Conference of Technologies and Solutions for the HR Industry

Until recently, implementing MFA was considered a sufficient measure to secure access to systems. Today, in the era of Phishing-as-a-Service and AI-powered tools, cybercriminals are able to effectively bypass many commonly used authentication methods. Protecting user identities is becoming one of the most critical elements of an organization’s cyber resilience.

During this presentation, I’ll explain why the FIDO2 standard and passkeys are now considered the most phishing-resistant authentication method and how they eliminate the risks associated with passwords, SMS codes, and OTP apps. I will also explain why passkeys not only provide greater security but also enable faster logins, a better user experience, and lower operating costs.However, this won’t be purely theoretical. Participants will see a hands-on demo of the registration and login process using passkeys, and will learn how to implement modern authentication in existing environments without having to modify applications.

This presentation is intended for professionals responsible for cybersecurity, IT architecture, and identity management who want to prepare their organizations for the next generation of threats while simplifying the user login process.

A bonus for attendees: an interactive mini-guide to passkeys from Secfense.

Most organizations prepare for phishing, ransomware, and hacking attacks. Meanwhile, many cyberattacks are preceded by a lengthy reconnaissance phase in which the attacker does not use malware, but rather publicly available information and ordinary conversations. During this presentation, I will demonstrate how seemingly insignificant data-published on social media, in job postings, press releases, or at conferences-can be used to build a detailed picture of an organization. Drawing on many years of experience in auditing and information security, I will discuss how to foster a culture of security that protects an organization even before the first cyberattack occurs.

"Implementing AI in an organization today is not only a business decision but also a legal and regulatory one. A single contract with an AI provider can simultaneously fall under five regulatory frameworks: the AI Act, DORA, NIS2, GDPR, and the Data Act. Incorrect assumptions made during the contracting phase translate into real risks, including unwittingly assuming the role of an AI system provider, a lack of business continuity, a breach of data controller obligations, or dependence on a provider without a realistic exit strategy.

During the presentation, I will present a practical list of questions that an organization should ask its AI provider—as well as itself—before signing a contract. I will discuss examples of “red flags” in providers’ responses, mandatory contract elements required by specific regulations, and the division of responsibilities between the parties.This presentation is intended for CISOs, CIOs, compliance specialists, in-house counsel, and IT risk managers—particularly those in the financial sector and entities subject to the NIS2 regime."

For years, IT and OT environments were designed, managed, and monitored separately. This approach was justified by both technological and organizational factors; however, today more and more incidents begin in IT and ultimately impact the technological process.

During this presentation, I’ll demonstrate an example attack scenario that begins with the compromise of an account or VPN access, passes through an engineering workstation, and reaches the SCADA or PLC environment. Each team sees only a fragment of the event: the SOC monitors IT alerts, the automation team observes process issues, and the administrator sees an active service session. 

Without linking this information, the organization may fail to recognize the attack until the process is shut down.

I’ll also address the common claim: “Our OT network is completely isolated.” In practice, during audits, we find VPN connections for maintenance technicians, LTE modems, private access points, laptops used in both environments, and sometimes even gaming consoles or household appliances connected to the OT network.I will demonstrate why IT and OT monitoring should employ different methods—in IT, these include SIEM, EDR, and active detection mechanisms, while in OT, they primarily involve passive traffic analysis, IDS, and knowledge of industrial protocols. However, different telemetry sources should converge into a single incident view, a single timeline, and a coordinated response within the SOC.KSC will be presented as a catalyst for building true operational resilience, rather than as just another regulatory topic.

The main message of the presentation:“IT and OT may require different monitoring technologies, but they cannot have two different versions of the same incident.

Is spending on cybersecurity just a necessary evil and a drain on the budget?

 This talk invites you to shift your perspective. In an accessible way, we’ll look at IT security not through the lens of fear and threats, but through the lens of stability and growth. We’ll translate technical jargon into clear language that highlights business benefits. 

Together, we’ll discover how a wisely planned strategy becomes a reliable safety net that allows a company to operate with peace of mind, grow, and build a competitive advantage.

Cyberbullying—hate speech, doxing, and impersonation on digital platforms—is a topic that usually falls under the purview of HR or PR, not the security team. 

This is a mistake: the mechanisms it employs are classic attack vectors, except that they target people rather than infrastructure.

I’ll show that within an organization, this isn’t just a matter of culture and reputation, but a real operational and legal risk-with consequences extending to incident reporting obligations and management liability.

Where is the line between a “personnel matter” and a security incident? How can you build a response process that brings together HR, compliance, and the SOC—before everyone finds out about the problem from the media? 

The answers to these questions are the first step toward ensuring that cyberbullying ceases to be a surprise and becomes a risk that the organization actively manages.

The most effective way to teach responsibility is by example. The behavior of parents and caregivers in the digital world shapes the way children use social media, evaluate information, and build relationships. 

This lecture will explore how artificial intelligence and digital media affect brain function—including attention, emotions, decision-making, and susceptibility to manipulation and misinformation.

Practical strategies for fostering empathy, critical thinking, and accountability for one’s words will be presented to help children navigate the online and offline worlds safely and mindfully.

Implementing NIS2 is far more than just an IT project or a task for the security department. Organizational silos—characterized by a lack of cooperation, fragmented accountability, and limited information flow between departments—often prove to be the greatest obstacle. These silos hinder risk identification, incident management, and effective compliance with the Act on the National Cybersecurity System (uKSC). In today’s landscape, breaking down silos is not merely a "soft" topic from team-building workshops; it is fundamental to the survival of your critical infrastructure. During this presentation, we will demonstrate why establishing a "single source of truth" is essential for building cyber-resilience and how to create a collaboration model that supports regulatory compliance while genuinely strengthening the organization's security.

Budowanie odporności cyfrowej przestało być projektem IT - stało się problemem biznesowym, który wymaga wspólnego języka między zarządem, ryzykiem i technologią. Krzysztof Pulkiewicz, CEO BCMLogic i były Chief Security Officer CEE w AXA, pokaże, jak agenci AI stają się praktycznym narzędziem domknięcia tej luki: nie jako chatboty, lecz jako nowe "osoby" w zespole - prowadzące oceny dostawców, monitorujące zmiany w rejestrze ryzyka i raportujące odchylenia bez angażowania analityków. Prezentacja skupi się na trzech obszarach: automatyzacji TPRM w reżimie DORA i NIS2, wsparciu dialogu biznes-IT przez AI generujące zrozumiałe dla zarządu syntezy z danych technicznych, oraz budowaniu ciągłości działania, gdzie system sam identyfikuje zależności krytyczne. Uczestnicy zobaczą, jak - korzystając z dostępnych dziś narzędzi - dział ryzyka, cyber lub compliance może wdrożyć pierwszego agenta AI bez wielomiesięcznego projektu transformacyjnego. Prezentacja jest przeznaczona dla CISO, CRO i dyrektorów compliance, którzy chcą wiedzieć, od czego zacząć - i czego nie delegować maszynie.

The amendment to the Act on the National Cybersecurity System (KSC) has imposed obligations on thousands of "essential" and "important" entities, requiring them to implement an information security management system by April 2027. Far less attention is paid to the "second wave"—the tens of thousands of suppliers to these entities. While not directly subject to the Act themselves, they will begin receiving security questionnaires, contractual clauses, and requests for evidence. Most are companies lacking dedicated security departments, for whom ISO 27001 certification entails a disproportionate investment of time and money. 

This presentation outlines the practical intermediate layer: the open ShieldNet standard, comprising 48 controls across five operational areas. Each control is presented with a business rationale, a list of required evidence, and a direct link to specific provisions within NIS2, GDPR, the Cyber ​​Resilience Act, or the AI ​​Act. The session will also cover the self-declaration model, the use of the standard in supplier assessment, and the role of SMEs and integrators as implementation channels.

Hands-on TeskaLabs AI SIEM Demo & Live Q&A

During his presentation, Iwo will show what a modern recruiter’s workday might look like in 2026—free from chaotic spreadsheets, manual data entry, scattered notes, and endless follow-ups. Using the Recruitify recruitment system as an example, he will demonstrate how automation and artificial intelligence (AI) can streamline the entire recruitment process: from candidate sourcing, screening, and presentation to the client, all the way to finalizing the engagement.

Employee engagement in Poland is among the lowest in Europe, and its decline leads to tangible losses: lower productivity, burnout, demotivation, and rising absenteeism. In this presentation, I will demonstrate—using concrete examples—how business games and team sessions effectively boost engagement, reduce demotivation and absenteeism, and translate into improved business results.

Punkt Ster is a workshop system created by Punkt Wiedza for leaders who want to strengthen their control over decisions, energy, and their response to pressure. We work based on data, physiology, and real-world experience—not slogans.

At the trade fair, Michał will present Cyber ​​BOX—an interactive team game inspired by the escape room format that teaches participants to recognize cyber threats, fosters collaboration, and demonstrates that cybersecurity education can be both effective and engaging.

In an era of AI expansion, automation, and information overload, mental well-being is becoming a key factor in organizational success, directly translating into innovation, adaptability, and the cognitive performance of employees. 

Research shows that spending time in a natural environment lowers stress levels while simultaneously stimulating creativity.

 In her presentation, Sylwia Łuszczyńska will demonstrate how to integrate nature into a daily well-being strategy. It is a simple way to soothe the overloaded nervous systems of teams and build a stable organizational culture—one that is rich in creativity and ready for innovation.

For nearly forty years, we have known that simply providing knowledge does not change people’s behavior at work. Baldwin and Ford described this mechanism in 1988, and decades of subsequent research have only confirmed it. Despite this, organizations continue to seek answers in tools: first in more precisely designed development programs and competency models, then in coaching, mentoring, and leadership academies, followed by e-learning, microlearning, and gamification, and today in LXP platforms, personalized learning paths, learning analytics, and artificial intelligence.Each of these approaches was valid and each genuinely expanded development opportunities, but none solved the fundamental problem. Once back at their daily work, people revert to old habits, and their knowledge erodes. The paradox is that the more ways we have to deliver knowledge, the clearer it becomes that something else is the deciding factor.

During this presentation, we return to the fundamentals of behavioral change and answer the question of what truly causes a person to start acting differently—and to stick with it. We also demonstrate why new technologies alone are not enough if we consistently overlook the implementation conditions that have long determined the success of change within an organization.

The workers’ compensation premium is one of the employment costs that employers can effectively influence through their actions. During the presentation, Inventage experts will discuss how HR processes, collaboration with the occupational safety and health department, and proper reporting of data to ZUS affect the amount of this contribution. They will also share practical examples illustrating how working with external specialists and proactive management in this area can yield measurable savings for a company.