Nick Woodley
CISSP, CCSP, ACIIS AND ISO Auditor
Oakham, United Kingdom
Actions
Nick Woodley is an ISO 42001 Lead Auditor with over 25 years of enterprise technology experience, uniquely positioned to bridge the gap between AI innovation and governance requirements. As a Microsoft Certified Trainer and Cybersecurity Architect Expert, Nick combines deep Microsoft platform knowledge with practical AI governance implementation experience.
Relevant Credentials:
ISO 42001 Lead Auditor (AI Management Systems)
Microsoft Cybersecurity Architect Expert
Azure Solutions Architect Expert
CISSP & CCSP (ISC2)
Chartered Institute of Information Security (CIISec) Associate Member
Current AI Governance Experience:
As Cyber Security and Power Platform Principal at Ascent, Nick has developed AI compliance offerings incorporating DORA and NIST frameworks for European financial institutions. His recent work includes conducting AI risk assessments for global engineering companies and implementing AI governance frameworks that strike a balance between innovation and regulatory compliance.
Practical Audit Insight:
Nick's experience as an active ISO 42001 Lead Auditor provides unique insights into what actually works during audits, as opposed to theoretical compliance. His background spanning regulated industries (banking, government, insurance) gives him a practical understanding of how AI governance requirements vary across different regulatory environments and organisational contexts.
As an ISC2 East Midlands Chapter Officer, Nick actively contributes to the cybersecurity community's understanding of emerging AI security and governance challenges, making him well-positioned to share practical, implementable strategies with conference attendees.
Area of Expertise
Topics
The Agent Told Me the Tenant Was Clean
Sooner or later, you inherit an estate nobody can explain. The team that built it has left, the documentation is out of date, and you’re the one being asked whether it’s safe.
This session walks through how I approach that situation: what I do in the first ten days, how I turn what I find into decisions, and what I leave behind so the next person doesn’t have to start from scratch.
I’ll use a real example: two Azure tenants, eleven subscriptions, 63 storage accounts and 155 machines, with read-only guest access and nobody to ask for context. I’ll show how I collected the data, analysed it with AzureHound, and discovered that five service principals, identified only by hex strings, had access to every storage account in the estate.
I’ll also cover four times my own tooling gave me a clean, plausible answer that was wrong. When there’s nobody around to check your work, those are the mistakes you can easily miss.
You’ll leave with the scripts, a tool-by-tool guide to what each can tell you and where it can fail, and a blind-spot register that makes what you couldn’t verify an explicit part of the handover.
Takeaways
1. Now. Your survey is only as complete as your access allows. Agree the access you need before you start, and enforce scope in the code as well as in the statement of work.
2. Next. Once you’ve mapped the estate, you still need to decide what to do. Establish who owns each non-human identity before making changes, check every reported count against a second source, and record what you couldn’t verify in a blind-spot register.
3. Future. Handovers break down when the people who leave take their knowledge of ownership with them. Record ownership in metadata and enforce it through policy, manage non-human identities throughout their lifecycle, and set a minimum telemetry retention period. That gives the next person a graph they can work from, instead of a rumour.
Nobody Sees Your Prompts: Building a Local Agent Fabric for Development
I want to open by showing you something, not telling you about it. I put a proxy in front of a coding assistant I use every day and looked at what it actually sends. Repo structure, file paths, the contents of files I didn't have open, and the full system prompt it assembled before it asked the model anything. None of that is a breach, and none of it is undocumented. It is the product working as designed, and I had agreed to all of it. I had just never looked.
Then I turn the Wi-Fi off, and it stays off for the rest of the session.
What interests me is not that you can run a model locally. Most of us tried a 7B and came away unimpressed. What has changed is that a 120B mixture-of-experts model now runs on a device that fits in a jacket pocket and draws 65 watts, and you can put that device behind the same endpoint as a 128GB AMD Ryzen AI Max+ 395 laptop and treat the pair as one piece of infrastructure.
So, this is not a hardware session. It is about what you build once you have it.
Foundry Local handles the awkward part: the machines have completely different accelerators, and I would rather not write device plumbing for each one. A LiteLLM gateway sits in front of them, so everything upstream sees a single OpenAI-compatible endpoint and has no idea which box answered. Then I run a coding agent against a private repo and let the work spread across the fabric. Classification, redaction and embeddings land on the small device, because latency is what it is good at. Planning and code generation go to the 120B. A local Langfuse instance shows the trace filling in as it happens, so you can see which machine served which span, and the network monitor sits at zero throughout.
Memory is the part I think we under-examine. A prompt leaks once, but an agent's memory is the distilled version of everything you have ever worked on, and most of it lives in a vector store nobody can read. I run a local memory layer so the agent keeps context across sessions and repositories, and the memory itself is inspectable — plain files you can open, with provenance attached, rather than a black box you have to trust.
I finish with the parts that do not work. Long-context prefill is slow on this hardware, and I am not editing the pause out. Quantisation costs you something real, and I will show you an eval rather than assert it. The reasoning gap against frontier models is genuine. Local is also not the same as compliant, which is a distinction I spend much of my working life on. I end with a routing pattern that decides what stays local based on sensitivity and point to Foundry Local on Azure Local as the supported path for running this across a cluster rather than a bench.
What you will see running live
A coding agent working across a full private repo, with the work distributed across local machines and nothing leaving the room.
The trace on screen showing which machine handled which part of the job.
An agent memory layer you can actually read, built up across sessions.
A batch agent that has been running since before the session started, and the maths on what the same throughput would have cost through a frontier API.
What I hope you take away
A way to check what your own toolchain sends, which takes about twenty minutes to set up. Why the wall you hit with local models was bandwidth rather than capacity, and what that means for model choice.
A concrete architecture for routing work across heterogeneous local hardware, rather than treating local as an all-or-nothing swap.
An honest sense of where this approach stops being the right answer.
All the hardware is on a bench afterwards. Come and pick it up, see how warm the small one gets, and ask what it cost.
Bang Bang Audit Done, The skills you need to pass an audit.
How to Pass Audits — Learn from an Expert
Audits don't have to be painful — but they often are, because nobody tells you the things that actually matter until you've sat through a few.
In this 20-minute lightning talk, I'll share what I've learned from 25 years on both sides of the audit table: building security and compliance programmes that get audited, and auditing partners on behalf of Microsoft, AWS, Google Cloud and SAP. You'll hear how to read what an auditor is really asking, which evidence carries weight (and which is just noise), the small habits that turn a chaotic scramble into a calm review, and the mistakes that quietly cost organisations time, money, and certifications.
Whether you're heading into ISO 27001, SOC 2, DORA, NIS2, or your first internal audit, you'll leave with practical tactics you can put to work on Monday morning or any day of the week.
From Chaos to Control: Mastering Microsoft Enterprise Identity in Hybrid Environments
Organizations struggle with identity sprawl, security gaps, and compliance challenges when managing users across hybrid environments. Poor identity governance leads to security breaches, failed audits, and frustrated users. These critical pain points demand proven strategies for creating a unified, secure, and compliant identity infrastructure.
This session provides a comprehensive roadmap for implementing robust Microsoft-based enterprise identity solutions that seamlessly bridge on-premises and cloud environments. We'll explore Azure AD (Entra ID) hybrid scenarios, automated user provisioning strategies, and governance frameworks that ensure compliance while maintaining user productivity.
Through real-world scenarios and practical demonstrations, attendees will learn to design hybrid identity architectures using Azure AD Connect and Azure AD Connect Cloud Sync, implement automated provisioning workflows with SCIM and custom connectors, and establish governance policies using access reviews, privileged identity management, and lifecycle workflows. The session includes troubleshooting common hybrid identity challenges, performance optimization techniques, and building effective compliance reporting and monitoring strategies.
This session is ideal for IT professionals, identity architects, security administrators, and anyone responsible for managing enterprise identity infrastructure. Attendees should have basic familiarity with Active Directory and Azure concepts, but specific hybrid identity experience is not required.
Key Takeaways - By the end of this session, attendees will have:
A clear understanding of hybrid identity architecture best practices
Practical knowledge of provisioning automation techniques
Governance strategies that balance security with user experience
Troubleshooting skills for common hybrid scenarios
A roadmap for implementing these solutions in their own environments
AI Governance Reality Check: ISO 42001 Implementation Strategies for AI Solutions
With the EU AI Act entering force and creating mandatory compliance requirements for high-risk AI systems, European organizations urgently need robust AI governance frameworks. Without proper AI management systems, companies risk significant fines (up to 7% of global turnover), compliance failures, and operational incidents. While ISO 42001 provides the international framework that aligns with EU AI Act requirements, most organizations struggle with practical implementation, especially in Microsoft ecosystems where AI capabilities are rapidly expanding.
This session provides a practical roadmap for implementing ISO 42001 AI Management Systems within Microsoft environments, covering Azure AI services, Copilot deployments, and custom AI solutions. Led by an ISO 42001 Lead Auditor, you'll learn how to establish governance frameworks that satisfy regulatory requirements while enabling AI innovation.
Through real-world audit experiences and practical implementation guidance, attendees will discover how to map ISO 42001 requirements to Microsoft AI services, align AI management systems with EU AI Act compliance obligations, and implement effective risk management processes for high-risk AI systems. The session covers establishing data governance for AI pipelines, creating audit trails that satisfy EU regulatory requirements, and building continuous monitoring and improvement processes. You'll gain practical insights from actual ISO 42001 audits and EU AI Act gap analyses, along with actionable templates and frameworks.
This session targets IT leaders, compliance officers, AI project managers, and security professionals responsible for AI governance. Basic familiarity with AI concepts and Microsoft AI services is helpful, but specific ISO 42001 knowledge is not required - we'll build that foundation together.
Key Takeaways - By the end of this session, attendees will have:
Clear understanding of ISO 42001 requirements and EU AI Act alignment for Microsoft AI solutions
Practical implementation templates and checklists for AI governance compliance
Risk assessment frameworks tailored to common Microsoft AI scenarios and EU high-risk classifications
Documentation strategies that satisfy ISO 42001 auditors and EU AI Act requirements
Action plan for implementing compliant AI management systems in their organization
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top