Inventage experts will discuss how HR processes, collaboration with the occupational safety and health department, and proper reporting of data to ZUS affect the amount of this contribution. They will also share practical examples illustrating how working with external specialists and proactive management in this area can yield measurable savings for a company.

The grand opening of the event will be hosted by Tomasz Szypuła, President of the Management Board of Ptak Warsaw Expo. As part of the ceremony, invited guests of honor representing key communities and institutions related to the event’s theme will also deliver speeches.

Is it possible to spot employee demotivation several weeks before its effects show up in the company’s results? And instead of constantly trying to “motivate people”- could we systematically identify and eliminate the factors that sap their motivation every day?

We’ll showcase the system we’ve built and have been developing for the past 6 years at a factory in Macedonia. This isn’t theory or a short-term experiment. It’s the result of 2,000 days of daily observations and over 300,000 measurements of actual employee behavior.

The result? A culture of proactivity, the lowest turnover rate in years, and approximately 1 million PLN in annual savings—without any additional investment.

How did we achieve this?Instead of creating yet another incentive program, we focused on identifying and eliminating the causes of demotivation. We built a system in which employees identify problems from the ground up and take action to resolve them, while we measure changes in behavioral patterns across the entire organization every 24 hours.

During the presentation, we’ll give you an inside look at this mechanism: what we do to spark bottom-up employee activity, what behavioral mechanisms we use, and what we consciously avoid—because some actions taken with the intention of motivating people can actually undermine their intrinsic motivation.

Pokażemy, jak wykorzystujemy model behawioralny Fogga, motywację wewnętrzną i mechanizm nawyku zbiorowego, aby ułatwić podjęcie pierwszego, nawet bardzo małego działania, a następnie przekształcać pojedyncze zachowania w trwały wzorzec całej grupy.

Pokażemy również, jak technologia ZX-Agent pozwala nam obserwować to, czego nie widać w okresowych badaniach zaangażowania. Co 24 godziny analizujemy aktywność i zmiany zbiorowych wzorców zachowań. Ich osłabienie może być pierwszym sygnałem nadchodzącego kryzysu – widocznym na kilka tygodni przed tym, zanim problem ujawni się w wynikach firmy.

Nie będzie to prelekcja o kolejnych benefitach ani o tym, jak „zwiększać zaangażowanie”. Pokażemy działający od 6 lat system, mechanizmy, na których go zbudowaliśmy, błędy i pułapki, których unikamy, oraz sposób, w jaki każdego dnia wykrywamy i usuwamy źródła demotywacji.

ZX-Agent.pl (Narmox Sp. z o.o.) jest członkiem Klastra Technologicznego CINNOMATECH, który zrzesza ponad 150 firm technologicznych i wspiera je w rozwoju oraz realizacji innowacyjnych przedsięwzięć. To właśnie w takim ekosystemie powstają i rozwijają się rozwiązania łączące technologię z realnymi wyzwaniami biznesu – takie jak system ZX-Agent

AGH – project SOCCER (Centrum Cybersecurity AGH)