The next evolution of QSC, where the brightest minds in cybersecurity unite to chart the future of cyber risk management.

De-risk Your Business
Join us at ROCon EMEA, the premier cybersecurity event where top security leaders and practitioners come to get cutting-edge strategies, insights, and discover new solutions that proactively manage and reduce cyber risk.
ROCon, The Risk Operations Conference, delivers thought-provoking keynotes, high-impact sessions, and hands-on workshops on threat detection, cloud security, automation, and risk-driven security strategies. You will discover how to streamline security operations, reduce noise, maximize ROI, and strengthen business resilience, and align security initiatives with your leadership. Don’t miss this opportunity to shape the future of modern cybersecurity and de-risk your organization.
Keynote Speakers
About
As President and CEO, Sumedh leads the company’s vision, strategic direction and implementation. He joined Qualys in 2003 in engineering and grew within the company, taking various leadership roles focused on helping Qualys deliver on its platform vision. From 2014 to 2021, he served as Qualys’ Chief Product Officer, where he oversaw all things product, including engineering, development, product management, cloud operations, DevOps, and customer support. A product fanatic and engineer at heart, he is a driving force behind expanding the platform from Vulnerability Management into broader areas of security and compliance, helping customers consolidate their security stack. This includes the rollout of the game-changing VMDR (Vulnerability Management, Detection and Response) that continually detects and prevents risk to their systems, Multi-Vector EDR, which focuses on protecting endpoints as well as Container Security, Compliance and Web Application Security solutions. Sumedh was also instrumental in the build-up of multiple Qualys sites resulting in a global 24×7 follow-the-sun product team.
About
Sarah Armstrong-Smith is a leading authority on cyber resilience and crisis management. As Microsoft’s Chief Security Advisor for Europe, the Middle East and Africa, she advises governments and global enterprises on how to prepare for, respond to, and recover from serious cyber incidents. Her work focuses on embedding resilience into digital transformation and helping organisations navigate the complex intersection of risk, regulation and innovation.With over 25 years of experience, Sarah has held senior positions in both the private and public sectors. At Fujitsu, she led Continuity and Resilience, while at the London Stock Exchange Group she was Head of Business Resilience and Crisis Management. She began her career addressing large-scale events such as the Millennium Bug, laying the foundation for her expertise in managing disruption at scale.Sarah is the bestselling author of Understand the Cyber Attacker Mindset (2024) and Effective Crisis Management (2022), and a Fellow of the British Computer Society. Recognised as one of the Top 30 Female Cybersecurity Leaders by SC Media in 2024, she is a vocal advocate for diversity in tech and a trusted voice in board-level cyber strategy.Known for her clarity and accessibility, Sarah translates technical risk into practical, actionable guidance. On stage, she combines real-world case studies with forward-looking insights into evolving threats such as AI, deepfakes and the future of cybercrime. She equips audiences with the tools to lead confidently through uncertainty and build cultures of resilience.
Featured Speakers
About
Now serving as Kering Head of CERT. Created and continuously improved the group’s global incident response capability over the last 4 years—covering SOC, CSIRT, VOC, and CTI for 15 Houses and 47,000 employees across 75 countries—achieving TF-CSIRT certification and SIM3 maturity level. Over 15 years’ experience from energy sector (CEA, EDF) to luxury retail, spanning full security stack: SOC tooling, management, and luxury-specific threats.French cybersecurity community contributions include authoring *Cybersecurity & PowerShell* (ENI), 8 MISC magazine articles, EPITA engineering school instruction, and podcast appearances. Passionate mountaineer; graduated from the regional alpinism team in 2019.
About
As Senior Vice President of Product Management, Shailesh leads the product management team and drives the Qualys product vision helping customers assess and improve their IT, security and compliance posture. Since joining Qualys in 2012, he has worked in various security and compliance roles driving innovative solutions, including remote endpoint protection, endpoint detection and response, and SaaS security. In addition, Shailesh headed engineering, research and product management for Qualys Policy Compliance and File Integrity Monitoring, where he helped customers go beyond compliance to drive their IT GRC objectives. Before Qualys, he focused on security research for Symantec ESM and Compliance solutions. Shailesh holds a master’s in computer applications (MCA) from the Vishwakarma Institute of Technology and has various security certifications including CISA, CRISC, CISM. He is also a regular speaker at industry conferences.
About
As the Chief Risk Technology Officer at Qualys, Richard helps customers and the broader security community measure, communicate, and eliminate risk. With over 10 years of experience as a CISO, he’s led and supported security strategy, operations, and governance across critical infrastructure and cloud-native organizations. Richard has published two books, “How To Measure Anything In Cybersecurity Risk” and “The Metrics Manifesto: Confronting Security With Data.” Each provides practical and innovative approaches to quantifying and reducing security risk. His first book is the main curriculum at the US Dept of Defense (DoD) CISO program at Carnegie Mellon University and numerous other institutions of higher education.
Agenda
Training Sessions
Conference Sessions
8:45 AM – 9:30 AM
Registration
9:30 AM – 11:00 AM
Mastering the Attack Surface: VMDR to Enterprise TruRisk Management (ETM)

Marcus Burrows
Lead Technical Trainer, Qualys
The shift to a Continuous Threat Exposure Management (CTEM) framework is an operational necessity. This session moves beyond basic scanning to bridge the gap between data collection and decisive action.
During this session, we will showcase:
- Visibility & Automation: Optimising VMDR and CSAM for 100% asset discovery across hybrid environments
- The ETM Logic: Unifying third-party data and Qualys telemetry into a single, actionable risk score
- Contextual Prioritization: Moving past static CVSS scores to prioritize remediation based on exploitability and business impact
- Operational Roadmap: A technical guide to evolving daily SecOps into a 360-degree risk posture
At the end of this session, we will bring in a former Global CISO in an Executive Spotlight to include:
- How to translate technical data into executive clarity
- Frame vulnerabilities as “Residual Risk to Revenue” rather than CVE counts
- The three data points that actually matter to leadership when justifying spend to look at key metrics
Why Attend?
Stop managing noise and start managing risk. Learn how to automate prioritization, reduce manual overhead, and effectively communicate security value to stakeholders
11:00 AM – 11:30 AM
Coffee Break
11:30 AM – 12:30 PM
Qualys Risk Busters
With prizes to be won, do you have what it takes to be a Qualys Risk Buster?
12:30 PM – 1:30 PM
Lunch
1:30 PM – 3:00 PM
Track 1
ROC-Solid Audit Readiness

Fil Lamagna
Technical Trainer, Qualys
Track 2
Prioritised Risk RemOps

Marcus Burrows
Lead Technical Trainer, Qualys
3:00 PM – 3:30 PM
Tea Break
3:30 PM – 5:00 PM
Track 1
Mastering Metrics to unlock the Power of the Platform

Marcus Burrows
Lead Technical Trainer, Qualys
Track 2
Securing Web Apps and APIs: Best Practices for Resilience

Fil Lamagna
Technical Trainer, Qualys
5:00 PM – 6:30 PM
Drinks Reception
8:30 AM
Registration and Coffee
9:10 AM
Welcome to ROCon EMEA
9:15 AM – 10:00 AM
External Keynote

Sarah Armstrong-Smith
Executive Cybersecurity and Crisis Leader
10:00 AM – 10:50 AM
Qualys Keynote

Sumedh Thakar
President and CEO, Qualys
10:50 AM – 11:20 AM
Coffee Break
11:20 AM – 12:00 PM
Product Update

Shailesh Athalye
SVP, Product and Solutions Architecture, Qualys
12:00 AM – 12:30 PM
Plenary Sessions
12:30 AM – 1:00 PM
Kering and Vulnerability Management with Qualys

Etienne Ladent
Head of CERT, Kering
1:00 PM – 2:00 PM
Lunch
2:00 PM – 4:00 PM
Operations Track
Operations Track Sessions
Business Track
Business Track Sessions
4:00 PM – 4:30 PM
Tea Break
4:30 PM – 5:00 PM
Plenary Session
5:00 PM – 5:30 PM
Fireside Conversation

Andy Powell
CISO, Maersk

Richard Seiersen
VP, Cyber Risk, Qualys
5:30 PM – 5:45 PM
Closing Remarks
5:45 PM – 7:30 PM
ROCon Reception
Conference Highlights

Explore and secure the digital journey.
Dive into the profound impact of the digital journey and explore how to build in security automation from the data center to the cloud. Industry experts and Qualys leaders discuss automation strategies, preview product roadmaps, listen to your challenges, and answer your questions.

Get inspired
Engage with Qualys’ customer-facing teams and your peers around best practices and user case studies for applying security automation to real-world challenges.

Sharpen your expertise
One day of free training covers forward-looking strategies, best practices to improve effectiveness and productivity, and core and expanded product features to up-level your security program.
Who Should Attend

CIOs, CSOs and CTOs; directors and managers of network, security and cloud; developers and DevSecOps practitioners; Qualys partners and consultants; or any forward-thinking security professionals.
Hilton Park Lane
London, United Kingdom
Qualys Security Conference will be held at the Hilton Park Lane.
Hilton Park Lane
22 Park Ln, London W1K 1BE, United Kingdom
T: +44 20 7836 2400
Conference Pricing
Attendance at ROCon is complimentary. This includes access to all general sessions, breakfast, lunch and breaks, and training.
Travel and hotel accommodations are not included with ROCon or pre-conference training.

Register Today
Join us to learn how to effectively secure your hybrid IT environment, streamline your security and compliance initiatives and enable digital transformation. There is no cost to attend this event.








