Going beyond the standard: Key takeaways from VantaCon UK 2025

Our second annual VantaCon UK event featured thought-provoking conversions with founders, CISOs, and security leaders from Synthesia, Okta, Klarna, Pigment, Multiverse, and more.

‍

During the event, speakers touched on the complexities of building trust in the age of AI, discussed specific regulatory challenges in the EU, and shared practical tips for modern CISOs operating amidst an evolving regulatory landscape and complex risk environment. 

‍

For those who couldn’t attend the live event in London, we’re sharing some key takeaways.

‍

Trust in the age of AI

During a fireside chat with Vanta’s CEO Christina Cacioppo, Synthesia co-founder and COO Steffen Tjerrild discussed his journey building the UK’s most valuable generative AI media company. He shared the importance of balancing innovation with transparency to demonstrate trustworthiness and allay customer concerns around AI. 

‍

Though there was no AI regulation in place at the time he founded Synthesia, Steffen and his team built the company with a framework of “consent, control, and collaboration” in mind—guiding principles that helped Synthesia take cutting-edge AI technology to market in a responsible way

‍

Today, another way Synthesia demonstrates trust is through ISO 42001 compliance. Synthesia became the world’s first ISO 42001-compliant AI video company in September 2024—providing validation that the company has a strong AI governance framework in place and develops AI in line with industry best practices. ISO 42001 has been a competitive differentiator for Synthesia, especially when assuring enterprise customers that they are a vendor that can be trusted. 

‍

Regulatory challenges in the EU

Another panel of experts went deep on regulations in the EU. Quentin Berdugo, CISO at Pigment, Zafrul Sattar, Director of Information Security at Multiverse, Becci Freeman, Chief of Staff at Engine by Starling, and Lazar Lazarov, Head of Security at BVNK took the stage to chat about the biggest security and compliance challenges they face at their respective companies.

‍

While each organization faces unique compliance challenges, all agreed that AI is changing the game significantly in the European market—amidst local regulations like the EU AI Act. Zaffrul discussed the challenge of balancing innovation with security while building AI products and the risks associated with using publicly available LLMs. He reminded the audience that all the public LLMs have backdoors that can be hacked. Zafrul encouraged attendees not to use confidential or client data with these models. However, he advised that there are still appropriate use cases where they can increase your productivity (though you do need to assess for risks in those use cases). 

‍

The panel also discussed the challenges of meeting EU regulatory frameworks while balancing other demands on their security programs. Quentin touched on how market demands dictate team priorities: “The market is telling you what it wants.” Customers demand to see things like ISO 27001, which makes this tablestakes for EU-based companies. As he says, security is a product feature, and it’s critical to listen to what customers want. 

‍

With new emerging frameworks like DORA, it can also be tough to prioritize which frameworks to pursue. Becci cautioned security leaders to strike a balance—seizing opportunities where controls overlap and multiple frameworks can be achieved without duplicating work, while also focusing on scalability and maintaining compliance with the frameworks you already have in place. Quentin echoed that sentiment and reminded leaders not to underestimate the effort needed to maintain a certification: “It sends a good signal when you acquire a new one. It sends a very bad signal when you lose one.”

‍

How modern CISOs adapt to a changing landscape

A panel of CISOs also shared insights from the front line. David Bradbury, CISO at Okta, Niek Nigg, Chief Security Risk Officer at Klarna, and Vanta’s own Jadee Hanson discussed how the role of a modern CISO has evolved into one that’s part technologist, part strategist, and part trust-builder. 

‍

Panelists talked about the challenges of creating a security-minded culture across all departments within an organization and the need to assess the DNA of any organization to figure out the best approach. At Klarna, for example, Niek talked about how the organization is first and foremost an engineering company, made up of 1,800 engineers. The goal is to let engineers do what they do best and not force them into compliance work. For the security team, it’s essential to make compliance an effortless part of the engineering journey—so it doesn’t interfere with engineering work and supports continuous compliance efforts. 

‍

Once more, AI was top of mind. David shared how his team at Okta is trialling LLMs to detect malware in marketplace integrations—externally developed code submitted by third parties—with early results proving promising.  He also talked about the potential benefits of AI in third-party risk management. He discussed the “paper trail of trust” that vendors leave behind—with documents that exist in the public domain and are privately shared. Together, these documents help define the trust level we associate with each vendor. David sees an opportunity for AI to optimize this process: “As I’m relying more and more on humans to interpret these documents, I see a strong linkage between the ability for natural language processing to consume these documents at scale and identify where we’re seeing hot spots, so we can then double-click into those.” 

‍

The panel closed with some advice for fellow CISOs. Jadee advised listeners to stay curious and embrace AI, while Niek shared a poignant reminder to start small. Demonstrate value in small ways, then evolve your program from there—chase progress, not perfection in GRC.

‍

Hear from more industry leaders at our next VantaCon event

VantaCon is coming back to San Francisco later this year (more details coming soon). Join us to connect with industry leaders, discuss the latest trends in security, compliance, and AI, and learn how Vanta helps companies build trust in the age of AI. 

‍

Keep an eye on our website for details about the location and event date.

‍