Date: Thursday 24 September 2026
Time: 15:00 (BST)
Overview
Threat-led testing is becoming the benchmark for cyber resilience across financial services. While frameworks such as ISO 27001 and NIST CSF provide a strong foundation, they don't demonstrate how security controls perform against real-world attacks.
In this session, we'll review findings from recent red team engagements and explore how frameworks such as CBEST, STAR-FS, TIBER (DORA), i-CRT, AASE, and iCAST are helping firms validate their ability to detect, respond to, and recover from sophisticated threats. Through real attack paths, from initial access to privilege escalation and lateral movement, we'll highlight where security controls are most often tested and the lessons organisations can apply to strengthen resilience.
Speakers
Bobby Spooner - Managing Principal Security Consultant, LRQA
Bobby Spooner is a Managing Principal Security Consultant at LRQA. As a CREST Certified Red Team Manager (CCRTM), Bobby has expertise overseeing intelligence-led red teaming engagements across the world. Previously, Bobby has built and managed operational security assurance in a large UK Government Department, alongside managing red and purple teaming across UK Critical National Infrastructure (CNI).
Ben Turner - Business Director, Cyber UK&I and EMEA, LRQA
Ben Turner leads LRQA’s global cyber consulting & advisory practice, bringing over 15 years of expertise in threat-led penetration testing, red teaming, and cyber risk management. He has worked across critical sectors and central banks to help organisations build resilience, align security with business priorities, and turn cyber risk into strategic opportunity.