It Wasn't a Vulnerability. It Was a Gap in Who Was Watching.

A red team was hired to test a regulated financial company. They didn't get in through an unpatched server or a missing control. They got in through alert fatigue and a monitoring gap that belonged to neither the security team nor the production team. "It was like nobody's baby." That's Jason Joseph, CISO at mPokket, describing a real red-team engagement in this BSides Mumbai 2025 panel. The compromise was simulated. The gap was not. It's the clearest illustration of the question four CISOs spend 52 minutes on: your audits pass, would you actually survive an attack? ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT YOU'LL LEARN • Why alert fatigue becomes exploitable when alerts sit between "production issue" and "security incident" and nobody owns the boundary • Why narrowly scoped red-team engagements produce unrealistic results, and what an open mandate reveals instead • How an API can be encrypted, authenticated and fully compliant while still carrying personal data nobody questioned • Why one CISO argues third- and fourth-party risk assessments give far less assurance than organisations assume and how the others push back • A practical way to grade vendor assessments by criticality when budget is finite • How to use the regulator's own audit checklist to win board attention • Why "make security the path of least resistance" beats prohibition for developers and for password sharing alike • How video KYC actually defends against deepfakes and forged documents ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ KEY TOPICS Cyber resilience | Compliance vs resilience | Red team and blue team | Alert fatigue | Third-party and fourth-party risk | SBOM | Right-to-audit clauses | DevSecOps culture | CISO board engagement | Multicloud detection | Video KYC | Tabletop exercises ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PANEL Jason Joseph - CISO, mPokket https://www.linkedin.com/in/jasonjoseph5/ Prakash Ranjan - CISO & DPO, Sammaan Capital Limited https://www.linkedin.com/in/prakash-kumar-ranjan-cisa-cism-cdpse-cpisi-7b004b30/ Manikant Singh - CISO & VP, DMI Finance Private Limited https://www.linkedin.com/in/manikantrsingh/ Mrinmoy Dey - CISO, Lendingkart https://www.linkedin.com/in/mrinmoydey/ Moderated by Gayatri Nayak - Security Engineer, Amazon https://www.linkedin.com/in/gayatri-nayak/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ABOUT THE SESSION "Beyond Compliance: Building a Cyber Resilient BFSI Enterprise" CxO Panel Discussion | BSides Mumbai 2025 BSides Mumbai is a community-driven cybersecurity conference bringing practitioners, researchers and security leaders together for open technical discussion. 🔗 Website: https://bsidesmumbai.in/ 🔗 LinkedIn: https://www.linkedin.com/company/bsidesmumbai 🔗 Instagram: https://www.instagram.com/bsidesmumbai 🔗 All BSides Mumbai 2025 sessions: https://www.youtube.com/playlist?list=PLHVEFAazJLBU ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ If you work in security, GRC or engineering, subscribe for more sessions from BSides Mumbai. And tell us in the comments - in your organisation, who owns the alerts that aren't clearly a security incident? #cyberresilience #ciso #redteam #bfsi #bsidesmumbai