Mikko Hyppönen Speaking Fee: $10,000 to $20,000

The connected world promised convenience and new capabilities — and delivered an entirely new class of fragility. From smart lightbulbs to industrial control systems, anything with software is now an entry point for criminals, spies, and state actors. This talk reframes cyber risk: vulnerabilities are not edge cases, they are the fundamental property of a networked age. Drawing on decades of frontline malware research and his book If It’s Smart, It’s Vulnerable, Mikko Hyppönen explains how attackers think, how past outbreaks teach future defenses, and why technical fixes alone are never enough. He demonstrates real-world incidents — from early PC viruses to modern supply-chain attacks — as lenses for defensive strategy, then connects those lessons to board-level decisions about product design, procurement, and incident preparedness. PERFECT FOR TEAMS & LEADERS WHO ARE: • Building or buying connected products and need a practical risk model that informs secure design and vendor selection • Responsible for enterprise resilience and looking to translate technical threat intelligence into board-ready priorities and budgets • Preparing crisis response playbooks and want clear signals that separate routine incidents from strategic cyber campaigns • Operating in regulated industries that must balance innovation, privacy, and safety without creating untenable exposure YOUR AUDIENCE WILL WALK AWAY WITH: • A simple, repeatable mental model for why “smart” equals vulnerable — and what immediate mitigations reduce exploitability in products and services • Concrete examples of real attacks and the governance choices that would have prevented or limited them, for use in risk discussions with executives • Actionable priorities for technical teams (secure defaults, supply-chain scrutiny, telemetry) aligned with procurement and legal workflows • A readiness checklist to evaluate whether an organization is prepared to detect, contain, and recover from high-impact cyber incidents If it’s smart, it may be vulnerable — and knowing which vulnerabilities matter changes how you build, buy, and think about risk.

Conflict has moved from battlefields to networks, where stealth and persistence matter more than blunt force. The distinction between criminal campaigns, corporate espionage, and state-backed operations is increasingly blurry, and defenders who treat threats as isolated incidents are being outmaneuvered. This keynote exposes the new rules of geopolitical competition played out in code. Mikko Hyppönen walks audiences through documented episodes of cyber-enabled conflict and espionage, explaining attribution limitations, the economics of cyber campaigns, and how civilians and private firms become collateral in broader strategic contests. He draws on his law-enforcement collaborations and global incident response work to illuminate patterns that repeat across continents and sectors — and to show where organizations can ethically and effectively respond. PERFECT FOR TEAMS & LEADERS WHO ARE: • Charged with national security, critical infrastructure, or essential services and need to map cyber threats onto operational risk • Corporate security and legal teams preparing policies for data sovereignty, incident disclosure, and engagement with state actors • Boards and executives who must understand the strategic consequences of data theft, sabotage, or influence operations on reputation and continuity • Policy-makers and public-sector leaders designing resilience programs that coordinate public-private incident response YOUR AUDIENCE WILL WALK AWAY WITH: • A clear taxonomy for distinguishing criminal, commercial, and state-aligned cyber activity and recommended response postures for each • Playbook-level guidance for when to engage law enforcement, regulators, and partner companies — and when transparency or silence is the safer choice • Practical risk controls to harden critical systems most likely to be targeted in geopolitical campaigns • A strategic lens to guide investment in deterrence, detection, and cross-sector collaboration that scales beyond incident triage Understanding cyber conflict lets organizations act with clarity instead of panic; that clarity is the first line of strategic defense.

New technologies promise enormous benefits — and new attack vectors. As AI systems accelerate decision-making and drones proliferate physically, the security landscape shifts faster than many governance frameworks can follow. This talk confronts the uncomfortable truth: technological progress without security foresight creates easy wins for malicious actors. Mikko Hyppönen combines his recent work on AI safety and his move into anti-drone research to map the adjacent threats that leaders must prioritize today. He synthesizes lessons from malware history with forward-looking scenarios where AI amplifies deception, automation enables large-scale campaigns, and inexpensive drones become tactical tools for disruption. The emphasis is practical: identify high-leverage mitigations, policy levers, and cross-disciplinary partnerships that reduce systemic risk. PERFECT FOR TEAMS & LEADERS WHO ARE: • Designing or deploying AI systems and need to anticipate misuse, model integrity risks, and operationalize safety controls • Responsible for physical security or critical infrastructure facing the proliferation of commercially available drones and autonomous systems • Policy or risk teams seeking bridgeable strategies that link technical safeguards, procurement standards, and regulatory dialogue • Innovation leaders who want to unlock new capabilities without inheriting catastrophic exposure from ungoverned tech YOUR AUDIENCE WILL WALK AWAY WITH: • A prioritized list of plausible AI-enabled threat scenarios and concrete engineering and governance steps to reduce likelihood and impact • Practical approaches to drone detection and mitigation that balance safety, privacy, and operational necessity • Communication templates for aligning research, product, and risk stakeholders around realistic threat models and acceptable risk thresholds • A framework for short-term safeguards and medium-term policy engagement to ensure emerging tech scales responsibly When new tech changes what’s possible, the organizations that plan for misuse before it happens preserve both innovation and safety.