Back | Home Agenda

Download PDF

Side Event

Tue 03

10:00h

Side Event | Side Event Systemic, cyber-physical and supply chain resilience IT & Infrastructure

Ciberresiliencia en la cadena de suministro industrial

Schedule

10:00h - 10:20h

Apertura: la cadena de suministro industrial ya no es una cadena

José Valiente Centro de Ciberseguridad Industrial Director General Speaker

10:20h - 10:40h

¿Qué ocurre cuando falla un tercero tecnológico crítico?

Oscar López GB-FOODS CISO Global Speaker

10:40h - 11:00h

El papel del fabricante en la ciberresiliencia industrial

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

11:00h - 11:20h

Cómo gerstionar dependencias en proyectos industriales complejos

María Dolores Trapero Elecnor Sistemas Responsable de Centro de Ciberseguridad y redes IT/OT Speaker

11:20h - 12:00h

Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial?

Oscar López GB-FOODS CISO Global Speaker

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

Pablo Carmona Preventa de Redes y Ciberseguridad OT/IT Speaker

Joan Figueras Coordinador de CCI en Cataluña Speaker

Maite Arcos Fundación ESYS Directora Moderator

2026-11-03 10:00 2026-11-03 12:00 Europe/Madrid Ciberresiliencia en la cadena de suministro industrial La resiliencia industrial ya no depende únicamente de proteger los activos propios, sino de comprender y gobernar las dependencias tecnológicas que sostienen la operación. Este side event aborda la cadena de suministro desde cuatro perspectivas complementarias: operador industrial, fabricante, ingeniería y gobierno del riesgo. Analizaremos qué ocurre cuando falla un tercero tecnológico crítico, cómo diseñar productos y arquitecturas capaces de resistir, y cómo gestionar dependencias en proyectos industriales complejos. La sesión culminará con un panel sobre quién controla realmente el riesgo de la cadena de suministro, poniendo el foco en responsabilidad compartida, visibilidad, alternativas, capacidad de respuesta y continuidad operativa. Networking Hub

Tue 3

10:00h - 12:00h Networking Hub Public Access

10:00h

Side Event | Side Event

Apertura: la cadena de suministro industrial ya no es una cadena

José Valiente Centro de Ciberseguridad Industrial Director General Speaker

2026-11-03 10:00 2026-11-03 10:20 Europe/Madrid Apertura: la cadena de suministro industrial ya no es una cadena text Networking Hub

Tue 3

10:00h - 10:20h Networking Hub Public Access

10:20h

Side Event | Side Event

¿Qué ocurre cuando falla un tercero tecnológico crítico?

Oscar López GB-FOODS CISO Global Speaker

2026-11-03 10:20 2026-11-03 10:40 Europe/Madrid ¿Qué ocurre cuando falla un tercero tecnológico crítico? text Networking Hub

Tue 3

10:20h - 10:40h Networking Hub Public Access

10:40h

Side Event | Side Event

El papel del fabricante en la ciberresiliencia industrial

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

2026-11-03 10:40 2026-11-03 11:00 Europe/Madrid El papel del fabricante en la ciberresiliencia industrial text Networking Hub

Tue 3

10:40h - 11:00h Networking Hub Public Access

11:00h

Side Event | Side Event

Cómo gerstionar dependencias en proyectos industriales complejos

María Dolores Trapero Elecnor Sistemas Responsable de Centro de Ciberseguridad y redes IT/OT Speaker

2026-11-03 11:00 2026-11-03 11:20 Europe/Madrid Cómo gerstionar dependencias en proyectos industriales complejos text Networking Hub

Tue 3

11:00h - 11:20h Networking Hub Public Access

11:20h

Side Event | Side Event

Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial?

Oscar López GB-FOODS CISO Global Speaker

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

Pablo Carmona Preventa de Redes y Ciberseguridad OT/IT Speaker

Joan Figueras Coordinador de CCI en Cataluña Speaker

Maite Arcos Fundación ESYS Directora Moderator

2026-11-03 11:20 2026-11-03 12:00 Europe/Madrid Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial? text Networking Hub

Tue 3

11:20h - 12:00h Networking Hub Public Access

15:30h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

Jornada Anual DCA Ciberseguretat

Alba Barrientos DCA Gestora de la Comunitat Ciberseguretat Host

José Nicolás Castellano Cybersecurity Consultant Speaker

Xavier Pi UPC School Co-director Máster Industria 4.0 Speaker

Olga Sánchez Caixabank IT Manager Speaker

Barbara Eisele DCA Gestora Blockchain Speaker

2026-11-03 15:30 2026-11-03 17:30 Europe/Madrid Jornada Anual DCA Ciberseguretat La comunitat de ciberseguretat de la Digital Catalonia Alliance (DCA) celebra la seva jornada anual en el marc del Barcelona Cybersecurity Congress, un punt de trobada per a empreses, professionals i agents de l’ecosistema digital. La sessió donarà visibilitat a solucions tecnològiques innovadores en els àmbits de la ciberseguretat i el blockchain, i abordarà els reptes de la confiança digital des de diferents perspectives. El programa inclourà demostracions i casos pràctics, una sessió sobre com s’executa un ciberatac i una taula rodona amb experts en ciberseguretat, compliance i blockchain. La jornada finalitzarà amb un espai de networking per fomentar connexions i noves oportunitats de col·laboració Level 0 - Room 2.1

Tue 3

15:30h - 17:30h Level 0 - Room 2.1 Invitation required

16:00h

Side Event | Side Event

AI Agents for vulnerability management and compliance-as-code

Schedule

16:00h - 16:30h

From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

Harald Messemer MessemerTech OÜ SO 27001 Lead Auditor Speaker

16:30h - 17:00h

Nobody Reads 40,000 Vulnerability Findings

Gerardo Prieto MessemerTech OÜ CISO Speaker

17:00h - 18:00h

Barcelona CyberSec Networking

2026-11-03 16:00 2026-11-03 18:00 Europe/Madrid AI Agents for vulnerability management and compliance-as-code Cybersecurity can no longer rely on manual backlogs, static bureaucracy, or blind trust. In this session block, we will explore the frontlines of digital defense: from transforming compliance into a living, automated process (OSCAL), and unleashing AI agents to manage the endless chaos of vulnerability findings, to fighting back in an era where deepfakes and spoofing mean voice and SMS can no longer be trusted. Three pivotal perspectives on building intelligent, scalable, and true zero-trust security for the real world. Networking Hub

Tue 3

16:00h - 18:00h Networking Hub Public Access

16:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Systemic, cyber-physical and supply chain resilience Compliance & Data Protection

From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

Harald Messemer MessemerTech OÜ SO 27001 Lead Auditor Speaker

#ComplianceAsCode, #ContinuousAssurance, #ISO27001, #OSCAL, #SGSI

2026-11-03 16:00 2026-11-03 16:30 Europe/Madrid From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL The ISMS and ISO 27001 are often perceived as bureaucratic processes disconnected from day-to-day cybersecurity operations. This talk proposes a different approach: integrating the ISMS into development and operations pipelines until it becomes part of the operational model. The key is to build systems that generate structured, signed evidence, traceably linked to policies, standards and legal requirements. OSCAL provides a common layer to continuously track the implementation and effectiveness of each control. The result is a shift from preparing for audits as one-off exercises to demonstrating an ongoing, living process. When facing an ISO 27001 audit or a customer request, traceability, evidence and the evolution of each control are already in place. Networking Hub

Tue 3

16:00h - 16:30h Networking Hub Public Access

16:30h

Side Event | Side Event AI, identity and trust in the digital environment CISOs & Security Leader IT & Infrastructure

Nobody Reads 40,000 Vulnerability Findings

Gerardo Prieto MessemerTech OÜ CISO Speaker

#HumanInTheLoop, #Remediation

2026-11-03 16:30 2026-11-03 17:00 Europe/Madrid Nobody Reads 40,000 Vulnerability Findings Handing the backlog to a chain of AI agents — and knowing when to stop and ask a human. Detection was never the bottleneck. Triage, ownership, chasing and retesting are. This session walks through an agentic pipeline that takes a finding — whether it came from a cloud scanner, a SAST tool, an endpoint agent or a pentest report — all the way to a verified fix. Contextual severity scoring, one agent independently checking another's work, and the hard part: knowing when the automation is confident and when a human still has to decide. Networking Hub

Tue 3

16:30h - 17:00h Networking Hub Public Access

17:00h

Side Event | Side Event

Barcelona CyberSec Networking

2026-11-03 17:00 2026-11-03 18:00 Europe/Madrid Barcelona CyberSec Networking Keep the conversation going: an hour to follow up with the speakers, swap notes with peers and meet Barcelona's cybersecurity community. Networking Hub

Tue 3

17:00h - 18:00h Networking Hub Public Access

10:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Cybersecurity. Business. Disruption. New angles for a new era

Xavier Vila ISACA Barcelona Board Member Speaker

Schedule

10:00h - 10:15h

Welcome and introductions

Ramsés Gallego ISACA Barcelona Chapter President Host

10:15h - 11:00h

At the DNA of every company: Identity and Access Management

Ramsés Gallego ISACA Barcelona Chapter President Speaker

11:00h - 11:45h

It’s not Machine Learning. It’s Human Teaching!

Ramsés Gallego ISACA Barcelona Chapter President Speaker

11:45h - 12:15h

Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026

Théo Nottelet ISACA Regional Development Manager Iberian Market Speaker

12:15h - 13:00h

AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach

Xavier Vila ISACA Barcelona Board Member Speaker

13:00h - 13:45h

Protecting and defending at machine speed. A New Beginning

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 10:00 2026-11-03 13:45 Europe/Madrid Cybersecurity. Business. Disruption. New angles for a new era

- At the DNA of every company: Identity and Access Management

- Building and running a SOC… from scratch

- Privacy as the pillar of every society

- The Perfect Storm: Threats & Risks IN the Cloud, FROM the Cloud, THROUGH the Cloud

- It’s not Machine Learning. It’s Human Teaching!

Level 0 - Room 2.1

Tue 3

10:00h - 13:45h Level 0 - Room 2.1 Public Access

10:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Welcome and introductions

Ramsés Gallego ISACA Barcelona Chapter President Host

2026-11-03 10:00 2026-11-03 10:15 Europe/Madrid Welcome and introductions text Level 0 - Room 2.1

Tue 3

10:00h - 10:15h Level 0 - Room 2.1 Public Access

10:15h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

At the DNA of every company: Identity and Access Management

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 10:15 2026-11-03 11:00 Europe/Madrid At the DNA of every company: Identity and Access Management There is one discipline that connects customers and products; one technology that build bridges between users and data; one IT angle that links employers and employees. This very dimension sits at the core of every organization and it is critical to understand who has access to what, how the access was granted, for how long, from where to where. There is one business need that is covered by the approach of providing full control and visibility on who is touching sensitive data and it is instrumental for the success of the risk management function. This is Identity Management and Access Governance and it should be the foundations for any Security program and has to do with design, architecture and even beauty. This is the opportunity for righting a wrong and providing answers to the business. This should be how we govern our an Enterprise IT. The DNA of company that connects and builds. Level 0 - Room 2.1

Tue 3

10:15h - 11:00h Level 0 - Room 2.1 Public Access

11:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

It’s not Machine Learning. It’s Human Teaching!

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 11:00 2026-11-03 11:45 Europe/Madrid It’s not Machine Learning. It’s Human Teaching! We humans have made a gigantic leap in the use of technology and are living through times where everything is almost possible. We have nurtured technologies that amplify and expand our reach and multiply the ways we can get to a solution. We have created artificial intelligence that is almost indistinguishable from human nature and, whether we like it or not, more capable in many, many tasks. One of them is cybersecurity and the discovery of patterns ‘hidden’ in a communication. The time has arrived for us to present the moral and ethical questions in the use of artificial intelligence and machine learning. The moment has come to wonder about the limits -if any- in the use of these technologies and what the future (of now) will be holding for us. Since, at the end of the day, it’s not the machines that are learning… but us. It’s not Machine Learning but how we, the people, teach machines the right way. Level 0 - Room 2.1

Tue 3

11:00h - 11:45h Level 0 - Room 2.1 Public Access

12:15h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach

Xavier Vila ISACA Barcelona Board Member Speaker

2026-11-03 12:15 2026-11-03 13:00 Europe/Madrid AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach text Level 0 - Room 2.1

Tue 3

12:15h - 13:00h Level 0 - Room 2.1 Public Access

13:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Protecting and defending at machine speed. A New Beginning

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 13:00 2026-11-03 13:45 Europe/Madrid Protecting and defending at machine speed. A New Beginning text Level 0 - Room 2.1

Tue 3

13:00h - 13:45h Level 0 - Room 2.1 Public Access

11:45h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026

Théo Nottelet ISACA Regional Development Manager Iberian Market Speaker

2026-11-03 11:45 2026-11-03 12:15 Europe/Madrid Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026 text Level 0 - Room 2.1

Tue 3

11:45h - 12:15h Level 0 - Room 2.1 Public Access

10:00h

Side Event | Side Event

The CISO no longer makes decisions alone

Juan Ma Perals Global CISO Council Spain Chapter President / Founder Speaker

Iñaki Aldaz Global CISO Council Spain Chapter, Ajuntament de Sant Cugat del Vallès Police Inspector, Leadership & Public Safety Specialist Speaker

2026-11-03 10:00 2026-11-03 11:00 Europe/Madrid The CISO no longer makes decisions alone Official presentation of the Global CISO Council Spain Chapter, its purpose, working model and collaboration initiatives with the CISO community in Spain. The session will conclude with an opportunity for discussion and networking. Level 0 - Room 2.1

Tue 3

10:00h - 11:00h Level 0 - Room 2.1 Public Access

Wed 04

12:00h

Side Event | Side Event Systemic, cyber-physical and supply chain resilience CISOs & Security Leader IT & Infrastructure

ISC2 Community & Professional Development Forum

Alejandro Cadarso ISC2 Spain Chapter / Field CTO President Host

Néstor Angulo ISC2 Spain Chapter / CISSP Head of Technology Moderator

Sebastián Correas ISS & GRC Consultant / CISSP / CCSSP / ISO27001 & ISO 42001 Lead Auditor Speaker

Mykhailo Sindieiev DevSecOps Engineer / OWASP Barcelona Leader Speaker

#Ciberseguridad, #ISC2, #ISC2Spain, #OWASP, #SBOM

2026-11-04 12:00 2026-11-04 13:30 Europe/Madrid ISC2 Community & Professional Development Forum ISC2 Spain Chapter is organising this 90-minute session to share updates on the Chapter’s development, its certification initiatives, continuing education and professional development activities, and to host a collaborative roundtable with OWASP. The roundtable, entitled “SBOM: The Foundation for Secure Development, Vulnerability Management, and Compliance”, will explore software supply chain security and Software Bills of Materials (SBOMs) in the context of the CRA (Cyber Resilience Act) and NIS2, offering a practical perspective on vulnerabilities and open-source risk management. An open space to learn, exchange experiences and strengthen the professional cybersecurity community. Networking Hub

Wed 4

12:00h - 13:30h Networking Hub Public Access

17:00h

Side Event | Side Event

Help securing the future. Community projects you can participate in

Mykhailo Sindieiev DevSecOps Engineer / OWASP Barcelona Leader Speaker

Andrés Galarza AstraZeneca Manager Speaker

2026-11-04 17:00 2026-11-04 18:30 Europe/Madrid Help securing the future. Community projects you can participate in In this session the chapter leaders of OWASP Barcelona give an overview of the community projects, and explain how you can contribute. OWASP is the Open World Application Security Project that drives application security for the software industry. The most well known project is the OWASP TOP 10 but there are hundereds of projects ranging from tools, industry standards and guides. Covering topics such as LLM security, AI agent secutity, supply chain management ,API security, process maturity, cheat sheets and much more. OWASP is a non profit foundation and everything is run by volunteers, you are invited to contribute and turbocharge your carreer in the community of experts. Networking Hub

Wed 4

17:00h - 18:30h Networking Hub Public Access

12:30h

Side Event | Side Event

Should cybersecurity report to the CIO or directly to the CEO?

2026-11-04 12:30 2026-11-04 14:00 Europe/Madrid Should cybersecurity report to the CIO or directly to the CEO? Cybersecurity is increasingly a strategic business risk management issue, rather than solely a technological one. In this context, should the CISO report to the CIO or directly to the CEO? While reporting to the CIO facilitates coordination with Technology, reporting directly to the CEO strengthens the independence and visibility of the security function. This raises the question of whether a model in which the CISO works closely with the CIO while having direct access to the CEO to escalate critical risks and incidents offers the best balance. Networking Hub

Wed 4

12:30h - 14:00h Networking Hub Public Access

10:00h

Side Event | Side Event CISOs & Security Leader

CISO FORUM: Securing Cities and Critical Infrastructure

2026-11-04 10:00 2026-11-04 11:30 Europe/Madrid CISO FORUM: Securing Cities and Critical Infrastructure An exclusive roundtable bringing together cybersecurity leaders from city councils, public institutions and critical infrastructure operators to exchange experiences, challenges and best practices. Through an open discussion, participants will explore topics such as OT security, cyber resilience, crisis management, interdependencies and cross-sector collaboration. Level 1 - Room 2.5

Wed 4

10:00h - 11:30h Level 1 - Room 2.5 Invitation required

15:00h

Side Event | Side Event AI, identity and trust in the digital environment

Securing AI Agents: What could go wrong? A hands-on session for understainng threats and how to mitigate them

Sebastián Correas ISS & GRC Consultant / CISSP / CCSSP / ISO27001 & ISO 42001 Lead Auditor Speaker

Simone Onofri W3C Security Lead Speaker

Mila Gerova Threat Modeling Connect Chapter Lead Speaker

2026-11-04 15:00 2026-11-04 17:00 Europe/Madrid Securing AI Agents: What could go wrong? A hands-on session for understainng threats and how to mitigate them

What could go wrong when an AI agent acts on your behalf, such as reading and using a Web?

In this interactive session, Threat Modeling Connect (TMC) will introduce its community and show how threat modeling helps us examine emerging AI technologies. Using agentic AI and WebMCP as a practical case, we'll share a few threats already identified in ongoing work, then invite participants to hands-on facilitated activities o challenge the model, find gaps, and discuss possible responses.

We'll close by looking at what evidence is needed to support AI risk management and, where applicable, EU AI Act compliance. No prior threat modeling experience is needed. Bring your perspective and see how you can contribute.

Networking Hub

Wed 4

15:00h - 17:00h Networking Hub Public Access

10:00h

Side Event | Side Event

CyberHub Spain National Conference: Cybersecurity in the face of the new technological landscape

Schedule

10:00h - 10:10h

Opening

Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Speaker

10:10h - 10:40h

Panel 1. European and Spanish cybersecurity strategy

Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Moderator

José Martínez-Usero DIGITALEUROPE Director for Projects Speaker

Daniel Burgos UNIR Vicerrector. Catedrático de Tecnologías para la Educación y la Comunicación, Vicerrector de Proyecto Speaker

Krzysztof Szubert European Cyber Security Organisation (ECSO) Board of Directors Speaker

11:00h - 11:40h

Panel 2. The business challenge: Capabilities, talent, and resilience

Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker

David Garriga Sirt CEO Speaker

Javier Zubieta AMETIC Presidente Comisión de Ciberseguridad Moderator

Jordi Ubach CyberTix Speaker

11:40h - 12:10h

Panel 3. AI and quantum computing: The new technological landscape

Iván Gutiérrez Tecnalia Responsable de Frontier Cybersecurity Speaker

Victor Canivell Qilimanjaro Founder and Chairman Speaker

Ángel López Airbus Cyber Technical Manager Speaker

12:10h - 12:30h

Closing

Paco Hortigüela Martos AMETIC Presidente Speaker

12:30h - 13:00h

Networking

2026-11-04 10:00 2026-11-04 13:00 Europe/Madrid CyberHub Spain National Conference: Cybersecurity in the face of the new technological landscape

Cybersecurity is facing a technological landscape undergoing profound transformation. The emergence of artificial intelligence, advances in technologies such as quantum computing, and the evolution of cyber threats are reshaping the capabilities required by businesses, public administrations, and professionals.

The Cyberhubs Spain National Conference will bring together representatives from institutions, industry, academia, and the technology ecosystem to analyse the key challenges and opportunities facing the sector in Spain and Europe.

The event will explore the evolution of cybersecurity strategies, the development of skills and talent, and the impact of AI and other emerging technologies on the future of cybersecurity. It will provide a space to share experiences, identify needs, and strengthen collaboration among the different stakeholders across the ecosystem.

Level 0 - Room 2.1

Wed 4

10:00h - 13:00h Level 0 - Room 2.1 Public Access

10:00h

Side Event | Side Event

Opening

Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Speaker

2026-11-04 10:00 2026-11-04 10:10 Europe/Madrid Opening Institutional welcome and introduction to the CyberHubs Spain National Conference, presenting the objectives of the event and the key challenges facing the cybersecurity ecosystem. Level 0 - Room 2.1

Wed 4

10:00h - 10:10h Level 0 - Room 2.1 Public Access

10:10h

Side Event | Side Event

Panel 1. European and Spanish cybersecurity strategy

Albert Anglarill Recasens AMETIC Director Territorial y de Proyectos Moderator

José Martínez-Usero DIGITALEUROPE Director for Projects Speaker

Daniel Burgos UNIR Vicerrector. Catedrático de Tecnologías para la Educación y la Comunicación, Vicerrector de Proyecto Speaker

Krzysztof Szubert European Cyber Security Organisation (ECSO) Board of Directors Speaker

2026-11-04 10:10 2026-11-04 10:40 Europe/Madrid Panel 1. European and Spanish cybersecurity strategy An analysis of European and national cybersecurity priorities, as well as coordination between institutions, industry, and the wider ecosystem to strengthen capabilities and develop talent in this field. Level 0 - Room 2.1

Wed 4

10:10h - 10:40h Level 0 - Room 2.1 Public Access

11:00h

Side Event | Side Event

Panel 2. The business challenge: Capabilities, talent, and resilience

Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker

David Garriga Sirt CEO Speaker

Javier Zubieta AMETIC Presidente Comisión de Ciberseguridad Moderator

Jordi Ubach CyberTix Speaker

2026-11-04 11:00 2026-11-04 11:40 Europe/Madrid Panel 2. The business challenge: Capabilities, talent, and resilience A discussion on the cybersecurity challenges facing businesses, with a particular focus on talent needs, capability development, and resilience, taking into account the different realities of large companies and SMEs. Level 0 - Room 2.1

Wed 4

11:00h - 11:40h Level 0 - Room 2.1 Public Access

11:40h

Side Event | Side Event

Panel 3. AI and quantum computing: The new technological landscape

Iván Gutiérrez Tecnalia Responsable de Frontier Cybersecurity Speaker

Victor Canivell Qilimanjaro Founder and Chairman Speaker

Ángel López Airbus Cyber Technical Manager Speaker

2026-11-04 11:40 2026-11-04 12:10 Europe/Madrid Panel 3. AI and quantum computing: The new technological landscape A discussion on the impact of artificial intelligence and quantum computing on cybersecurity, the new challenges posed by these technologies, and the opportunities they offer to develop new capabilities and solutions. Level 0 - Room 2.1

Wed 4

11:40h - 12:10h Level 0 - Room 2.1 Public Access

12:10h

Side Event | Side Event

Closing

Paco Hortigüela Martos AMETIC Presidente Speaker

2026-11-04 12:10 2026-11-04 12:30 Europe/Madrid Closing Conclusions and closing remarks by Paco Hortigüela, President of AMETIC. Level 0 - Room 2.1

Wed 4

12:10h - 12:30h Level 0 - Room 2.1 Public Access

12:30h

Side Event | Side Event

Networking

2026-11-04 12:30 2026-11-04 13:00 Europe/Madrid Networking An opportunity for attendees to connect and exchange ideas, share experiences, and foster new collaboration opportunities. Level 0 - Room 2.1

Wed 4

12:30h - 13:00h Level 0 - Room 2.1 Public Access

16:00h

Side Event | Side Event

Agents that act, humans that respond

José Manuel Tejedor Lloria Global CISO Council Spain Chapter Vice President – Finance Moderator

Eva Puerta Pérez Global CISO Council Spain Chapter Vice President – Academia Speaker

Rubén Cortés Domingo Global CISO Council Spain Chapter Advisory Board Member Speaker

Xavier Duch Global CISO Council Spain Chapter Advisory Board Member Speaker

2026-11-04 16:00 2026-11-04 17:30 Europe/Madrid Agents that act, humans that respond

Artificial intelligence is moving beyond assisting people to taking action. Systems already exist that can use tools, access data, trigger processes, and operate with real permissions.

Level 0 - Room 2.2

Wed 4

16:00h - 17:30h Level 0 - Room 2.2 Public Access

Thu 05

10:00h

Side Event | Side Event

Breaking trust: Internal desktop apps and the AppStream illusion

2026-11-05 10:00 2026-11-05 11:00 Europe/Madrid Breaking trust: Internal desktop apps and the AppStream illusion

Desktop applications have fallen out of the spotlight in the AI era, yet they remain deeply embedded in the internal infrastructure of countless companies and research labs, often running with elevated trust and minimal scrutiny.

This talk examines the security posture of desktop applications through the lens of Tier2 vs. Tier3 architectures, breaking down the structural weaknesses inherent to each model. Through real-world case studies, we'll walk through practical exploitation of common vulnerability classes (including login bypass, authentication bypass, and insecure deserialization), demonstrating how these flaws are found and abused in production environments.

We'll then examine standard remediation strategies for these vulnerabilities and discuss their inherent limitations. Finally, we'll dig into a widely adopted mitigation pattern: using application virtualization platforms like AppStream or Citrix to "convert" a Tier2 application into a Tier3-equivalent deployment.

We'll critically assess whether this approach constitutes a genuine architectural fix. Spoiler: it doesn't always hold up, and we'll show how it can be bypassed.

Level 0 - Room 2.1

Thu 5

10:00h - 11:00h Level 0 - Room 2.1 Public Access

11:00h

Side Event | Side Event

Return of Sedinho: Current situation and new tactics of the Brazilian banking trojan ecosystem

2026-11-05 11:00 2026-11-05 12:00 Europe/Madrid Return of Sedinho: Current situation and new tactics of the Brazilian banking trojan ecosystem During several years we have been tracking the evolution of Brazilian banking trojans, their expansion into countries well beyond their original sphere of influence, and the law enforcement operations that attempted to disrupt their activity. Building on that work, this talk revisits the current landscape and examines the latest improvements and changes introduced by the malware operators behind these groups. In this session, we will analyze several recent financially motivated campaigns that show how Latin American threat actors are not only evolving classic banking malware, but also introducing NFC based mobile fraud against victims in multiple countries. We will provide concrete examples of how well known families such as Grandoreiro and Casbaneiro are refining both their techniques and their social engineering narratives while continuously adapting their malware infection chains and evasion strategies. We will also introduce their newest Android campaigns that leverage NFC fraud through a new NGate variant that masquerades as legitimate applications intended to relay NFC card data between devices. Cybercriminals distribute these trojanized apps under various pretexts, including online banking tools, lottery apps, and shopping applications. Once installed, the malware intercepts NFC payment card data and the victim's PIN, forwarding them to attacker controlled infrastructure to enable contactless ATM cash outs and fraudulent POS transactions, all without requiring additional risky permissions. Throughout the talk, we will walk through the observed tactics, techniques, and procedures, highlighting how the malware code, supporting infrastructure, and social engineering patterns have changed compared to the campaigns we analyzed previously. Our goal is to raise awareness of the ongoing evolution of these Latin American originated malware operations and to equip security teams with the context they need to detect and block these threats before they can cause damage to their organizations. Level 0 - Room 2.1

Thu 5

11:00h - 12:00h Level 0 - Room 2.1 Public Access

12:00h

Side Event | Side Event

Las vulnerabilidades que no te quita la IA

2026-11-05 12:00 2026-11-05 13:00 Europe/Madrid Las vulnerabilidades que no te quita la IA La IA está cambiando la forma de realizar auditorías y Bug Bounty, pero hay vulnerabilidades que siguen requiriendo algo que ningún modelo puede automatizar por completo: experiencia, creatividad y una comprensión profunda del comportamiento de una aplicación. En esta charla nos olvidaremos de los fallos más comunes que la IA ya es capaz de encontrar y nos centraremos en bugs concretos y poco convencionales que todavía requieren una mirada humana. A través de mi experiencia con docenas de vulnerabilidades reportadas antes y después de la llegada de la IA, veremos cómo la especialización puede convertirse en una ventaja frente a otros hackers y frente a la propia inteligencia artificial. Analizaremos ejemplos reales de vulnerabilidades y técnicas de explotación que he encontrado en auditorías y programas de Bug Bounty, y cómo desarrollar una metodología para descubrir aquello que otros pasan por alto. Level 0 - Room 2.1

Thu 5

12:00h - 13:00h Level 0 - Room 2.1 Public Access

11:00h

Side Event | Side Event

The cyber-AI paradox: Why research must simultaneously advance AI-based defense and secure the AI pipeline

Shuaib Siddiqui Cybersecurity & Blockchain Research Group Director Speaker

Josep Pegueroles UPC-ETSETB Professor Speaker

Pere Tuset-Peiró Professor of Computer Networks & Cybersecurity Speaker

2026-11-05 11:00 2026-11-05 12:30 Europe/Madrid The cyber-AI paradox: Why research must simultaneously advance AI-based defense and secure the AI pipeline

Artificial Intelligence is rapidly transforming cybersecurity, providing new capabilities to detect threats, automate analysis, and respond to increasingly sophisticated attacks. At the same time, the growing adoption of AI introduces a new and complex attack surface: the AI pipeline itself.

This dual challenge—the Cyber-AI paradox—is at the core of the research carried out by GREC, the Cognitive Cybersecurity Research Group, which brings together researchers from i2CAT, UPC, and UOC. The group approaches AI and cybersecurity from two complementary directions: using AI to strengthen cyber defense, while simultaneously ensuring that AI systems and their entire pipelines are secure, trustworthy, and resilient.

During the session, we will present the main research lines currently being explored by GREC and showcase some of the work carried out in these areas, ranging from AI-driven approaches for threat detection and cyber defense to the identification and mitigation of security risks affecting AI models, data, and infrastructures.

The talk will provide an overview of the challenges, ongoing research, and lessons learned at the intersection of AI and cybersecurity, highlighting why advancing AI-based defense and securing the AI pipeline must be addressed together to build the next generation of resilient digital infrastructures.

Networking Hub

Thu 5

11:00h - 12:30h Networking Hub Public Access

Side Event

#BCC26

October is Cyber Month.