
Chainguard: Racing the Machines: Board-Ready Security Metrics for CISOs in the AI Era

Discussion Points
1. Retiring the vulnerability myths
Why severity charts, patch counts and incident response speed no longer reassure the board — or the regulators.
2. Pricing the backlog
Translating open critical/high vulnerabilities into people-hour debt and real remediation cost.
3. From firefighting to resilience
Reducing emergency patching and operational disruption in always-on, customer-facing environments.
4. Building it in, not bolting it on
How secure-by-default software inputs shrink attack surface before it reaches production.
5. What "good" looks like
Framing MTTR, accrual rate and backlog trends as evidence for boards, regulators, auditors and customers — across sector-specific regimes, NIS2/DORA and emerging UK resilience legislation.
Racing the Machines: Board-Ready Security Metrics for CISOs in the AI Era
AI-assisted attackers are finding and exploiting vulnerabilities faster than most security teams can triage, assess and remediate them. Across financial services, healthcare, retail, manufacturing, energy, telecoms and technology, boards and regulators are asking a sharper question than severity charts and ticket counts can answer: is material risk actually declining, and can this environment withstand an attacker working at machine speed?
This roundtable brings together senior security leaders from across UK industry to reframe vulnerability management in business and governance terms — translating technical exposure into cost, disruption and risk metrics that boards, regulators and customers want to see. Whether that scrutiny comes from sector regulators, NIS2 and DORA for organisations with EU operations, the UK Cyber Security and Resilience Bill, the EU Cyber Resilience Act for those shipping software and connected products, or customer and supply-chain assurance demands, the vocabulary of risk is changing.
Drawing on Chainguard's research, the conversation will explore how to move from reactive patching to structurally reducing attack surface, and what "good" looks like when reporting upward — including how secure-by-default software inputs shrink exposure before it reaches production, and how MTTR, accrual rate and backlog trends can be framed as evidence across sector-specific regimes.
Agenda
Welcomed attendees are integrated into a curated networking space, fostering direct interactions for ice-breaking and relationship-building before engaging in substantive, collaborative discussions.
Shifting to a sit-down discussion with drinks, this promotes open, thoughtful dialogue on a set topic agenda, aimed at fostering collaboration and deepening connections in a relaxed, supportive setting.
The evening culminates with a luxury meal, offering exquisite cuisine in an elegant setting, enhancing networking opportunities, and providing a memorable experience that strengthens professional bonds among attendees.
The finale features a wrap-up and Q&A session, where sponsors address the roundtable, followed by drinks and networking, enabling direct engagement and planning of actionable next steps in a collaborative environment.
About the Hosts
Chainguard is building the trusted source for open source in the age of AI. From containers and virtual machines to libraries, packages, agent skills and actions, Chainguard delivers hardened, verifiable, production-ready builds of the open source software engineers and AI systems depend on — so organisations can build faster, stay compliant and eliminate risk.
The team behind Chainguard has spent decades securing the open source technologies that power modern infrastructure, contributing to foundational projects including Kubernetes, Sigstore, Distroless and DriftlessAF. Chainguard is hosting this private dinner roundtable to help senior security leaders reframe vulnerability management for boards, regulators and customers.




















