Close
10:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience Compliance & Data Protection CISOs & Security Leader IT & Infrastructure

Ciberresiliencia en la cadena de suministro industrial

Schedule
10:00h - 10:20h
Apertura: la cadena de suministro industrial ya no es una cadena
José Valiente
José Valiente Centro de Ciberseguridad Industrial (CCI) Director General Speaker
10:20h - 10:40h
¿Qué ocurre cuando falla un tercero tecnológico crítico?
Oscar López
Oscar López Grupo Agrolimen Cybersecurity & IT Governance Manager Speaker
10:40h - 11:00h
El papel del fabricante en la ciberresiliencia industrial
César Delgado
César Delgado Rockwell Automation Cybersecurity Business Development Speaker
11:00h - 11:20h
Cómo gestionar dependencias en proyectos industriales complejos
María Dolores Trapero
María Dolores Trapero Elecnor Sistemas Responsable de Centro de Ciberseguridad y redes IT/OT Speaker
11:20h - 12:00h
Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial?
Oscar López
Oscar López Grupo Agrolimen Cybersecurity & IT Governance Manager Speaker
César Delgado
César Delgado Rockwell Automation Cybersecurity Business Development Speaker
Pablo  Carmona
Pablo Carmona Preventa de Redes y Ciberseguridad OT/IT Speaker
Joan Figueras
Joan Figueras Coordinador de CCI en Cataluña Speaker
Maite Arcos
Maite Arcos Fundación ESYS Directora Moderator

2026-11-03 10:00 2026-11-03 12:00 Europe/Madrid Ciberresiliencia en la cadena de suministro industrial La resiliencia industrial ya no depende únicamente de proteger los activos propios, sino de comprender y gobernar las dependencias tecnológicas que sostienen la operación. Este side event aborda la cadena de suministro desde cuatro perspectivas complementarias: operador industrial, fabricante, ingeniería y gobierno del riesgo. Analizaremos qué ocurre cuando falla un tercero tecnológico crítico, cómo diseñar productos y arquitecturas capaces de resistir, y cómo gestionar dependencias en proyectos industriales complejos. La sesión culminará con un panel sobre quién controla realmente el riesgo de la cadena de suministro, poniendo el foco en responsabilidad compartida, visibilidad, alternativas, capacidad de respuesta y continuidad operativa. Networking Hub
Tue 3
10:00h - 12:00h Networking Hub Public Access
10:00h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

Cybersecurity. Business. Disruption. New angles for a new era

Xavier Vila
Xavier Vila ISACA Barcelona Board Member Speaker
Schedule
10:00h - 10:15h
Welcome and introductions
Ramsés Gallego
Ramsés Gallego ISACA Barcelona Chapter President Host
10:15h - 11:00h
At the DNA of every company: Identity and Access Management
Ramsés Gallego
Ramsés Gallego ISACA Barcelona Chapter President Speaker
11:00h - 11:45h
It’s not Machine Learning. It’s Human Teaching!
Ramsés Gallego
Ramsés Gallego ISACA Barcelona Chapter President Speaker
11:45h - 12:15h
Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026
Théo Nottelet
Théo Nottelet ISACA Regional Development Manager Iberian Market Speaker
12:15h - 13:00h
13:00h - 13:45h
Protecting and defending at machine speed. A New Beginning
Ramsés Gallego
Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 10:00 2026-11-03 13:45 Europe/Madrid Cybersecurity. Business. Disruption. New angles for a new era
- At the DNA of every company: Identity and Access Management
- Building and running a SOC… from scratch
- Privacy as the pillar of every society
- The Perfect Storm: Threats & Risks IN the Cloud, FROM the Cloud, THROUGH the Cloud
- It’s not Machine Learning. It’s Human Teaching!
Level 0 - Room 2.1
Tue 3
10:00h - 13:45h Level 0 - Room 2.1 Public Access
10:00h
Side Event | Side Event AI, identity and trust in the digital environment Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

The CISO no longer makes decisions alone

Juan Ma Perals
Juan Ma Perals Global CISO Council Spain Chapter President / Founder Speaker
Iñaki Aldaz
Iñaki Aldaz Global CISO Council Spain Chapter, Ajuntament de Sant Cugat del Vallès Police Inspector, Leadership & Public Safety Specialist Speaker

2026-11-03 10:00 2026-11-03 11:00 Europe/Madrid The CISO no longer makes decisions alone Official presentation of the Global CISO Council Spain Chapter, its purpose, working model and collaboration initiatives with the CISO community in Spain. The session will conclude with an opportunity for discussion and networking. Level 1 - Room 2.3
Tue 3
10:00h - 11:00h Level 1 - Room 2.3 Public Access
10:00h
Startup session | Startups Sessions

Startup Sessions

2026-11-03 10:00 2026-11-03 17:00 Europe/Madrid Startup Sessions A dedicated space for startups to showcase their solutions through 15-minute presentations, talks, and live demos. An opportunity to promote their innovations, share insights, and connect with the cybersecurity community.

10:40 - 10:55 Polar Risk
11:00 - 11:15 Red Mimicry
11:20 - 11:35 Ciberia Labs
11:40 - 11:55 Inprosec
12:00 - 12:15 AI Esra
12:20 - 12:35 Emery
12:40 - 12:55 Revel8
13:00 - 13:15 Stofu
13:20 - 13:35 Neotica

14:40 - 14:55 MetaData (CEIN)
15:00 - 15:15 Tesicnor (CEIN)
15:20 - 15:35 ViVeSec Box
15:40 - 15:55 Merox
16:00 - 16:15 Wodam
Startup Area
Tue 3
10:00h - 17:00h Startup Area Public Access
10:00h
Conference | Congress Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

Opening Session BCC

Laura Caballero Nadales
Laura Caballero Nadales Cybersecurity Agency of Catalonia Director Speaker
Albert Tort
Albert Tort Generalitat de Catalunya Secretary of Telecommunications and Digital Transformation Speaker
Flavia Santoro
Flavia Santoro BCC Director Speaker

2026-11-03 10:00 2026-11-03 10:35 Europe/Madrid Opening Session BCC
The Opening Session of the Barcelona Cybersecurity Congress 2026 will officially launch the congress, bringing together industry leaders, cybersecurity experts and key stakeholders.
The session will set the tone for a congress dedicated to knowledge sharing, innovation and building a more secure digital future.
Auditorium I
Tue 3
10:00h - 10:35h Auditorium I Full Congress Pass
10:45h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

When AI becomes the adversary: The new race between cyber attackers and defenders

James Burchell
James Burchell Crowdstrike Sales Engineering Manager Speaker

2026-11-03 10:45 2026-11-03 11:10 Europe/Madrid When AI becomes the adversary: The new race between cyber attackers and defenders Agentic AI is reshaping cyberattacks, enabling adversaries to move beyond AI-assisted operations toward autonomous intrusions. CrowdStrike's latest threat research reveals real-world examples of AI agents executing complex attack tasks with minimal human direction or intervention. Drawing on frontline adversary intelligence, this keynote explores the rise of the agent-state and the new challenges it creates for defenders. Learn how organisations can rethink their defences to counter AI-driven attacks, combining human expertise, adversary intelligence, and AI-powered security to stay ahead. Auditorium II
Tue 3
10:45h - 11:10h Auditorium II Full Congress Pass
10:45h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Defending at machine speed: From trusting what we see to trusting what we can prove

Bryan Lopez
Bryan Lopez Mastercard Senior Vice President and Field CISO, Commercial Speaker

2026-11-03 10:45 2026-11-03 11:10 Europe/Madrid Defending at machine speed: From trusting what we see to trusting what we can prove
As cyber threats evolve, CISOs need to understand not only where risk exists, but how it translates into business and financial impact. This talk explores how connecting cyber, fraud and identity intelligence can create a more complete picture of risk, helping organizations identify threats earlier, focus on what matters most and strengthen resilience.

Auditorium I
Tue 3
10:45h - 11:10h Auditorium I Full Congress Pass
11:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Quantum-Safe Threat: Standards and Regulations

Schedule
11:00h - 11:30h
Opening Keynote: The Quantum-Safe Transition
Magda Chelly
Magda Chelly Independent CISO and Cyber Risk Advisor Speaker
11:30h - 12:15h
Round Table: What technologies can help mitigate the quantum threat? How can businesses adopt them?
Victor Canivell
Victor Canivell Qilimanjaro President and Co-Founder Speaker
Vanesa Díaz
Vanesa Díaz Luxquanta QKD expert Speaker
Carlos Abellan
Carlos Abellan Quside PQC expert Speaker
Natalia Gómez
Natalia Gómez CTTI Director of Strategy and Planning for Digital Infrastructure Speaker
Jordi Mur
Jordi Mur Emerging Technologies, Quantum & Cybersecurity Expert Moderator
12:15h - 13:00h
Round Table: Preparing for the Quantum-Safe Transition – The End-User Perspective
Manuel García-Cervigón
Manuel García-Cervigón Nestlé Strategic Product Portofolio Architect, IT Security & Compliance Speaker
Joan Puig
Joan Puig Banc Sabadell CISO Speaker
Pau Serra
Pau Serra CaixaBank Tech Security Architect Speaker
Isart Canyameres
Isart Canyameres Cybersecurity Agency of Catalonia Head of the Innovation Unit Moderator
13:00h - 13:15h
Closing Remarks
Magda Chelly
Magda Chelly Independent CISO and Cyber Risk Advisor Speaker

2026-11-03 11:00 2026-11-03 13:15 Europe/Madrid Quantum-Safe Threat: Standards and Regulations Quantum-Safe Threat: Standards and Regulations

As part of this side event, participants will have the opportunity to visit the Barcelona Supercomputing Center free of charge. Registration here
Level 0 - Room 2.2
Tue 3
11:00h - 13:15h Level 0 - Room 2.2 Public Access
11:20h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Defending against hidden risks of AI tools in the workplace

Seamus Lennon
Seamus Lennon ThreatLocker Vice President of Operations for EMEA Speaker

#CISOs&SecurityLeader, #Compliance&DataProtection, #CybersecurityConsultants, #IT&Infrastructure

2026-11-03 11:20 2026-11-03 11:45 Europe/Madrid Defending against hidden risks of AI tools in the workplace AI tools have the power to transform organizational productivity while exponentially increasing risk. Join this session to uncover how workplace AI tools can expose sensitive data, bypass controls, and introduce new attack surfaces. We’ll also explore what you can do to mitigate these risks effectively without impeding innovation. Auditorium I
Tue 3
11:20h - 11:45h Auditorium I Full Congress Pass
11:20h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Your agents will inherit your blind spots: Context before autonomy in the integrated SOC

Charalambos Ioannides
Charalambos Ioannides ClearSkies™ Sales Engineering Manager Speaker

2026-11-03 11:20 2026-11-03 11:45 Europe/Madrid Your agents will inherit your blind spots: Context before autonomy in the integrated SOC

Every agentic SOC demo works, because every demo environment has perfect context. Yours does not. An alert carries almost none of what is needed to judge it: who the identity is, how critical the asset is, what depends on it, whether a change window is open. Analysts assemble that context by asking people. An agent has nobody to ask, and when context is missing it does not stop, it reasons around the gap and answers confidently anyway.

Auditorium II
Tue 3
11:20h - 11:45h Auditorium II Full Congress Pass
11:55h
Roundtable | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

Defending Europe in 2026: National cybersecurity strategies, collaboration & emerging threats

Maurizio Mensi
Maurizio Mensi Italian National School of Administration Professor of Law and Economics Moderator
Jan Smedts
Jan Smedts Digitaal Vlaanderen (Flanders) CEO Speaker
Dan Cîmpean
Dan Cîmpean National Directorate for Cyber Security (DNSC) (Romania) Director Speaker
Laura Caballero Nadales
Laura Caballero Nadales Cybersecurity Agency of Catalonia Director Speaker
Adam Marczyski
Adam Marczyski NASK National Research Institute (Poland) Deputy Director for Cybersecurity and Innovation Speaker

#CyberResilience, #CyberSovereignty, #EuropeanSecurity, #NationalCybersecurityStrategies, #ThreatLandscape

2026-11-03 11:55 2026-11-03 12:55 Europe/Madrid Defending Europe in 2026: National cybersecurity strategies, collaboration & emerging threats Our next round table brings together cybersecurity representatives from Catalonia, Flanders, Romania and Poland to discuss some of the key challenges shaping cybersecurity in Europe today. The conversation will explore the evolving threat landscape, the impact of regulation and AI, the need to strengthen talent and public-private collaboration, and the importance of cross-border cooperation and digital trust.  Auditorium II
Tue 3
11:55h - 12:55h Auditorium II Full Congress Pass
11:55h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Strengthening Europe’s Cyber Resilience – transition from regulatory framework to implementation

Hans De Vries
Hans De Vries ENISA Chief Cybersecurity and Operations Officer (COO) Speaker

2026-11-03 11:55 2026-11-03 12:20 Europe/Madrid Strengthening Europe’s Cyber Resilience – transition from regulatory framework to implementation Strengthening Europe’s Cyber Resilience – transition from regulatory framework to implementation Auditorium I
Tue 3
11:55h - 12:20h Auditorium I Full Congress Pass
12:00h
Side Event | Side Event CISOs & Security Leader

CISO AI Coffee Talk & Tour

2026-11-03 12:00 2026-11-03 13:00 Europe/Madrid CISO AI Coffee Talk & Tour Exclusive gathering of CISOs for an informal coffee and networking session focused on the impact of Artificial Intelligence on cybersecurity. This private roundtable is designed to encourage the exchange of experiences, challenges, and best practices among security leaders from a variety of industries. The discussion will provide a valuable opportunity to share insights, explore emerging trends, and expand professional connections in a relaxed setting. The session will be moderated by David Hidalgo, CISO at Fira de Barcelona, who will guide the conversation through open discussion and interactive exchanges, fostering meaningful dialogue and networking among participants. Networking Hub
Tue 3
12:00h - 13:00h Networking Hub Invitation required
12:30h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Simplifying AI complexity: How to survive in the post-Mythos era

Román Vargas Sierra
Román Vargas Sierra Cisco Cybersecurity Sales Specialist Speaker

2026-11-03 12:30 2026-11-03 12:55 Europe/Madrid Simplifying AI complexity: How to survive in the post-Mythos era
Artificial intelligence has moved out of the lab and into the very heartbeat of our society. But with unprecedented speed comes unprecedented complexity. In the post-Mythos era, AI is not just a productivity tool; it is an active, autonomous participant in our digital ecosystems.
For many organizations, managing this revolution has turned into an operational labyrinth of fragmented tools, blind spots and emerging security risks. 
How do we embrace the immense power of AI without losing control of our critical systems?
Join this session for an insightful, no-nonsense roadmap on how leaders can strip away the noise, master AI complexity and build digital environments that are resilient, transparent and ready for tomorrow.
Auditorium I
Tue 3
12:30h - 12:55h Auditorium I Full Congress Pass
13:05h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

Lessons learned from security incidents: How to improve threat detection and response

David López Meco
David López Meco Telefónica Tech Global Head of Cybersecurity Product & Presales Engineering Speaker

#DigitalSovereignty, #TechnologyGovernance, #ThirdPartyRisk, #VendorSecurity

2026-11-03 13:05 2026-11-03 13:30 Europe/Madrid Lessons learned from security incidents: How to improve threat detection and response
Security incidents in recent years have made it clear that the ability to prevent attacks is no longer enough. Rapid detection, investigative capabilities, and coordinated response are key factors in minimizing the impact of a security breach.
In this session, we will review some of the key lessons learned from real-world incidents and trends observed in today’s threat landscape. We will analyze the challenges organizations face in identifying malicious behavior, reducing response times, and improving their resilience against increasingly sophisticated attacks.
Based on these findings, we will explore how managed detection and response (MxDR) models help complement the capabilities of security teams by combining technology, threat intelligence, and expert knowledge, providing a more comprehensive view of the environment and a more effective response to incidents.
Auditorium I
Tue 3
13:05h - 13:30h Auditorium I Full Congress Pass
13:05h
Conference | Congress Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

Sunburst — Taking luck out of incident response

Tim Brown
Tim Brown Team8 Partner and CISO in Residence Speaker

2026-11-03 13:05 2026-11-03 13:30 Europe/Madrid Sunburst — Taking luck out of incident response
In 2020, the Russian SVR compromised SolarWinds' Orion build pipeline, and roughly 18,000 organizations downloaded the tainted update. Tim Brown, former CISO of SolarWinds, shares his first-person account of leading the response to SUNBURST, the SEC charges that followed, and five years to vindication.
Brown has often called that response lucky — the right help arrived, the team stayed aligned, transparency was a situational call rather than a plan, and the tabletop exercises they'd run hadn't covered this scenario. It worked, but it worked because of people and circumstance no organization can count on twice.
This keynote moves from that manual, human-driven response to what's possible today: how agentic AI is changing incident detection, triage, and response, and what it takes to replace luck with design — rehearsed, scenario-flexible playbooks and tooling that don't depend on who happens to be in the room when the call comes in.
Auditorium II
Tue 3
13:05h - 13:30h Auditorium II Full Congress Pass
13:30h
Conference | Other

Cybersecurity in the AI Era: Identity, Detection and Response

2026-11-03 13:30 2026-11-03 14:00 Europe/Madrid Cybersecurity in the AI Era: Identity, Detection and Response As cyberattacks become faster, more sophisticated and increasingly AI-enabled, organizations need security operations that can keep pace. Discover how Sophos Fusion combines MDR, ITDR and Advisory Services to help businesses strengthen resilience, improve visibility, and accelerate cyber defense in the AI era. Stand 2C41
Tue 3
13:30h - 14:00h Stand 2C41 Public Access
13:40h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

From 840 days to 1.6: Rebuilding application security for the Frontier-AI era

Daniela da Cruz
Daniela da Cruz Checkmarx Vice President of Artificial Intelligence Speaker

2026-11-03 13:40 2026-11-03 14:10 Europe/Madrid From 840 days to 1.6: Rebuilding application security for the Frontier-AI era
In 2018, the median time to exploit a disclosed vulnerability was 840 days. Today it is 1.6, and frontier AI is pushing that toward minutes. At the same time, AI is writing a growing share of production code, adding new vulnerabilities on top of unresolved backlogs. European regulators have taken notice: from DORA and the EU AI Act to the ECB’s requirement that significant banks submit a cyber-resilience action plan by 31 October 2026, “should have” has become “must have”.
This session looks at what that shift means for security and engineering leaders, in banking and beyond. We will examine why AI-only security (fast, but probabilistic) and traditional AppSec (reliable, but slow and noisy) each fall short, and how a hybrid model, combining deterministic detection with multi-model AI reasoning, can surface vulnerabilities that rules alone miss while cutting false-positive noise. We’ll then follow findings through to action: triage prioritised by attackability rather than severity, automated remediation, and the governance needed to keep humans in control.
Attendees will leave with a practical Capture, Eliminate, Govern framework and a checklist for turning a regulatory action plan into day-to-day engineering practice.
Auditorium II
Tue 3
13:40h - 14:10h Auditorium II Full Congress Pass
14:30h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

Cybercompliance 360: Governing digital risk

Emilio Piñeiro
Emilio Piñeiro Asociación Territorio Compliance President Moderator
Melanie Díaz
Melanie Díaz Molins Defensa Penal Legal Counsel · Corporate, Compliance, Privacy & Digital Manager · DPO/DPD certificada Speaker
Eduard Blasi Casagran
Eduard Blasi Casagran TechAndLaw Abogados Abogado especializado en Privacidad e IA · Fundador Speaker
Patricia Cabello Soto
Patricia Cabello Soto PDI - Policía de Investigaciones de Chile Abogada · Compliance y Ciberseguridad Speaker

2026-11-03 14:30 2026-11-03 15:30 Europe/Madrid Cybercompliance 360: Governing digital risk A discussion bringing together professionals from different disciplines to explore how cybersecurity, compliance, risk, privacy, governance and business can no longer be managed as independent functions. Networking Hub
Tue 3
14:30h - 15:30h Networking Hub Public Access
14:35h
Conference | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

NIS2: a preview from Italy

Edoardo Tarricone
Edoardo Tarricone Complaion CEO and co-founder Speaker

2026-11-03 14:35 2026-11-03 15:00 Europe/Madrid NIS2: a preview from Italy
Italy has had a year of NIS2. Spain is about to start its own.
We saw companies discover they were “essential entities” by reading an email. We saw registrations rushed through at the last minute. We saw suppliers asked to prove NIS2 compliance by their own customers, long before any regulator came knocking. And we saw the gap grow between those who had prepared and those who hadn’t.
Edoardo Tarricone, CEO and co-founder of Complaion, shares what that year taught us: what companies underestimated, which mistakes cost the most, and when they realised they should have started sooner.
Auditorium I
Tue 3
14:35h - 15:00h Auditorium I Full Congress Pass
14:35h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Securing AI agents

Roger Gallego
Roger Gallego Delinea Iberia Sales Manager Speaker

#AccessGovernance, #AIAgents, #AISecurity, #Authorization, #IdentityGovernance, #PrivilegedAccess, #RuntimeAuthorization

2026-11-03 14:35 2026-11-03 15:00 Europe/Madrid Securing AI agents
Chasing every agent identity in our organizations doesn't scale. We must implement runtime authorization, which enforces policy at the point of action.
Agents are running on standing credentials issued to people, not to systems. Vault them and replace standing access with just-in-time access.
Auditorium II
Tue 3
14:35h - 15:00h Auditorium II Full Congress Pass
15:10h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Stop managing remote access. Start governing vendors

Michael Ferdinandsen
Michael Ferdinandsen Secomea CEO & President Speaker

#AccessGovernance, #AISecurity, #CyberPhysicalResilience, #IdentityGovernance, #PrivilegedAccess, #SecureRemoteAccess

2026-11-03 15:10 2026-11-03 15:35 Europe/Madrid Stop managing remote access. Start governing vendors Third-party access has become one of the biggest cybersecurity and compliance challenges in modern manufacturing. As vendor ecosystems grow and regulations such as NIS2 raise accountability, manufacturers need more than secure connectivity. They need visibility, governance, and control. Discover why third-party access management is emerging as a strategic OT capability and how purpose-built Secure Remote Access enables secure collaboration without compromising productivity. Auditorium I
Tue 3
15:10h - 15:35h Auditorium I Full Congress Pass
15:10h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

The confidence gap: Securing what changes faster than you can test

Marcelo Castro Escalada
Marcelo Castro Escalada Outpost24 Senior Product Manager Speaker

#AccessGovernance, #AIAgents, #AISecurity, #Authorization, #IdentityGovernance, #PrivilegedAccess, #RuntimeAuthorization

2026-11-03 15:10 2026-11-03 15:35 Europe/Madrid The confidence gap: Securing what changes faster than you can test
Security leaders face a difficult reality: applications, infrastructure, APIs, and attack surfaces are changing faster than traditional security programs can validate them.  
While annual and periodic testing still provide value, they were never designed for environments shaped by AI-powered development, continuous deployment, and rapidly evolving threats. The result is a growing confidence gap between perceived security and actual exposure.  
So how do organizations determine what to test, when to test it, and where to focus their efforts as the environment continuously changes?  
In this session, we'll explore the shift from static testing programs to continuous, risk-based validation strategies that enable teams to identify exploitable risk, prioritize what matters most, and validate security as their attack surface evolves. We'll examine the role of automation, human expertise, and continuous exposure assessment in helping organizations move from reactive testing to continuous confidence.  
Join us to see how modern security teams are adapting their validation strategies to keep pace with change and make better security decisions in an increasingly dynamic risk landscape.
Auditorium II
Tue 3
15:10h - 15:35h Auditorium II Full Congress Pass
15:30h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

Jornada Anual DCA Ciberseguretat

Laura Caballero Nadales
Laura Caballero Nadales Cybersecurity Agency of Catalonia Director Speaker
Alba Barrientos
Alba Barrientos DCA Gestora de la Comunitat Ciberseguretat Host
José Nicolás Castellano
José Nicolás Castellano Cybersecurity Consultant Speaker
Xavier Pi
Xavier Pi UPC School Co-director Máster Industria 4.0 Speaker
Olga Sánchez
Olga Sánchez Caixabank IT Manager Speaker
Barbara Eisele
Barbara Eisele DCA Gestora Blockchain Speaker

2026-11-03 15:30 2026-11-03 17:30 Europe/Madrid Jornada Anual DCA Ciberseguretat La comunitat de ciberseguretat de la Digital Catalonia Alliance (DCA) celebra la seva jornada anual en el marc del Barcelona Cybersecurity Congress, un punt de trobada per a empreses, professionals i agents de l’ecosistema digital. La sessió donarà visibilitat a solucions tecnològiques innovadores en els àmbits de la ciberseguretat i el blockchain, i abordarà els reptes de la confiança digital des de diferents perspectives. El programa inclourà demostracions i casos pràctics, una sessió sobre com s’executa un ciberatac i una taula rodona amb experts en ciberseguretat, compliance i blockchain. La jornada finalitzarà amb un espai de networking per fomentar connexions i noves oportunitats de col·laboració Level 0 - Room 2.1
Tue 3
15:30h - 17:30h Level 0 - Room 2.1 Invitation required
15:45h
Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Are you okay, Internet? The state of the internet in 2026

Martijn Grooten
Martijn Grooten Censys Principal Security Researcher Speaker

#AttackSurface, #CyberRisk, #InfrastructureSecurity, #InternetExposure, #InternetSecurity

2026-11-03 15:45 2026-11-03 16:10 Europe/Madrid Are you okay, Internet? The state of the internet in 2026 In this presentation, Censys researcher Martijn Grooten walks through interesting findings from the 2026 Censys State of the Internet report and will answer questions such as: what trends do we see when it comes to Internet-connected services? Who are the major players? What are the vulnerabilities that should concern us? How is the rapid adoption of AI affecting the Internet map. Auditorium I
Tue 3
15:45h - 16:10h Auditorium I Full Congress Pass
15:45h
Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Assume breach, prepare for recovery: Why data resilience is mandatory for business survival

Miguel Tena Martin
Miguel Tena Martin Object First Field Sales Engineer Speaker

#BusinessContinuity, #CyberResilience, #DataProtection, #DataResilience, #DisasterRecovery, #Ransomware, #Recovery

2026-11-03 15:45 2026-11-03 16:10 Europe/Madrid Assume breach, prepare for recovery: Why data resilience is mandatory for business survival
Zero Trust teaches us to assume that there’s a breach, but what’s the worst that could happen when there is a breach? And how do you mitigate against that?
Join Miguel Tena, Object First Field Sales Engineer as he discusses why data resilience is critical in the evolving cybersecurity landscape and what that means in practice. Leveraging insights from research on data protection and ransomware trends, Miguel will explore how organisations can prepare for the worst-case scenario: where a cybercriminal has access to all passwords and secrets. Meeting regulatory and cyberinsurance requirements and, ultimately, guaranteeing business survival mean this is no longer ‘just’ an IT topic, it’s a board-level imperative.
Auditorium II
Tue 3
15:45h - 16:10h Auditorium II Full Congress Pass
16:00h
Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection

AI Agents for vulnerability management and compliance-as-code

Schedule
16:00h - 16:30h
From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL
Harald  Messemer
Harald Messemer MessemerTech OÜ ISO 27001 Lead Auditor Speaker
16:30h - 17:00h
Nobody Reads 40,000 Vulnerability Findings
Gerardo Prieto
Gerardo Prieto The Mill Adventure CISO Speaker
17:00h - 17:30h
Deepfakes & Spoofing: When SMS and Voice Cannot Be Trusted
Xavier Álvarez
Xavier Álvarez Merabytes Director de Operaciones Speaker

2026-11-03 16:00 2026-11-03 18:00 Europe/Madrid AI Agents for vulnerability management and compliance-as-code Cybersecurity can no longer rely on manual backlogs, static bureaucracy, or blind trust. In this session block, we will explore the frontlines of digital defense: from transforming compliance into a living, automated process (OSCAL), and unleashing AI agents to manage the endless chaos of vulnerability findings, to fighting back in an era where deepfakes and spoofing mean voice and SMS can no longer be trusted. Three pivotal perspectives on building intelligent, scalable, and true zero-trust security for the real world. Networking Hub
Tue 3
16:00h - 18:00h Networking Hub Public Access
16:20h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

New threat landscape and challenges in the age of Frontier AI

Joan Ruiz
Joan Ruiz Fortinet Systems Engineer Manager Speaker

2026-11-03 16:20 2026-11-03 16:45 Europe/Madrid New threat landscape and challenges in the age of Frontier AI In this talk we will discuss current state of the art and landscape of emerging threats due to the progress of frontier ai models and we'll introduce Fortinet layered security approach to  fight against it Auditorium I
Tue 3
16:20h - 16:45h Auditorium I Full Congress Pass
16:20h
Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Improve security posture: Start with your endpoints

Juan José González
Juan José González NinjaOne Level 2 Solutions Engineer Speaker

2026-11-03 16:20 2026-11-03 16:45 Europe/Madrid Improve security posture: Start with your endpoints
Many organizations continue to invest heavily in advanced cybersecurity solutions in efforts to better defend against attacks that are not only increasing in frequency but also becoming more complex and difficult to detect. However, the importance of good cyber hygiene, starting with the endpoint, is often overlooked.
NinjaOne consolidates workflows, reduces silos, and provides a single source of truth for all your security and endpoint data.
Join NinjaOne's Solutions Engineer Juan José González as he demonstrates the power and simplicity of the NinjaOne platform and how it can enable you to achieve these benefits:
Detect and respond to threats faster with real-time visibility and control over your entire IT environment.
Harden endpoints by removing unnecessary software and minimizing your attack surface through automated device configuration at scale.
Make sure systems are always secure and up to date with automated patch management.
Recover quickly in the event of an attack with secure, cloud-based backup.
Auditorium II
Tue 3
16:20h - 16:45h Auditorium II Full Congress Pass
16:55h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

From smart cities to cyber-resilient cities. How Greater Paris is helping municipalities prepare for cyber

Geoffroy Boulard
Geoffroy Boulard Greater Paris Metropolis Vice-President for Communication and Digital Innovation Speaker

2026-11-03 16:55 2026-11-03 17:20 Europe/Madrid From smart cities to cyber-resilient cities. How Greater Paris is helping municipalities prepare for cyber As cities become increasingly digital, cybersecurity is a growing concern for local governments. This session will explore the main challenges faced by municipalities and present how the Greater Paris Metropolis supports local authorities in strengthening their cyber resilience. Through initiatives such as the CYBIAH programme, a municipal Bug Bounty scheme and REMPART, a cyber crisis simulation exercise developed with ANSSI, the session will showcase practical tools and collaborative approaches to help cities better anticipate, prevent and respond to cyber threats. Auditorium II
Tue 3
16:55h - 17:20h Auditorium II Full Congress Pass
18:15h
Side Event | Side Event

Cybersecurity for Healthcare Services in Spain and Europe – MEDICYSS Launch Event

Ulrich Seldeslachts
Ulrich Seldeslachts LSEC Leaders in Security CEO Speaker
Flavia Santoro
Flavia Santoro BCC Director Speaker
Andraz Logar
Andraz Logar 3fs Nordic CEO Speaker
Andreas Foerster
Andreas Foerster Fenin Catalunya President Speaker
Joan Calvet Estela
Joan Calvet Estela HM Hospitales Cybersecurity Team and Compliance Speaker
Jorge Prado Casal
Jorge Prado Casal Galicia - Spain Regional Ministry of Healthcare Speaker
Josep Bardallo
Josep Bardallo EBMT — European Society for Blood and Marrow Transplantation Global Chief Information Security Officer (Global CISO) Speaker
Vasileios Mingos
Vasileios Mingos Health-ISAC European Operations Director, GCTI, GREM, GCIL Speaker

2026-11-03 18:15 2026-11-03 22:00 Europe/Madrid Cybersecurity for Healthcare Services in Spain and Europe – MEDICYSS Launch Event
MEDICYSS (Cybersecurity for Healthcare Services in Spain and Europe) is a European initiative funded by the Digital Europe Programme that aims to strengthen cybersecurity resilience across healthcare organisations, including hospitals, healthcare providers, research centres, laboratories and suppliers. 
The launch event, held alongside the Barcelona Cybersecurity Congress 2026 and supported and promoted by the congress, will bring together European experts, healthcare leaders and industry representatives to discuss key cybersecurity challenges and present the first MEDICYSS support actions.

Location: 
Hotel Porta Fira
Plaça d'Europa 45, 08908 L'Hospitalet de Llobregat, Barcelona, Spain

Hotel Porta Fira
Tue 3
18:15h - 22:00h Hotel Porta Fira Registration required
10:00h
Startup session | Startups Sessions

Startup Sessions

2026-11-04 10:00 2026-11-04 17:00 Europe/Madrid Startup Sessions
A dedicated space for startups to showcase their solutions through 15-minute presentations, talks, and live demos. An opportunity to promote their innovations, share insights, and connect with the cybersecurity community.

10:40 - 10:55 Polar Risk
11:00 - 11:15 Red Mimicry
11:20 - 11:35 Ciberia Labs
11:40 - 11:55 Inprosec
12:00 - 12:15 AI Esra
12:20 - 12:35 Emery
12:40 - 12:55 Revel8
13:00 - 13:15 Stofu
13:20 - 13:35 Neotica

14:40 - 14:55 MetaData (CEIN)
15:00 - 15:15 Tesicnor (CEIN)
15:20 - 15:35 ViVeSec Box
15:40 - 15:55 Merox
16:00 - 16:15 Wodam
Startup Area
Wed 4
10:00h - 17:00h Startup Area Public Access
10:00h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

CyberHub Spain National Conference: Cybersecurity in the face of the new technological landscape

Schedule
10:00h - 10:05h
Opening
Albert Anglarill Recasens
Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Speaker
10:05h - 10:40h
Panel 1. European and Spanish cybersecurity strategy
Albert Anglarill Recasens
Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Moderator
José Martínez-Usero
José Martínez-Usero DIGITALEUROPE Director for Projects Speaker
Daniel Burgos
Daniel Burgos UNIR Vicerrector. Catedrático de Tecnologías para la Educación y la Comunicación, Vicerrector de Proyecto Speaker
10:40h - 10:50h
Keynote. Building a European Cybersecurity Skills Network: From National Hubs to Long-Term European Cooperation
Urša Mlekuž
Urša Mlekuž Chamber of Commerce & Industry of Slovenia Consultant Speaker
10:50h - 10:55h
Presentation of the report “Analysis of Cybersecurity Needs in Spain 2026”
Rocío Baeza
Rocío Baeza AMETIC Project and Policy Manager Speaker
11:15h - 12:00h
Panel 2. The business challenge: Capabilities, talent, and resilience
Marcos Gómez
Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker
David Garriga
David Garriga Sirt CEO Speaker
Javier Zubieta
Javier Zubieta AMETIC Presidente Comisión de Ciberseguridad Moderator
Jordi Ubach
Jordi Ubach CyberTix Speaker
David Forner
David Forner Agència de Ciberseguretat de Catalunya Jefe de la Unidad de Producto Transversal Speaker
12:00h - 12:45h
Panel 3. AI and quantum computing: The new technological landscape
Iván Gutiérrez
Iván Gutiérrez Tecnalia Responsable de Frontier Cybersecurity Speaker
Ángel López
Ángel López Airbus Cyber Technical Manager Speaker
Mònica Espinosa Garcés
Mònica Espinosa Garcés Women4Cyber / Agència de Ciberseguretat de Catalunya Embajadora en Cataluña (Women4Cyber) / Jefa de Captura y Gestión de Fondos (ACC) Moderator
Domenico Tulli
Domenico Tulli Quside PhD Co-founder & CTO Speaker
Albert Solana
Albert Solana Qilimanjaro Quantum Tech Chief of Staff Speaker
12:45h - 13:00h
Closing
Paco Hortigüela Martos
Paco Hortigüela Martos AMETIC Presidente Speaker
13:00h - 13:30h

2026-11-04 10:00 2026-11-04 13:00 Europe/Madrid CyberHub Spain National Conference: Cybersecurity in the face of the new technological landscape
Cybersecurity is facing a technological landscape undergoing profound transformation. The emergence of artificial intelligence, advances in technologies such as quantum computing, and the evolution of cyber threats are reshaping the capabilities required by businesses, public administrations, and professionals.
The Cyberhubs Spain National Conference will bring together representatives from institutions, industry, academia, and the technology ecosystem to analyse the key challenges and opportunities facing the sector in Spain and Europe.
The event will explore the evolution of cybersecurity strategies, the development of skills and talent, and the impact of AI and other emerging technologies on the future of cybersecurity. It will provide a space to share experiences, identify needs, and strengthen collaboration among the different stakeholders across the ecosystem.
Level 0 - Room 2.1
Wed 4
10:00h - 13:00h Level 0 - Room 2.1 Public Access
10:00h
Side Event | Side Event CISOs & Security Leader

AI in your CISO security program: From risk to readiness

DrBA MSc Jeroen Van Der Vlies
DrBA MSc Jeroen Van Der Vlies checksec.nl Trainer, Writer, A.I. CISO/CISPO and Auditor Speaker

2026-11-04 10:00 2026-11-04 11:30 Europe/Madrid AI in your CISO security program: From risk to readiness
Turn AI uncertainty into security leadership
AI is changing the rules of cyberattack and defence. For CISOs, the challenge is clear: manage emerging risks while putting AI to work in the security program.
Move beyond the hype. Join this workshop to explore how to connect AI adoption with business strategy, establish effective governance, and turn promising use cases into measurable security outcomes.

From strategic insight to practical action
Join DrBA MSc Jeroen Van Der Vlies for a business-focused discussion on AI, cybersecurity, and executive decision-making. Explore perspectives from EC-Council’s Certified AI Program Manager CAIPM training and his book, How Can the C-level Boardroom Stay Agile and Make Effective Company Decisions of (New) “Cyber” Business Risks.
The session brings together AI risk management, security operations, and boardroom priorities, focusing on supporting compliance with applicable requirements under the AI Act, GDPR, NIS2, CER, and the Cybersecurity Act.

Three calls to action
Take control of your AI risk. Map your organization’s AI exposure and establish clear policies, accountability, and oversight aligned with your business priorities.
Put AI to work in your security program. Prioritize use cases—from alert triage to incident response—and plan controlled pilots with clear success criteria.
Turn ambition into readiness. Build an actionable roadmap that connects people, processes, and technology with measurable outcomes and executive oversight.
Networking Hub
Wed 4
10:00h - 11:30h Networking Hub Public Access
10:00h
Side Event | Side Event CISOs & Security Leader

CISO FORUM: Securing Cities and Critical Infrastructure

David Esteban
David Esteban Barcelona City Council CISO Speaker

2026-11-04 10:00 2026-11-04 11:30 Europe/Madrid CISO FORUM: Securing Cities and Critical Infrastructure An exclusive roundtable led by David Esteban, CISO of the Barcelona City Council, bringing together cybersecurity leaders from city councils, public institutions and critical infrastructure operators to exchange experiences, challenges and best practices. Through an open discussion, participants will explore topics such as OT security, cyber resilience, crisis management, interdependencies and cross-sector collaboration. Level 1 - Room 2.5
Wed 4
10:00h - 11:30h Level 1 - Room 2.5 Invitation required
10:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Barcelona Smart Transportation & Maritime Cyber Resilience Forum

Schedule
10:00h - 10:15h
10:15h - 10:20h
Welcome and opening remarks
Ulrich Seldeslachts
Ulrich Seldeslachts LSEC Leaders in Security CEO Speaker
10:20h - 10:45h
Opening Keynote: The cyber threat landscape for the transport sector
Marcos Gómez
Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker
11:00h - 11:30h
11:30h - 12:00h
Keynote: ACTI-X: From cyber threat intelligence to action in global travel & critical transport infrastructures
Vincent Rigal
Vincent Rigal Head of Amadeus Application Security Operations Centers Speaker
12:00h - 13:00h
Roundtable: From port to aircraft and across supply chain – Common cybersecurity and CTI challenges
Nick Saharan
Nick Saharan CSAFI.ORG President Speaker
Vincent Rigal
Vincent Rigal Head of Amadeus Application Security Operations Centers Speaker
Alejandro Manuel Herrera Pérez
Alejandro Manuel Herrera Pérez Port of Algeciras CISO Speaker
Ulrich Seldeslachts
Ulrich Seldeslachts LSEC Leaders in Security CEO Moderator
13:00h - 13:45h
14:15h - 14:45h
Fireside chat: Cross sector collaboration and cyber defence capabilities for critical infrastructures: Supply chains, subsea cables and resilient compute
Holger Spohn
Holger Spohn North Atlantic Treaty Organisation Principal Engineer (Advanced Cyber Defence Principles) Speaker
Ulrich Seldeslachts
Ulrich Seldeslachts LSEC Leaders in Security CEO Speaker
14:45h - 15:00h
Closing remarks and next steps
Ulrich Seldeslachts
Ulrich Seldeslachts LSEC Leaders in Security CEO Speaker

2026-11-04 10:00 2026-11-04 15:00 Europe/Madrid Barcelona Smart Transportation & Maritime Cyber Resilience Forum A strategic forum on cyber resilience across connected transportation and maritime environments. Bringing together transport, port, shipping and cybersecurity perspectives, the programme will explore emerging threats, OT and IT convergence, operational continuity, regulatory expectations and supply-chain dependencies—from connected mobility systems and transport infrastructure to vessels and ports. The goal is to identify practical priorities for securing essential services and strengthening cross-sector collaboration. Level 1 - Room 2.3
Wed 4
10:00h - 15:00h Level 1 - Room 2.3 Public Access
10:00h
Showcase session | Showcase Corner

Showcase Corner Sessions

2026-11-04 10:00 2026-11-04 17:00 Europe/Madrid Showcase Corner Sessions
10:00 – Jakincode
10:20 – Inetum
10:40 – Cisco
11:00 – Censys
11:20 – Odyssey (ClearSkies)
11:40 – Checkmarx
12:00 – Object First
12:20 – Delinea
12:40 – Fortinet
13:00 – Optimumtic
13:35 – RDT Barcelona
14:40 – Inetum
15:00 – Bitecsa
15:20 – Riot
15:40 – S2 Grupo
16:00 – Sarenet
16:20 – Secomea
16:40 – Hangzhou Expo Group
Showcase Corner
Wed 4
10:00h - 17:00h Showcase Corner Public Access
10:00h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

The new attack surface in healthcare & pharma: Balancing AI, vendor access, and rapid response

Jordi García
Jordi García Palo Alto Networks Solutions Consultant Speaker
Miguel Angel Benito
Miguel Angel Benito Servei de Salut de les Illes Balears Subdirector de Transformación, Innovación y Salud Digital Speaker

2026-11-04 10:00 2026-11-04 10:35 Europe/Madrid The new attack surface in healthcare & pharma: Balancing AI, vendor access, and rapid response As modern hospitals and pharmaceutical companies evolve into highly interconnected digital ecosystems, their attack surface has expanded exponentially, making cybersecurity critical for both patient safety and intellectual property protection. This session explores real-world use cases across clinical environments and pharma R&D to address the most pressing challenges facing security teams today.  Auditorium II
Wed 4
10:00h - 10:35h Auditorium II Full Congress Pass
10:00h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Sovereign Cyber AI: Beyond the obvious

Kirti Kumar
Kirti Kumar Cyber AI Products Global CTO Speaker

#AIGovernance, #AIInfrastructure, #AISecurity, #CyberSovereignty, #DataGovernance, #DigitalSovereignty, #EuropeanAI, #SovereignAI

2026-11-04 10:00 2026-11-04 10:35 Europe/Madrid Sovereign Cyber AI: Beyond the obvious Sovereign AI usually raises three concerns: where the data resides, what the regulator will ask, and a geopolitically induced coma. Those are the obvious ones. The harder questions are who can alter your AI, whether your defenders can live without it, and one rarely asked: how far an attacker can steer it without ever touching it. Drawing on real-world initiatives, this session sets out a reference architecture for Sovereign Cyber AI and its value-realisation model. Existing standards stop short of this, and closing the gap is our job as a community. The safeguards we settle on now are what the next generation inherits. Auditorium I
Wed 4
10:00h - 10:35h Auditorium I Full Congress Pass
10:45h
Conference | Congress Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem

Rob Harrison
Rob Harrison Sophos Vice President Speaker

#Accountability, #Compliance, #Compliance&DataProtection, #CyberRegulation, #CyberResilience, #DORA, #Governance, #NIS2, #RiskManagement

2026-11-04 10:45 2026-11-04 11:10 Europe/Madrid No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem Europe's regulators have quietly redrawn the cybersecurity poverty line - the gap between the few organisations that can run security as a system and the millions that have the tools but not the capability to make them work. Under NIS2 and DORA, that gap is no longer a social problem; it's a legal one, and it runs straight through your supply chain. When an under-resourced supplier or ICT provider sits below the line, you inherit both the breach and the regulatory exposure  and, increasingly, your board inherits personal liability for it. This session examines how MDR and an agentic SOC scale security operations across 40,000 organizations, and why the harder, unsolved problem is scaling strategy and governance. That's the gap Sophos CISO Advantage is built to close: scaling the judgment of a world-class CISO, continuous control validation, and regulator-ready metrics to organisations with or without a CISO, so they can both deliver their security strategy and prove it, and lift their whole ecosystem above the line. Auditorium I
Wed 4
10:45h - 11:10h Auditorium I Full Congress Pass
10:45h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

The future of access security in Europe: AI, non-human Identities and digital sovereignty

Alejandro Soret Madolell
Alejandro Soret Madolell Wallix IT & OT Solutions Engineer Speaker

2026-11-04 10:45 2026-11-04 11:10 Europe/Madrid The future of access security in Europe: AI, non-human Identities and digital sovereignty Can Europe truly achieve digital sovereignty without controlling who or what can access its critical systems? This session explores how Privileged Access Management (PAM) is evolving, from securing administrator accounts to managing access for non-human identities and AI agents. Through practical examples, we'll look at the challenges of controlling privileged access and why this is essential for Europe's digital sovereignty. Auditorium II
Wed 4
10:45h - 11:10h Auditorium II Full Congress Pass
11:20h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

The new frontier: Sovereignty and resilience in the age of AI

José de la Cruz
José de la Cruz TrendAI™ Technical Director Iberia Speaker
Raúl Guillén
Raúl Guillén TrendAI™ European Cybersecurity Strategist Speaker

2026-11-04 11:20 2026-11-04 11:45 Europe/Madrid The new frontier: Sovereignty and resilience in the age of AI Frontier AI is creating a new technology frontier — and a new security challenge. Organisations must not only protect AI systems, but also understand their dependencies, maintain control over critical capabilities and remain resilient as the technology evolves. This session explores the intersection of Frontier AI, digital sovereignty and cyber resilience, bringing together strategic and technical perspectives on how to navigate this rapidly changing landscape. Auditorium II
Wed 4
11:20h - 11:45h Auditorium II Full Congress Pass
11:20h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

This is your brain on deepfakes: Why AI scams work on smart people and how you can stop it

Christian Reinhardt
Christian Reinhardt SoSafe SE Director Human Risk Management Speaker

#DataPrivacy, #DigitalTrust, #Governance, #IdentitySecurity, #Resilience, #TrustFrameworks

2026-11-04 11:20 2026-11-04 11:45 Europe/Madrid This is your brain on deepfakes: Why AI scams work on smart people and how you can stop it Deepfakes are no longer science fiction – they are here, and they are highly effective. Drawing on neuroscientific insights, this talk explains why the human brain is not built for these threats and how the same psychological mechanisms attackers exploit can be turned into powerful tools for awareness. Understanding the brain is key to building real security resilience. Auditorium I
Wed 4
11:20h - 11:45h Auditorium I Full Congress Pass
11:55h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Your AI Agents can act without you: Can you see them, control them and stop them?

Arvin Bansal
Arvin Bansal C&S Wholesale Grocers CISO Speaker

2026-11-04 11:55 2026-11-04 12:20 Europe/Madrid Your AI Agents can act without you: Can you see them, control them and stop them?
Enterprise AI has crossed a line. The first wave advised people. Agentic AI can now use credentials, call APIs, access sensitive data and change business systems at machine speed.
Before you scale it, can you answer: How many agents are running? Who owns them? What can they access and change? Can an agent exceed the authority of the human it serves? Can you prove what an agent actually did? And if one is compromised or manipulated, can you stop it before it becomes a business incident?
Drawing on practical experience building an enterprise AI security strategy, Arvin Bansal will show how to move from AI policy to production control using TRACE: Track, Register, Approve, Certify and Expose. He will connect board risk to agent identity, permission inheritance, data protection, gateways, behavioral monitoring, forensic traceability and kill switches, showing how security can accelerate agentic transformation without surrendering control.
Auditorium II
Wed 4
11:55h - 12:20h Auditorium II Full Congress Pass
11:55h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

New operating models for governing AI and cybersecurity

Sounil Yu
Sounil Yu Cyber Defense Matrix and the DIE Triad Author and creator Speaker

#AIGovernance, #CISOs, #CyberResilience, #CybersecurityLeadership, #Governance, #RiskManagement, #SecurityOperatingModel, #Strategy

2026-11-04 11:55 2026-11-04 12:20 Europe/Madrid New operating models for governing AI and cybersecurity AI is not just more automation. It requires new thinking and new operating models to govern and secure properly. This session explores these operating models, shares practical ways to apply them, and predicts what is coming next. Auditorium I
Wed 4
11:55h - 12:20h Auditorium I Full Congress Pass
12:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience CISOs & Security Leader IT & Infrastructure

ISC2 Community & Professional Development Forum

Alejandro Cadarso
Alejandro Cadarso ISC2 Spain Chapter / Field CTO President Host
Néstor Angulo
Néstor Angulo ISC2 Spain Chapter / CISSP Head of Technology Moderator
Sebastián Correas
Sebastián Correas ISS & GRC Consultant / CISSP / CCSSP / ISO27001 & ISO 42001 Lead Auditor Speaker
Mykhailo Sindieiev
Mykhailo Sindieiev DevSecOps Engineer / OWASP Barcelona Leader Speaker

#Ciberseguridad, #ISC2, #ISC2Spain, #OWASP, #SBOM

2026-11-04 12:00 2026-11-04 13:30 Europe/Madrid ISC2 Community & Professional Development Forum ISC2 Spain Chapter is organising this 90-minute session to share updates on the Chapter’s development, its certification initiatives, continuing education and professional development activities, and to host a collaborative roundtable with OWASP. The roundtable, entitled “SBOM: The Foundation for Secure Development, Vulnerability Management, and Compliance”, will explore software supply chain security and Software Bills of Materials (SBOMs) in the context of the CRA (Cyber Resilience Act) and NIS2, offering a practical perspective on vulnerabilities and open-source risk management. An open space to learn, exchange experiences and strengthen the professional cybersecurity community. Networking Hub
Wed 4
12:00h - 13:30h Networking Hub Public Access
12:30h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

The real story behind zero trust, identity, and device security. From identity to workforce trust: Securing workforce access end-to-end

Darren James
Darren James Specops Software Senior Product Manager Speaker

#AccessControl, #Authentication, #CyberRisk, #DeviceSecurity, #IdentityGovernance, #IdentitySecurity, #WorkforceIdentity, #ZeroTrust

2026-11-04 12:30 2026-11-04 12:55 Europe/Madrid The real story behind zero trust, identity, and device security. From identity to workforce trust: Securing workforce access end-to-end
Workforce access has never been more dynamic or more unpredictable. Users connect from anywhere, on devices that shift daily between personal, managed, trusted, and unknown, and security teams are expected to make the right call every time. Identity tells you who is connecting, but today’s environments make it equally critical to understand what they’re connecting with.
Because if you don’t trust the device, you can’t trust the access. This session explores how identity and device trust come together to meet the real access challenges organizations face. Curious how this story shapes the future of secure access in 2026? Join us to find out.
Auditorium II
Wed 4
12:30h - 12:55h Auditorium II Full Congress Pass
12:30h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

The dark side of AI: Tackling AI-based cyber attacks

Joan Vives
Joan Vives ManageEngine Technical Consultant Speaker

#AISecurity, #AIThreats, #IdentitySecurity, #PAM, #ThreatLandscape

2026-11-04 12:30 2026-11-04 12:55 Europe/Madrid The dark side of AI: Tackling AI-based cyber attacks Privileged Access Management is evolving beyond simple password vaulting. Discover the mission to turn PAM360 into a comprehensive command center that builds, automates, and orchestrates your entire security landscape. This presentation covers the pillars of a robust PAM framework, the efficiency of automated operations, and the power of complex task orchestration. Auditorium I
Wed 4
12:30h - 12:55h Auditorium I Full Congress Pass
13:05h
Roundtable | Congress AI, identity and trust in the digital environment Compliance & Data Protection

Europe’s cyber resilience & cyber sovereignty: a strategic perspective from Europe’s governmental cybersecurity agencies

Marcos Gómez
Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker
Pekka Jokinen
Pekka Jokinen National Cyber Security Center Finland Deputy Director General Speaker
Maurizio Mensi
Maurizio Mensi Italian National School of Administration Professor of Law and Economics Moderator
Arno Spiegel
Arno Spiegel Federal Chancellery (Austria) Deputy Director - Cybersecurity and Crisis Data Center Speaker
Carlos Moreira Antunes
Carlos Moreira Antunes National Cybersecurity Centre (Portugal) Head of Legal and International Affairs Speaker

#CyberResilience, #CyberSovereignty, #EuropeanSecurity, #GovernmentCybersecurity, #NIS2, #StrategicCooperation, #ThreatLandscape

2026-11-04 13:05 2026-11-04 13:50 Europe/Madrid Europe’s cyber resilience & cyber sovereignty: a strategic perspective from Europe’s governmental cybersecurity agencies
Europe is entering a decisive era for cybersecurity. As geopolitical tensions, sophisticated cyber threats, supply-chain dependencies and digital disruption continue to grow, European governments must strengthen their ability to anticipate, withstand and recover from cyber incidents while protecting Europe’s strategic digital autonomy.

This high-level panel brings together senior representatives from the national cybersecurity agencies of Portugal, Spain, Finland and Austria to explore the governmental perspective on European Cyber Resilience and Cyber Sovereignty. The discussion will examine how European nations are translating EU cyber strategies, regulations and resilience frameworks into national capabilities; protecting critical infrastructure and government services; strengthening public-private cooperation; securing strategic technologies and supply chains; and developing greater European sovereignty in an increasingly contested digital environment.

The panel will provide practical insights into Europe’s evolving cybersecurity priorities, cross-border cooperation and the capabilities required to build a more resilient, secure and digitally sovereign Europe.
Auditorium I
Wed 4
13:05h - 13:50h Auditorium I Full Congress Pass
13:05h
Conference | Congress Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

From culture to posture: Strengthening employee security in the age of AI

Kike Serrano Velamazán
Kike Serrano Velamazán Riot Market Launcher Spain & Iberia Ambassador and Speaker Speaker

2026-11-04 13:05 2026-11-04 13:30 Europe/Madrid From culture to posture: Strengthening employee security in the age of AI
Today's threats evolve faster than we can train our teams, and CISOs know that legacy awareness programs are no longer enough to stop sophisticated and adaptive attacks.
By empowering users to take ownership of their daily cyber habits and actions, CISOs can limit their exposure to attacks, enable clearer reporting on key metrics, and build a stronger shared security posture across the organisation.

Join this boardroom to discuss strategies to:
- Expand security awareness programmes to engage all business units, not just IT
- Implement individual cybersecurity KPIs to encourage teams to build better habits
- Enable effective board-level reporting with clear, measurable security progress indicators
Auditorium II
Wed 4
13:05h - 13:30h Auditorium II Full Congress Pass
13:30h
Conference | Other

What’s new at Sophos: AI Defense, XDR and Next-Gen SIEM

2026-11-04 13:30 2026-11-04 14:00 Europe/Madrid What’s new at Sophos: AI Defense, XDR and Next-Gen SIEM The rise of AI is creating new opportunities, but also new risks. Join us to explore the latest innovations from Sophos, including Sophos AI Defense, New XDR and Next Gen SIEM, and learn how organizations can gain visibility, reduce complexity and stay ahead of emerging threats Stand 2C41
Wed 4
13:30h - 14:00h Stand 2C41 Public Access
14:35h
Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

PHP2Shell: Why the patch isn’t the fix, and the playbook for the next one

Greg Olmstead
Greg Olmstead Nubelo Engineering Co-Founder Speaker

2026-11-04 14:35 2026-11-04 15:00 Europe/Madrid PHP2Shell: Why the patch isn’t the fix, and the playbook for the next one A vendor-agnostic look at PHP2Shell (CVE-2026-109618/109619), from early leak to patch to in-the-wild exploitation. We'll cover why it bypasses application-layer defences, why old PHP versions with no official fix leave public-sector and smart-city estates exposed, and why leaked memory means rotating credentials is part of the response, not an afterthought. Attendees leave with a practical playbook: asset discovery, prioritising unsupported versions, rotating secrets, and deciding what to do when a disclosure comes out before the fix. Auditorium I
Wed 4
14:35h - 15:00h Auditorium I Full Congress Pass
14:35h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Agentic AI in production: What works and what doesn’t in a real SOC

Erik Alejos Agustí
Erik Alejos Agustí Fundació “la Caixa” CISO Speaker
Ángela Martijena Di Monte
Ángela Martijena Di Monte Var Group Iberia Head of Cyber Defence Speaker

2026-11-04 14:35 2026-11-04 15:00 Europe/Madrid Agentic AI in production: What works and what doesn’t in a real SOC
The evolution of the SOC is no longer just about increasing automation, but about improving decision-making and prioritising alerts according to actual business risk.
This session presents a real-world use case from Fundació “la Caixa”, whose 24/7 Follow-the-Sun SOC operates across Spain, Thailand and Mexico. Building on existing SIEM/SOAR automation, the organisation is exploring agentic AI capabilities using Devo and Strike AI 48 to support alert triage, enrichment and initial analysis.
The goal is to reduce analysts’ workload, improve response times and ensure more consistent risk-based prioritisation, while keeping human judgement at the centre. Preliminary results show improvements in triage time, analytical consistency and escalation processes. The session will also address key challenges, including agent governance, context quality and the need for human oversight.
Co-presented with Erik Alejos, Security Manager at Fundació “la Caixa”, this session shares practical lessons, benefits and limitations from a real-world implementation, with no commercial focus.
Auditorium II
Wed 4
14:35h - 15:00h Auditorium II Full Congress Pass
15:00h
Side Event | Side Event AI, identity and trust in the digital environment

Securing AI Agents: What could go wrong? A hands-on session for understainng threats and how to mitigate them

Sebastián Correas
Sebastián Correas ISS & GRC Consultant / CISSP / CCSSP / ISO27001 & ISO 42001 Lead Auditor Speaker
Simone Onofri
Simone Onofri W3C Security Lead Speaker
Mila Gerova
Mila Gerova Threat Modeling Connect Chapter Lead Speaker

2026-11-04 15:00 2026-11-04 17:00 Europe/Madrid Securing AI Agents: What could go wrong? A hands-on session for understainng threats and how to mitigate them
What could go wrong when an AI agent acts on your behalf, such as reading and using a Web?
In this interactive session, Threat Modeling Connect (TMC) will introduce its community and show how threat modeling helps us examine emerging AI technologies. Using agentic AI and WebMCP as a practical case, we'll share a few threats already identified in ongoing work, then invite participants to hands-on facilitated activities o challenge the model, find gaps, and discuss possible responses.
We'll close by looking at what evidence is needed to support AI risk management and, where applicable, EU AI Act compliance. No prior threat modeling experience is needed. Bring your perspective and see how you can contribute.
Networking Hub
Wed 4
15:00h - 17:00h Networking Hub Public Access
15:10h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Quantum cryptography: Past, present, future

Carlos Solano Sánchez
Carlos Solano Sánchez NTT Data Senior Product Manager Speaker

#CryptoAgility, #Cryptography, #PostQuantumCryptography, #PQC, #QKD, #QuantumCryptography, #QuantumSecurity

2026-11-04 15:10 2026-11-04 15:35 Europe/Madrid Quantum cryptography: Past, present, future
Cryptography is facing one of the greatest turning points in its history. This presentation will explore the evolution of encryption, from the cryptographic models that currently protect our communications and data to the new paradigms that will shape digital security in the quantum era.
We will analyze the current state of pre-quantum cryptography, the risks posed by the arrival of quantum computers capable of compromising certain existing algorithms, and the transition towards post-quantum cryptography as a response to this new landscape. We will also explore the role of quantum cryptography and technologies such as Quantum Key Distribution (QKD), placing their level of maturity, applications, and challenges into context.
A journey through the past, present, and future to understand how information protection will evolve, what decisions organizations need to start making today, and why crypto-agility will become a strategic capability for addressing the next generation of threats.
Auditorium I
Wed 4
15:10h - 15:35h Auditorium I Full Congress Pass
15:10h
Conference | Hacking Partner Cybersecurity as a strategic business and reputational risk IT & Infrastructure

See NinjaOne in action: Vulnerability remediation in the age of AI-driven exploits

Wladimir Rojo
Wladimir Rojo NinjaOne Team Lead Solutions Engineer for EMEA Speaker

2026-11-04 15:10 2026-11-04 15:35 Europe/Madrid See NinjaOne in action: Vulnerability remediation in the age of AI-driven exploits
What you'll see: Live in NinjaOne, watch a vulnerable application get patched on the spot, an endpoint get hardened against real world attack paths like open USB ports and outdated protocols, and a device recovered from a ransomware style incident using backups, all in a matter of minutes.
Why it matters: Endpoints are now where 90% of cyberattacks originate and where 90% of ransomware incidents begin, with endpoint attacks up 300% quarter over quarter and nearly 40,000 new CVEs published last year alone. This session shows attendees exactly how to close that gap before an attacker gets there first.
Auditorium II
Wed 4
15:10h - 15:35h Auditorium II Full Congress Pass
15:30h
Conference | Other

Cybersecurity in the AI Era: Identity, detection and response

2026-11-04 15:30 2026-11-04 16:00 Europe/Madrid Cybersecurity in the AI Era: Identity, detection and response
Modern cyber defense requires more than technology alone. Learn how Sophos Fusion combines Managed Detection and Response, Identity Threat Detection and Response, and expert Advisory Services to help organizations detect, investigate and respond to threats across the entire attack surface.
Stand 2C41
Wed 4
15:30h - 16:00h Stand 2C41 Public Access
15:45h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

The absent perimeter: Why modern SOCs must defend the cognitive layer

Xavier Martí-Renom
Xavier Martí-Renom Sirt Head of Intellectual Property & Business Development Speaker

2026-11-04 15:45 2026-11-04 16:10 Europe/Madrid The absent perimeter: Why modern SOCs must defend the cognitive layer As modern Security Operations Centers (SOCs) automate their operations using AI with autonomous capabilities (agentic AI), attackers are bypassing technical defenses by directly exploiting the minds of authorized users through advanced social engineering techniques. This trend reveals a critical gap in the "Zero Trust" model: while this model validates identities and devices, it fails to detect when a user is acting under psychological manipulation. Cognitive security can no longer be limited to traditional awareness training; it must be integrated as an operational capability within the SOC and the Security Incident Response Team (SIRT). In this session, we will examine how incident response teams can incorporate cognitive defense into their workflows, and why corporate culture and context—just as much as technical telemetry—are crucial for mitigating these types of attacks. Auditorium II
Wed 4
15:45h - 16:10h Auditorium II Full Congress Pass
15:45h
Conference | Congress AI, identity and trust in the digital environment CISOs & Security Leader

Okay… so, what next?

Carlos Payés
Carlos Payés SentinelOne Strategic AI Executive Speaker

#AITransformation, #CISOs, #CyberLeadership, #DecisionMaking, #ExecutiveLeadership, #Governance, #RiskManagement, #SecurityStrategy

2026-11-04 15:45 2026-11-04 16:10 Europe/Madrid Okay… so, what next?
We are at the AI inflection point.
Externally, AI is enabling attackers. Internally, adoption is racing ahead of security, governance, and clarity of ownership. It all feels a bit uncomfortably familiar.
This session draws lessons from yesterday's cyber security as we look to tomorrow. What has worked, what failed, and where can we head next if we want to secure AI without slowing progress.
I’ll look ahead to autonomous SOC operations and a threat landscape shaped by AI-enabled attackers and machine-speed decision making.
AI is changing security. Okay... so, what next?
Auditorium I
Wed 4
15:45h - 16:10h Auditorium I Full Congress Pass
16:00h
Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection IT & Infrastructure

Agents that act, humans that respond

José Manuel Tejedor Lloria
José Manuel Tejedor Lloria Global CISO Council Spain Chapter Vice President – Finance Moderator
Eva Puerta Pérez
Eva Puerta Pérez Global CISO Council Spain Chapter Vice President – Academia Speaker
Rubén Cortés Domingo
Rubén Cortés Domingo Global CISO Council Spain Chapter Advisory Board Member Speaker
Xavier Duch
Xavier Duch Global CISO Council Spain Chapter Advisory Board Member Speaker

2026-11-04 16:00 2026-11-04 17:30 Europe/Madrid Agents that act, humans that respond
Artificial intelligence is moving beyond assisting people to taking action. Systems already exist that can use tools, access data, trigger processes, and operate with real permissions.
Level 0 - Room 2.2
Wed 4
16:00h - 17:30h Level 0 - Room 2.2 Public Access
16:30h
Awards | Awards Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

The CISO Leadership Awards Ceremony

Marcos Gómez
Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Jury
Holger Spohn
Holger Spohn North Atlantic Treaty Organisation Principal Engineer (Advanced Cyber Defence Principles) Jury
José Valiente
José Valiente Centro de Ciberseguridad Industrial (CCI) Director General Jury
Krzysztof Szubert
Krzysztof Szubert European Cyber Security Organisation (ECSO) Member of the Board of Directors Jury
Anett Mádi-Nátor
Anett Mádi-Nátor Women4Cyber Foundation President Jury
Daniel Walther
Daniel Walther die Mobiliar Chief Information Security Officer Jury
Jon France
Jon France idea42 CISO Jury
Katy Anton
Katy Anton JP Morgan Executive Director of Cybersecurity Architecture Jury
Luca Dozio
Luca Dozio Altermaind Chief Information Security Officer Jury
Sascha Maier
Sascha Maier SV Group Chief Information Security Officer Jury

2026-11-04 16:30 2026-11-04 17:30 Europe/Madrid The CISO Leadership Awards Ceremony 28 of the most influential cybersecurity leaders in Europe and beyond are competing across 7 categories. The winners will be revealed live at Barcelona Cybersecurity Congress on 4 November at 16:30. Make sure you are in the room. Auditorium I
Wed 4
16:30h - 17:30h Auditorium I Full Congress Pass
17:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Help securing the future. Community projects you can participate in

Mykhailo Sindieiev
Mykhailo Sindieiev DevSecOps Engineer / OWASP Barcelona Leader Speaker
Andrés Galarza
Andrés Galarza AstraZeneca Manager Speaker

2026-11-04 17:00 2026-11-04 18:30 Europe/Madrid Help securing the future. Community projects you can participate in In this session the chapter leaders of OWASP Barcelona give an overview of the community projects, and explain how you can contribute. OWASP is the Open World Application Security Project that drives application security for the software industry. The most well known project is the OWASP TOP 10 but there are hundereds of projects ranging from tools, industry standards and guides. Covering topics such as LLM security, AI agent secutity, supply chain management ,API security, process maturity, cheat sheets and much more. OWASP is a non profit foundation and everything is run by volunteers, you are invited to contribute and turbocharge your carreer in the community of experts. Networking Hub
Wed 4
17:00h - 18:30h Networking Hub Public Access
10:00h
Side Event | Side Event Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Breaking trust: Internal desktop apps and the AppStream illusion

2026-11-05 10:00 2026-11-05 11:00 Europe/Madrid Breaking trust: Internal desktop apps and the AppStream illusion
Desktop applications have fallen out of the spotlight in the AI era, yet they remain deeply embedded in the internal infrastructure of countless companies and research labs, often running with elevated trust and minimal scrutiny.
This talk examines the security posture of desktop applications through the lens of Tier2 vs. Tier3 architectures, breaking down the structural weaknesses inherent to each model. Through real-world case studies, we'll walk through practical exploitation of common vulnerability classes (including login bypass, authentication bypass, and insecure deserialization), demonstrating how these flaws are found and abused in production environments.
We'll then examine standard remediation strategies for these vulnerabilities and discuss their inherent limitations. Finally, we'll dig into a widely adopted mitigation pattern: using application virtualization platforms like AppStream or Citrix to "convert" a Tier2 application into a Tier3-equivalent deployment.
We'll critically assess whether this approach constitutes a genuine architectural fix. Spoiler: it doesn't always hold up, and we'll show how it can be bypassed.
Level 0 - Room 2.1
Thu 5
10:00h - 11:00h Level 0 - Room 2.1 Public Access
10:00h
Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection

AI under control: Security, governance and accountability

Emilio Piñeiro
Emilio Piñeiro Asociación Territorio Compliance President Moderator
Jordi  Martínez Barranco
Jordi Martínez Barranco SELGRUP Dirección de Tecnología · Gobernanza IT · Transformación Digital · Seguridad de la Información · IA Speaker
Sonia Gracia Castellón
Sonia Gracia Castellón Fieldfisher Principal Associate · Privacy & Digital Law · AI & Technology Speaker
Mª Dolores Fenollosa
Mª Dolores Fenollosa INCOTEC Innovación Eficiente Innovación · Negocio · Startups tecnológicas · Cumplimiento Speaker

2026-11-05 10:00 2026-11-05 11:00 Europe/Madrid AI under control: Security, governance and accountability A practical and multidisciplinary conversation on how organisations can govern the use of AI through security, risk management, compliance, accountability and organisational decision-making.  Networking Hub
Thu 5
10:00h - 11:00h Networking Hub Public Access
10:00h
Startup session | Startups Sessions

Startup Sessions

2026-11-05 10:00 2026-11-05 14:40 Europe/Madrid Startup Sessions A dedicated space for startups to showcase their solutions through 15-minute presentations, talks, and live demos. An opportunity to promote their innovations, share insights, and connect with the cybersecurity community.

10:00 - 10:15 Polar Risk
10:20 - 10:35 Red Mimicry
10:40 - 10:55 Ciberia Labs
11:00 - 11:15 Inprosec
11:20 - 11:35 AI Esra 
11:40 - 11:55 Emery
12:00 - 12:15 Revel8
12:20 - 12:35 Stofu
12:40 - 12:55 Neotica
13:00 - 13:15 MetaData (CEIN)
13:20 - 13:35 Tesicnor (CEIN)
13:40 - 13:55 ViVeSec Box
14:00 - 14:15 Merox
14:20 - 14:35 Wodam
Startup Area
Thu 5
10:00h - 14:40h Startup Area Public Access
10:00h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

European cyber innovation & investment forum

Schedule
10:00h - 10:05h
Opening – Europe’s Cybersecurity innovation moment
Polyvios Hadjiyiangou
Polyvios Hadjiyiangou Operations at European Cybersecurity Competence Centre (ECCC) Head of Unit Speaker
10:30h - 11:00h
ECSO panel: can Europe build a competitive cybersecurity industry?
François Lavaste
François Lavaste Tikehau Capital Executive Director Speaker
Magdalena Chałas
Magdalena Chałas Elevator Ventures Senior Investment Manager Speaker
Polyvios Hadjiyiangou
Polyvios Hadjiyiangou Operations at European Cybersecurity Competence Centre (ECCC) Head of Unit Moderator
12:00h - 12:40h
Panel A – The investors’ perspective: what will it take to build Europe’s next cybersecurity champions?
Alde Gonzalez
Alde Gonzalez Plug & Play Cybersecurity Investor & Consultant Moderator
Bastien Menguy
Bastien Menguy Auriga Partners Cyber Investor Speaker
Bart Houlleberghs
Bart Houlleberghs TIN Capital Partner Speaker
Alberto Pérez Arranz
Alberto Pérez Arranz Giesecke+Devrient Investment Principal Speaker
Yanick Rosenbaum
Yanick Rosenbaum eCAPITAL VC Speaker
12:40h - 13:10h
Panel B – The founders’ startup perspective: Building the next European cybersecurity leader
Xavier Álvarez
Xavier Álvarez Merabytes Director de Operaciones Speaker
Dan Brett
Dan Brett NNEAT CEO and co-founder Speaker
Oscar Villanueva
Oscar Villanueva Nymiz Founder & CEO Speaker
Sarah Isal
Sarah Isal Auriga Partners Cybersecurity early-stage investor Moderator
Àlex Sànchez i Nofre
Àlex Sànchez i Nofre Scud Cybersecurity CEO & Founder Speaker
13:10h - 13:30h
Open discussion with the audience about the European challenges for both investors and startup companies
Polyvios Hadjiyiangou
Polyvios Hadjiyiangou Operations at European Cybersecurity Competence Centre (ECCC) Head of Unit Speaker
13:30h - 13:45h
Closing: 10 actions to build Europe’s cybersecurity champions
Polyvios Hadjiyiangou
Polyvios Hadjiyiangou Operations at European Cybersecurity Competence Centre (ECCC) Head of Unit Speaker

2026-11-05 10:00 2026-11-05 13:40 Europe/Madrid European cyber innovation & investment forum
Building Europe's next cybersecurity champions - from startup innovation to global scale, strategic capital & unicorn exits.
Can Europe build the next cybersecurity unicorn?
Level 1 - Room 2.4
Thu 5
10:00h - 13:40h Level 1 - Room 2.4 Public Access
10:00h
Showcase session | Showcase Corner

Showcase Corner Sessions

2026-11-05 10:00 2026-11-05 14:35 Europe/Madrid Showcase Corner Sessions
10:00 – Swimlane
10:20 – Vega Security
10:40 – Watchguard Technologies
11:00 – Yes We Hack
11:20 – Opentext
11:40 – Hiksemi
12:00 – Basetis
12:20 – Var Group
12:40 – ISC2
13:00 – Utilis
13:20 – Mind The Hack
13:40 – Proofpoint
14:00 – Complaion
14:20 – Mimecast
Showcase Corner
Thu 5
10:00h - 14:35h Showcase Corner Public Access
10:00h
Side Event | Side Event AI, identity and trust in the digital environment

HackBCN Talks

Albert Trelis
Albert Trelis Eurofins Senior security consultant (Penetration tester) Speaker
Josep Albors
Josep Albors ESET Spain Head of Awareness & Research Speaker
Gorka El Bochi Morillo
Gorka El Bochi Morillo BBLABS Founder Speaker

#AppStream, #BankingTrojans, #BugBounty, #DesktopSecurity, #IA, #NFCFraud

2026-11-05 10:00 2026-11-05 13:30 Europe/Madrid HackBCN Talks Three technical talks, each lasting 1 hour and 10 minutes: (1) Breaking Trust: Internal Desktop Apps and the AppStream Illusion (Albert Trelis, Eurofins, EN), exploring desktop application exploitation, authentication bypasses, insecure deserialization, and the limitations of AppStream/Citrix virtualisation; (2) Return of Sedinho (Josep Albors, ESET, EN), examining the evolution of Brazilian banking trojans and new Android NFC fraud campaigns involving an NGate variant; and (3) The Vulnerabilities AI Can't Fix (Gorka El Bochi Morillo, BBLABS, ES), highlighting unconventional bugs in security audits and Bug Bounty programmes that still require human expertise and judgement. Level 1 - Room 2.4
Thu 5
10:00h - 13:30h Level 1 - Room 2.4 Public Access
10:05h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

The future of threat intelligence: Defending at machine speed

Staffan Truvé
Staffan Truvé Recorded Future Co-founder & CTO Speaker

2026-11-05 10:05 2026-11-05 10:35 Europe/Madrid The future of threat intelligence: Defending at machine speed As AI changes the speed and scale of cyber threats, intelligence has to evolve with it. This talk explores the changing role of threat intelligence in cyber defense, from identifying emerging risks to turning complex signals into the context needed to act earlier and with greater precision. It will examine how AI and threat intelligence are enabling faster, increasingly autonomous approaches to security, helping defenders keep pace as threats move at machine speed. Auditorium II
Thu 5
10:05h - 10:35h Auditorium II Full Congress Pass
10:05h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

Beyond compliance: Building cyber resilience where people, digital security and physical safety converge

Farell Folly
Farell Folly Cybersecurity Competencer Center Global Head Speaker

2026-11-05 10:05 2026-11-05 10:35 Europe/Madrid Beyond compliance: Building cyber resilience where people, digital security and physical safety converge
As Europe strengthens its cybersecurity regulations and digital sovereignty ambitions, organizations must move beyond compliance to build genuine, demonstrable cyber resilience.
Cybersecurity involves multiple perspectives: executives, engineers, security professionals, safety experts and employees all perceive risks differently. True resilience emerges from connecting these views and addressing threats that affect industrial operations, critical infrastructure, supply chains, business continuity and human safety.
This session explores how organizations can turn regulatory requirements into practical resilience capabilities. Drawing on industrial cybersecurity and independent testing, inspection and certification, it examines how human-centered leadership, security-by-design, international standards and independent assurance can strengthen resilience, manage technological dependencies and build trust.
Ultimately, cyber resilience means bringing diverse perspectives together to protect people, sustain critical operations and preserve trust in an interconnected world.
Auditorium I
Thu 5
10:05h - 10:35h Auditorium I Full Congress Pass
10:45h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

From check-in to takeover: The hidden cyber war on hospitality

Sascha Maier
Sascha Maier SV Group Chief Information Security Officer Speaker

2026-11-05 10:45 2026-11-05 11:10 Europe/Madrid From check-in to takeover: The hidden cyber war on hospitality
Your reservation is at risk. Please re-confirm your card within 24 hours.” It arrives via WhatsApp, with every booking detail correct, and it was written by a criminal.
Hotels, their partners, and booking platforms have quietly become some of the most attractive targets for cybercriminals. Hotels run 24/7 front desks under constant time pressure, have high staff turnover, handle payment data at every touchpoint, and route the guest journey through third-party platforms they don't control. Attackers have industrialised this. They use AI-crafted phishing in guests' own languages, fake “guest complaints” that deliver malware to reception desks, and hijacked extranet accounts that turn trusted channels into fraud machines.
Auditorium II
Thu 5
10:45h - 11:10h Auditorium II Full Congress Pass
10:45h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Who governs the agents? Identity governance in the age of agentic AI

Raul D'Opazo
Raul D'Opazo One Identity Solutions Architect Speaker

#AccessControl, #AIAgents, #AISecurity, #Authorization, #IdentityGovernance, #NonHumanIdentities, #ZeroTrust

2026-11-05 10:45 2026-11-05 11:10 Europe/Madrid Who governs the agents? Identity governance in the age of agentic AI AI agents are rapidly becoming autonomous actors within the enterprise: accessing applications, consuming APIs, handling data and making decisions on behalf of humans and organisations. But who owns these identities? Who grants their access, certifies their permissions and removes them when they are no longer needed? This session explores why Agentic AI requires us to extend Identity Governance beyond the human workforce. We will examine how AI agents can be discovered, assigned ownership, governed throughout their lifecycle and linked to the permissions they accumulate across cloud and enterprise environments. The goal is simple: enable organisations to embrace Agentic AI without losing control of who - or what - has access to what, why, and on whose behalf. Auditorium I
Thu 5
10:45h - 11:10h Auditorium I Full Congress Pass
11:00h
Side Event | Side Event AI, identity and trust in the digital environment IT & Infrastructure

The cyber-AI paradox: Why research must simultaneously advance AI-based defense and secure the AI pipeline

Shuaib Siddiqui
Shuaib Siddiqui Cybersecurity & Blockchain Research Group Director Speaker
Josep Pegueroles
Josep Pegueroles UPC-ETSETB Professor Speaker
Pere Tuset-Peiró
Pere Tuset-Peiró Professor of Computer Networks & Cybersecurity Speaker

2026-11-05 11:00 2026-11-05 12:30 Europe/Madrid The cyber-AI paradox: Why research must simultaneously advance AI-based defense and secure the AI pipeline
Artificial Intelligence is rapidly transforming cybersecurity, providing new capabilities to detect threats, automate analysis, and respond to increasingly sophisticated attacks. At the same time, the growing adoption of AI introduces a new and complex attack surface: the AI pipeline itself.
This dual challenge—the Cyber-AI paradox—is at the core of the research carried out by GREC, the Cognitive Cybersecurity Research Group, which brings together researchers from i2CAT, UPC, and UOC. The group approaches AI and cybersecurity from two complementary directions: using AI to strengthen cyber defense, while simultaneously ensuring that AI systems and their entire pipelines are secure, trustworthy, and resilient.
During the session, we will present the main research lines currently being explored by GREC and showcase some of the work carried out in these areas, ranging from AI-driven approaches for threat detection and cyber defense to the identification and mitigation of security risks affecting AI models, data, and infrastructures.
The talk will provide an overview of the challenges, ongoing research, and lessons learned at the intersection of AI and cybersecurity, highlighting why advancing AI-based defense and securing the AI pipeline must be addressed together to build the next generation of resilient digital infrastructures.
Networking Hub
Thu 5
11:00h - 12:30h Networking Hub Public Access
11:00h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Return of Sedinho: Current situation and new tactics of the Brazilian banking trojan ecosystem

2026-11-05 11:00 2026-11-05 12:00 Europe/Madrid Return of Sedinho: Current situation and new tactics of the Brazilian banking trojan ecosystem During several years we have been tracking the evolution of Brazilian banking trojans, their expansion into countries well beyond their original sphere of influence, and the law enforcement operations that attempted to disrupt their activity. Building on that work, this talk revisits the current landscape and examines the latest improvements and changes introduced by the malware operators behind these groups. In this session, we will analyze several recent financially motivated campaigns that show how Latin American threat actors are not only evolving classic banking malware, but also introducing NFC based mobile fraud against victims in multiple countries. We will provide concrete examples of how well known families such as Grandoreiro and Casbaneiro are refining both their techniques and their social engineering narratives while continuously adapting their malware infection chains and evasion strategies. We will also introduce their newest Android campaigns that leverage NFC fraud through a new NGate variant that masquerades as legitimate applications intended to relay NFC card data between devices. Cybercriminals distribute these trojanized apps under various pretexts, including online banking tools, lottery apps, and shopping applications. Once installed, the malware intercepts NFC payment card data and the victim's PIN, forwarding them to attacker controlled infrastructure to enable contactless ATM cash outs and fraudulent POS transactions, all without requiring additional risky permissions. Throughout the talk, we will walk through the observed tactics, techniques, and procedures, highlighting how the malware code, supporting infrastructure, and social engineering patterns have changed compared to the campaigns we analyzed previously. Our goal is to raise awareness of the ongoing evolution of these Latin American originated malware operations and to equip security teams with the context they need to detect and block these threats before they can cause damage to their organizations. Level 0 - Room 2.1
Thu 5
11:00h - 12:00h Level 0 - Room 2.1 Public Access
11:20h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

When one attack makes everyone stronger: Inside collective defense

Víctor Manuel Hernández Gómez
Víctor Manuel Hernández Gómez Orange Cyberdefense in Spain Country Manager Speaker

2026-11-05 11:20 2026-11-05 11:45 Europe/Madrid When one attack makes everyone stronger: Inside collective defense
Cyber threats are fast-moving, adaptive and increasingly interconnected, powered by AI. No organisation should have to face them alone.
Join Victor Hernandez, Orange Cyberdefense España, managing director, to discover how Dynamic SOC turns the scale and diversity of its protected community into a collective advantage. Signals from nearly 4,000 organizations, around 3 million supervised assets across 8 connected countries, combined with in-house cyber threat intelligence and human expertise, help identify emerging threats earlier and transform them into shared detection capabilities.
Dynamic SOC illustrates a simple conviction: when a threat is detected for one asset of one customer, the protection of the whole community can become stronger.
Auditorium II
Thu 5
11:20h - 11:45h Auditorium II Full Congress Pass
11:20h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

IoT Security: From device to cloud

Luka Herman
Luka Herman Deutsche Telekom IoT IoT Account Manager Speaker
Abanoub Mouanas Iskandar
Abanoub Mouanas Iskandar Deutsche Telekom IoT Global Account Manager IoT Speaker

2026-11-05 11:20 2026-11-05 11:45 Europe/Madrid IoT Security: From device to cloud
What if someone could turn a supermarket refrigerator into a 50°C oven from the other side of the world? As more devices become connected, securing the device itself is only part of the challenge. The way data travels between the device, network and cloud matters just as much.
This session explores how IoT connectivity can become part of the security architecture. We will look at how private APNs can reduce direct exposure to the public Internet, create controlled communication paths and help ensure that connected devices are reachable where needed, while remaining invisible to everyone else.
Auditorium I
Thu 5
11:20h - 11:45h Auditorium I Full Congress Pass
11:30h
Conference | Other

Sophos Firewall in the AI Era

2026-11-05 11:30 2026-11-05 12:00 Europe/Madrid Sophos Firewall in the AI Era As networks become more distributed and threats move at machine speed, firewall technology remains a critical foundation of cyber resilience. Discover the latest Sophos Firewall capabilities and how they help organizations improve protection, simplify management and strengthen security outcomes in the AI era. Stand 2C41
Thu 5
11:30h - 12:00h Stand 2C41 Public Access
11:55h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Securing the intelligent network: Cyber resilience for AI, 5G and 6G

Connie McIntosh
Connie McIntosh Ericsson Head of Security Speaker

#5GSecurity, #6GSecurity, #AISecurity, #CriticalInfrastructure, #CyberResilience, #NetworkResilience, #NetworkSecurity, #TelecomSecurity

2026-11-05 11:55 2026-11-05 12:20 Europe/Madrid Securing the intelligent network: Cyber resilience for AI, 5G and 6G AI is transforming intelligent transport networks into autonomous, software-defined systems, but with greater autonomy comes greater risk. This session examines emerging cyber threats across AI-driven control planes, edge and satellite infrastructure, quantum disruption, and the intersection of EU sovereignty, EU regulation, and cyber resilience. Auditorium I
Thu 5
11:55h - 12:20h Auditorium I Full Congress Pass
11:55h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

Beyond cybersecurity: Who owns the decision?

Holger Spohn
Holger Spohn North Atlantic Treaty Organisation Principal Engineer (Advanced Cyber Defence Principles) Speaker

#BoardGovernance, #BusinessAlignment, #CISOs, #CyberLeadership, #CyberStrategy, #ExecutiveAccountability, #Governance, #RiskOwnership

2026-11-05 11:55 2026-11-05 12:20 Europe/Madrid Beyond cybersecurity: Who owns the decision?
Cybersecurity is no longer just about protecting systems, identities, and data.
As AI, automation, critical infrastructure, cloud platforms, and global supply chains become increasingly interconnected, security, resilience, and sovereignty are converging into a single challenge: maintaining the ability to act when dependencies fail, change, or come under pressure.
Drawing on insights from Black Hat and DEF CON, this keynote explores how the attack surface is expanding beyond technology into trust, dependency, autonomy, and decision-making itself. From critical infrastructure and supply chains to undersea cables, compute concentration, and hybrid cyber operations, the session examines how modern cyber incidents increasingly create operational, economic, and strategic effects.
Attendees will gain a new perspective on resilience, sovereignty, and agency in a world where digital capabilities depend on infrastructures and ecosystems that few organizations fully control.
Auditorium II
Thu 5
11:55h - 12:20h Auditorium II Full Congress Pass
12:00h
Side Event | Side Event AI, identity and trust in the digital environment IT & Infrastructure

Las vulnerabilidades que no te quita la IA

2026-11-05 12:00 2026-11-05 13:00 Europe/Madrid Las vulnerabilidades que no te quita la IA La IA está cambiando la forma de realizar auditorías y Bug Bounty, pero hay vulnerabilidades que siguen requiriendo algo que ningún modelo puede automatizar por completo: experiencia, creatividad y una comprensión profunda del comportamiento de una aplicación. En esta charla nos olvidaremos de los fallos más comunes que la IA ya es capaz de encontrar y nos centraremos en bugs concretos y poco convencionales que todavía requieren una mirada humana. A través de mi experiencia con docenas de vulnerabilidades reportadas antes y después de la llegada de la IA, veremos cómo la especialización puede convertirse en una ventaja frente a otros hackers y frente a la propia inteligencia artificial. Analizaremos ejemplos reales de vulnerabilidades y técnicas de explotación que he encontrado en auditorías y programas de Bug Bounty, y cómo desarrollar una metodología para descubrir aquello que otros pasan por alto. Level 0 - Room 2.1
Thu 5
12:00h - 13:00h Level 0 - Room 2.1 Public Access
12:30h
Side Event | Side Event Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

Should cybersecurity report to the CIO or directly to the CEO?

2026-11-05 12:30 2026-11-05 14:00 Europe/Madrid Should cybersecurity report to the CIO or directly to the CEO? Cybersecurity is increasingly a strategic business risk management issue, rather than solely a technological one. In this context, should the CISO report to the CIO or directly to the CEO? While reporting to the CIO facilitates coordination with Technology, reporting directly to the CEO strengthens the independence and visibility of the security function. This raises the question of whether a model in which the CISO works closely with the CIO while having direct access to the CEO to escalate critical risks and incidents offers the best balance. Networking Hub
Thu 5
12:30h - 14:00h Networking Hub Public Access
12:30h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Cutting through the HYPE: A practical approach to secure AI adoption

Federico Teti
Federico Teti Zscaler Principal Strategy Architect Speaker

2026-11-05 12:30 2026-11-05 12:55 Europe/Madrid Cutting through the HYPE: A practical approach to secure AI adoption In this session, we cut through the noise and hype surrounding AI security to explore a practical, reality-based approach for secure AI adoption in the enterprise. While many vendors market broad AI security promises, they are often built on legacy architectures that fail to address decentralized agents and runtime risks. We will examine Zscaler's Zero Trust approach to AI security, demonstrating how true visibility, inline safeguards, and agent governance deliver real protection and risk mitigation beyond market rhetoric. Auditorium I
Thu 5
12:30h - 12:55h Auditorium I Full Congress Pass
12:30h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

Defending at AI speed

Francisco González Ortiz
Francisco González Ortiz Inetum Microsoft Security Lead Speaker
Gerard Salvador López
Gerard Salvador López Microsoft Global Security Blackbelt Speaker

2026-11-05 12:30 2026-11-05 12:55 Europe/Madrid Defending at AI speed Cyber threats evolve rapidly and security operations must adapt to respond just as fast. This session explores the key challenges, needs, and capabilities for enabling an AI assisted cyberdefense model that accelerates detection, investigation, and response. Attendees will gain insights into how organizations can foster human expertise with AI capabilities to improve their chances to stay ahead of increasingly sophisticated attacks. Auditorium II
Thu 5
12:30h - 12:55h Auditorium II Full Congress Pass
13:05h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Cyber resilience of emergency coordination centres from a law enforcement perspective on European security research

Rubén Fernández Bleda
Rubén Fernández Bleda Ajuntament de València Police Officer and Project Manager Speaker
José L. Diego
José L. Diego Ajuntament de València Police Inspector and Chief of Staff to the Chief Commissioner Speaker

#CriticalInfrastructure, #CyberResilience, #IncidentManagement, #LawEnforcement, #PublicSafety, #SecurityOperations

2026-11-05 13:05 2026-11-05 13:30 Europe/Madrid Cyber resilience of emergency coordination centres from a law enforcement perspective on European security research
This presentation explores how EU-funded security research helps law enforcement agencies protect citizens and counter cybercrime, from defining operational needs and co-designing solutions to validating emerging technologies.
Drawing on València Local Police’s experience, it focuses on the GANNDALF pilot protecting the city’s emergency coordination centre, including its 092 call line and dispatch services. The pilot tests tools for early threat detection, cyber risk assessment, forensic visualisation and decision support against phishing, ransomware-style disruption and denial-of-service scenarios.
Using simulated environments and synthetic data, the session examines how an emergency organisation can safely evaluate advanced cybersecurity tools. It shares practical lessons on collaboration between police, researchers and technology providers, bridging European security R&D with the everyday operational needs of public safety agencies,
Auditorium I
Thu 5
13:05h - 13:30h Auditorium I Full Congress Pass
13:05h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

A sign without a lock: How the web decides which AI Agents to trust

Jaime Morales Rodríguez de Lope
Jaime Morales Rodríguez de Lope Lognext Head of Cybersecurity Speaker

2026-11-05 13:05 2026-11-05 13:30 Europe/Madrid A sign without a lock: How the web decides which AI Agents to trust
AI agents no longer just answer questions. They browse, read and act on online services on our behalf. Every website now faces a new decision: trust this automated traffic, restrict it, or block it.
This talk presents the results of an empirical study on how websites actually treat AI-related User Agents. Combining large-scale measurement with controlled testing, we compared what websites declare in their policies, such as robots.txt, with what they really enforce. We also examined whether they identify AI agents, apply differentiated rules, and penalize some agents more than others.
The results show a fragmented and immature ecosystem. Some AI agents are widely accepted, while others face significantly more restrictions and blocking. In many cases, declared rules and real enforcement do not match. Together, these patterns point to new forms of trust and reputation between websites and autonomous systems.
Attendees will leave with a clear view of how the Internet is adapting to AI-driven traffic, which agents are penalized most often, and what this means for security, for businesses that publish content, and for the future of machine-to-web communication.
Auditorium II
Thu 5
13:05h - 13:30h Auditorium II Full Congress Pass
13:35h
Conference | Congress Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Cold chain, hot target: The OT security opportunity playbook in industrial food and bev sector

Nick Saharan
Nick Saharan CSAFI.ORG President Speaker

2026-11-05 13:35 2026-11-05 14:05 Europe/Madrid Cold chain, hot target: The OT security opportunity playbook in industrial food and bev sector Food processing, wholesale distribution and cold-chain logistics run on the PLCs, SCADA, HMIs and remote access that OT security teams protect every day. NIS2, the CER Directive, the Cyber Resilience Act and PAS 96:2026 are now converging on the sector. Yet most OT security providers struggle to get through the door, because industrial food sector buys differently. Drawing on csafi.org’s work with meat, poultry, dairy and seafood operators across Europe, North America and Australia, this session shows where the risks sit, cyber-physical environment in food manufacturing sector and how to earn a place in the market. Auditorium I
Thu 5
13:35h - 14:05h Auditorium I Public Access
13:35h
Conference | Congress AI, identity and trust in the digital environment IT & Infrastructure

From alert fatigue to autonomous triage: How agentic AI is reshaping vulnerability management

Sharjeel Qayyum Khan
Sharjeel Qayyum Khan EPAM Systems Senior Enterprise Security Architect (EMEA) Speaker

2026-11-05 13:35 2026-11-05 14:00 Europe/Madrid From alert fatigue to autonomous triage: How agentic AI is reshaping vulnerability management Security teams are drowning in findings. SAST, SCA and secret-scanning tools generate thousands of alerts, most of them false positives or unreachable code, and analysts spend more time sorting noise than fixing real risk. This session shows how agentic AI can change that. Drawing on a working system I designed and built, I will walk through how an AI triage pipeline combines retrieval over CWE, MITRE ATT&CK and CISA KEV knowledge, code reachability analysis and exploit-probability scoring to classify findings, explain its reasoning and route confirmed issues straight to developers as fix pull requests, with a human analyst kept in the loop for every decision. Attendees will leave with a practical architecture, the guardrails that make AI triage trustworthy, and an honest view of where it works and where it still needs people. Auditorium II
Thu 5
13:35h - 14:00h Auditorium II Full Congress Pass
14:05h
Conference | Congress AI, identity and trust in the digital environment Compliance & Data Protection

Governing, testing and assuring AI-enabled systems

Iraklis Mathiopoulos
Iraklis Mathiopoulos CREST Europe Council Member Speaker

2026-11-05 14:05 2026-11-05 14:30 Europe/Madrid Governing, testing and assuring AI-enabled systems
AI is transforming cybersecurity services, creating new opportunities while introducing challenges around risk, governance and trust. As AI systems become increasingly autonomous, how can organisations ensure they are secure, reliable and used responsibly?
Drawing on CREST's latest research and work on AI principles, standards and assurance, this session will explore how organisations can build confidence in AI-enabled systems through effective governance, human oversight, testing and independent assurance, enabling responsible innovation without compromising trust.
Auditorium I
Thu 5
14:05h - 14:30h Auditorium I Full Congress Pass
14:05h
Conference | Congress Systemic, cyber-physical and supply chain resilience CISOs & Security Leader

Decision-making under pressure: When cyber incidents become physical and operational crises

Jonatan Quintana
Jonatan Quintana IEEE Senior Member Corporate Security, Risk & Resilience Advisor Speaker

2026-11-05 14:05 2026-11-05 14:30 Europe/Madrid Decision-making under pressure: When cyber incidents become physical and operational crises How should leaders respond when a cyber incident threatens people, facilities and essential operations? This session explores practical approaches to making decisions with incomplete information and limited time, coordinating cyber, physical security and operational teams, and assessing the wider consequences of containment measures. Drawing on experience in high-risk security environments, it focuses on protecting people and maintaining business continuity. Auditorium II
Thu 5
14:05h - 14:30h Auditorium II Full Congress Pass
14:35h
Conference | Congress

Mapping the invisible: Geopolitical analysis as a cybersecurity tool

Margot François
Margot François Cassini Geopolitical Consultant Speaker

2026-11-05 14:35 2026-11-05 15:00 Europe/Madrid Mapping the invisible: Geopolitical analysis as a cybersecurity tool Behind every cyberattack lies an actor, whether state-sponsored, criminal, or hacktivist, driven by interests that are often divergent and sometimes conflicting. Yet cyber risk is still too often approached through a purely technical lens, detached from the strategic contexts in which threats emerge. This talk argues that geopolitical analysis, applied to cyberspace at multiple scales, offers security professionals a way to grasp the “big picture” of cyber risk. Central to our approach is the idea of a continuum: cyberspace does not exist in the ether. Data flows, infrastructures, and information campaigns are anchored in physical places, jurisdictions, and territories. Bringing this materiality to light makes cyber threats easier to understand and, crucially, to anticipate Auditorium I
Thu 5
14:35h - 15:00h Auditorium I Full Congress Pass

Subscribe to our newsletter

Be the first to hear about BCC27 · 2–4 November 2027

Close