🎙 BARCELONA CYBERSECURITY CONGRESS
BCC Podcast: cybersecurity conversations
without filters
The official video podcast of Barcelona Cybersecurity Congress. Host Scott MacKenzie (Industrial Talk) sits down with CISOs, founders and researchers to talk about what really happens on the front line of cybersecurity: real threats, real decisions and ideas you can take back to your team.
See you at BCC27 · 2–4 November 2027
6 episodesTop CISOs & expertsRecorded for BCC26
ALL EPISODES
Press play and level up your security thinking
Resilient architectures, CISO leadership, the psychology of human risk, identity-first security, internet exposure and what keeps CISOs up at night: six conversations with the people shaping the future of cybersecurity.
EP 01 · SOUNIL YU · 39 MIN
The DIE Triad: making cybersecurity irrelevant in the AI age
Why systems built to be Distributed, Immutable and Ephemeral need far less security, and how AI changes the game.
“We can either DIE intentionally, or we can die because the attacker has done it for us.”
DIE TriadResilienceAISecurity architecture
Sounil Yu
Cybersecurity veteran with 30+ years in the field, former Chief Scientist at Bank of America and creator of the Cyber Defense Matrix and the DIE Triad.
Can AI make cybersecurity irrelevant? Sounil Yu explains why systems built to be Distributed, Immutable and Ephemeral (DIE) need far less of the classic CIA triad (confidentiality, integrity, availability) and how AI is turning companies into high-velocity engineering organisations.
- âś“The more DIE, the less CIA. Short-lived, immutable, distributed assets lower your security burden: a vulnerability matters less if the asset is gone tomorrow.
- âś“AI enables high-velocity engineering. When rebuilding software is cheap, you can replace it faster than attackers can exploit it.
- ✓Pets vs. cattle. Some systems (hospitals, critical data) will always need protection; build everything else as disposable “cattle”.
- âś“Short term, attackers have the edge. Expect the next ~18 months to be hard for defenders as they ramp up on AI.
- âś“For newcomers: stay curious. Experiment with new technology, break it and learn from failure.
EP 02 · RUBÉN CORTÉS & ANTONIO DELGADO · 68 MIN
CISO Roundtable: real threats, real decisions, no BS
Two CISOs separate real threats from the noise: provider concentration, ransomware, cyber insurance and the board.
“Stop thinking that cybersecurity is a technical question. Talk about risks, not firewalls. Talk about business, not networks.”
CISO leadershipThird-party riskNIS2OT security
Rubén Cortés & Antonio Delgado · Global CISO Council Spain
Rubén Cortés, Director of Technology and Cybersecurity at Consorci AOC (serving around 2,200 Catalan public bodies), and Antonio Delgado, CISO of an international education group with around 30 schools in Europe, Latin America and the US.
Two CISOs from the Global CISO Council Spain chapter separate real threats from the noise: from dependence on a handful of providers to ransomware in schools, OT security, cyber insurance and how to talk to the board.
- âś“Real threats vs. hype. Concentration of services in few providers, third-party risk and ransomware/phishing are real; fully autonomous AI attacks are, for now, mostly noise.
- âś“The maturity gap. Small municipalities and schools often have no CISO and are prime ransomware targets.
- ✓Prepare before the incident. Contain, communicate and recover from an alternative instance. Frameworks like ISO 27001, NIST and Spain’s ENS force you to prepare.
- âś“Plan for provider failure. Multi-cloud, sovereign cloud and at least two providers per critical service.
- âś“Talk business, not firewalls. Present cyber risk to the board in terms of impact, and remember NIS2 fines.
- âś“Cyber insurance now requires maturity: MFA everywhere, backups, incident response plans, EDR and vulnerability management.
EP 03 · CHRISTIAN REINHARDT · 43 MIN
Why AI scams work on smart people, and how to stop the mechanism
Falling for a scam is about emotion, not intelligence. Simple habits to stop the mechanism at work and at home.
“Most attacks are successful not because we’re too stupid, but because we’re very emotional.”
Human riskPhishingSecurity awarenessPsychology
Christian Reinhardt · SoSafe
Sports psychologist at SoSafe who studies cybersecurity from the human side: how attackers manipulate behaviour and how to build lasting security habits.
Falling for a scam is not about intelligence, it is about emotion. Christian Reinhardt explains how attackers trigger strong emotions to bypass rational thinking, and gives simple, science-backed habits to protect people at work and at home.
- ✓It’s emotion, not intelligence. Attackers trigger fear or desire so we act before we think.
- ✓The 25-second rule. In SoSafe’s phishing simulations, 95% of people who clicked did so within the first 25 seconds. If in doubt, lock your screen and grab a coffee.
- âś“Ask someone else, verify through another channel. A second reader is less emotional; never use contact details from the suspicious email.
- âś“Attackers love short weeks. Busy days before bank holidays are peak phishing time.
- ✓Make awareness positive. Win people over, celebrate “cyber heroes” who report threats and show progress, like a personal trainer at the gym.
EP 04 · DARREN JAMES · 43 MIN
Identity-first architecture: proving you are you in the AI era
Voice cloning, stolen session cookies and MFA bypass: why identity and trusted devices are the new perimeter.
“Where is your security perimeter these days? It’s not the network. It’s the device you log in with.”
IdentityZero TrustMFASocial engineering
Darren James · Specops Software
Identity specialist at Specops Software (part of the Outpost24 group) with 15 years in cybersecurity, after starting his career on the IT service desk and running Active Directory for global companies.
Strong passwords and MFA are no longer enough. Darren James shows how attackers use AI voice cloning to fool service desks and steal session cookies to bypass MFA, and why the answer is identity-first, zero-trust security that users don’t hate.
- âś“The service desk is a target. With AI, anyone can clone a voice and build a convincing profile from LinkedIn; knowledge-based questions (date of birth, postcode) are not proof.
- âś“Verify identity for real. Government ID plus a liveness selfie, enforced before any password reset.
- âś“MFA can be bypassed. Adversary-in-the-middle phishing and infostealers steal session cookies after you log in.
- âś“Trust the device, not just the user. Bind credentials to known devices: the device is the new perimeter.
- ✓Security without friction. Self-service fixes, “Fix now” buttons and grace periods keep the business running.
EP 05 · MARTIJN GROOTEN · 35 MIN
State of the Internet: what the data says about your exposure
Unpatched systems, services on non-standard ports, exposed industrial control systems and the boom in public-facing AI, seen through internet-wide scan data.
“It’s not bad to put things on the internet. It’s bad to put vulnerable things on the internet.”
Attack surfacePatchingICS/OTShadow AI
Martijn Grooten · Censys
Principal Security Researcher at Censys, with almost 20 years in cybersecurity since joining a small security company in 2007.
Censys sees parts of the internet that almost no one else does. Martijn Grooten walks through the 2026 State of the Internet Report: what is exposed, what is left unpatched and how AI is quietly growing the attack surface.
- âś“Patching is the real gap. Vendors release fixes quickly; the challenge is getting organisations to apply them.
- âś“Look beyond the default ports. More than two-thirds of HTTP services run outside ports 80 and 443, so an admin panel on another port can be the way in.
- âś“ICS rarely travels alone. 80% of hosts running an industrial control system service also run HTTP, SSH or FTP, widening the attack surface.
- âś“Attackers pick providers, not countries. Threat infrastructure goes where hosting is cheap, functional and slow to act on takedown requests.
- âś“AI exposure is growing fast. Public-facing AI infrastructure grew 63% in nine months, and 76% of exposed n8n hosts had at least one critical (9+) vulnerability.
- âś“Shadow AI is the new shadow IT. When official tools fall short, people turn to unofficial AI, sometimes with customer data or corporate mailboxes.
EP 06 · ULRICH SELDESLACHTS · 54 MIN
What keeps CISOs up at night in 2026
Legacy OT, thousands of small suppliers, NIS2, the Cyber Resilience Act and the talent gap: protecting the business without slowing it down.
“Cybersecurity needs to be an enabler for the business. It should not stifle innovation.”
CISO leadershipSupply chainNIS2 & CRAOT security
Ulrich Seldeslachts · LSEC
CEO of LSEC – Leaders in Security, a non-profit association founded around 25 years ago with some 1,600 cybersecurity members, mostly in Europe. Close to three decades in security, including roles as CISO, security director and investment director.
What really keeps a CISO awake is keeping the business running. Ulrich Seldeslachts covers legacy OT, supply-chain risk under NIS2, the Cyber Resilience Act and how to use AI with guardrails.
- âś“Legacy OT is still a headache. Critical machines still run on Windows XP; keeping OT and IT security aligned is a continuous job.
- ✓Your suppliers are your risk. Large companies can have 3,000–4,000 suppliers, most of them small firms, and NIS2 means proving your supply chain is secure too.
- âś“Buy what you can run. Big-vendor platforms are expensive and often only 10% used; many teams are stepping back to specific tools their people can manage.
- âś“The talent gap is real. Europe is mapping its capacity: LSEC helped select 23 top pentesting firms across Europe from more than 350 applications.
- âś“Use AI, with guardrails. Draft a basic security policy or screen thousands of compliance documents in minutes, but review and double-check the output.
- âś“The CRA is coming. From January 2028, products with digital elements sold in Europe must meet security and documentation requirements or can be pulled from the market.
ABOUT THE PODCAST
About the BCC Podcast
The BCC Podcast brings the conversations of Barcelona Cybersecurity Congress to your screen all year round. BCC is the cybersecurity event organised by Fira de Barcelona in collaboration with the Cybersecurity Agency of Catalonia, bringing together CISOs, public institutions, companies and startups.
In every episode, host Scott MacKenzie (Industrial Talk) talks to the experts shaping the industry, from the DIE Triad and CISO leadership to the psychology of phishing, identity-first security, internet exposure and the challenges keeping CISOs awake in 2026, with practical ideas for security teams of any size.
BCC27 · 2–4 November 2027: subscribe to our newsletter to be the first to hear about new episodes, speakers and activities.
Contact us for the 2027 edition →
Frequently asked questions
What is the BCC Podcast?
The BCC Podcast is the video podcast of Barcelona Cybersecurity Congress (BCC). Each episode is a conversation with CISOs, researchers and security leaders about real threats, real decisions and practical ideas for security teams.
Who hosts the BCC Podcast?
The episodes are hosted by Scott MacKenzie of Industrial Talk, who also broadcast live from Barcelona Cybersecurity Congress 2026.
Who are the guests?
Sounil Yu, creator of the Cyber Defense Matrix and the DIE Triad; Rubén Cortés and Antonio Delgado from the Global CISO Council Spain chapter; Christian Reinhardt from SoSafe; Darren James from Specops Software; Martijn Grooten from Censys; and Ulrich Seldeslachts from LSEC.
What topics does the podcast cover?
Resilient security architecture and the DIE Triad, CISO leadership and third-party risk, the psychology of phishing and human risk, identity-first, zero-trust security, internet exposure and attack surface, and CISO priorities under NIS2 and the Cyber Resilience Act.
How can I stay updated about BCC27?
Subscribe to our newsletter to be the first to hear about new episodes, speakers and activities for BCC27. If you are interested in taking part in the 2027 edition, contact us.
When and where is BCC27?
Barcelona Cybersecurity Congress 2027 (BCC27) will take place on 2–4 November 2027 at the Gran Via venue of Fira de Barcelona, Barcelona.
Where can I watch the episodes?
All episodes are available on this page and on YouTube.
Want to be part of the conversation?
See you at BCC27. November 2–4, 2027 · Barcelona, Gran Via venue.
Subscribe to our newsletter to be the first to hear about new episodes and speakers.