Back | Home Agenda

Download PDF

Track: Cybersecurity as a strategic business and reputational risk

Tue 03

13:05h

Conference | Congress Cybersecurity as a strategic business and reputational risk CISOs & Security Leader

Sunburst — Taking luck out of incident response

Tim Brown Team8 Partner and CISO in Residence Speaker

2026-11-03 13:05 2026-11-03 13:30 Europe/Madrid Sunburst — Taking luck out of incident response

In 2020, the Russian SVR compromised SolarWinds' Orion build pipeline, and roughly 18,000 organizations downloaded the tainted update. Tim Brown, former CISO of SolarWinds, shares his first-person account of leading the response to SUNBURST, the SEC charges that followed, and five years to vindication.

Brown has often called that response lucky — the right help arrived, the team stayed aligned, transparency was a situational call rather than a plan, and the tabletop exercises they'd run hadn't covered this scenario. It worked, but it worked because of people and circumstance no organization can count on twice.

This keynote moves from that manual, human-driven response to what's possible today: how agentic AI is changing incident detection, triage, and response, and what it takes to replace luck with design — rehearsed, scenario-flexible playbooks and tooling that don't depend on who happens to be in the room when the call comes in.

Auditorium II

Tue 3

13:05h - 13:30h Auditorium II Full Congress Pass

13:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Protecting and defending at machine speed. A New Beginning

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 13:00 2026-11-03 13:45 Europe/Madrid Protecting and defending at machine speed. A New Beginning text Level 0 - Room 2.1

Tue 3

13:00h - 13:45h Level 0 - Room 2.1 Public Access

11:45h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026

Théo Nottelet ISACA Regional Development Manager Iberian Market Speaker

2026-11-03 11:45 2026-11-03 12:15 Europe/Madrid Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026 text Level 0 - Room 2.1

Tue 3

11:45h - 12:15h Level 0 - Room 2.1 Public Access

11:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

It’s not Machine Learning. It’s Human Teaching!

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 11:00 2026-11-03 11:45 Europe/Madrid It’s not Machine Learning. It’s Human Teaching! We humans have made a gigantic leap in the use of technology and are living through times where everything is almost possible. We have nurtured technologies that amplify and expand our reach and multiply the ways we can get to a solution. We have created artificial intelligence that is almost indistinguishable from human nature and, whether we like it or not, more capable in many, many tasks. One of them is cybersecurity and the discovery of patterns ‘hidden’ in a communication. The time has arrived for us to present the moral and ethical questions in the use of artificial intelligence and machine learning. The moment has come to wonder about the limits -if any- in the use of these technologies and what the future (of now) will be holding for us. Since, at the end of the day, it’s not the machines that are learning… but us. It’s not Machine Learning but how we, the people, teach machines the right way. Level 0 - Room 2.1

Tue 3

11:00h - 11:45h Level 0 - Room 2.1 Public Access

12:15h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach

Xavier Vila ISACA Barcelona Board Member Speaker

2026-11-03 12:15 2026-11-03 13:00 Europe/Madrid AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach text Level 0 - Room 2.1

Tue 3

12:15h - 13:00h Level 0 - Room 2.1 Public Access

10:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Welcome and introductions

Ramsés Gallego ISACA Barcelona Chapter President Host

2026-11-03 10:00 2026-11-03 10:15 Europe/Madrid Welcome and introductions text Level 0 - Room 2.1

Tue 3

10:00h - 10:15h Level 0 - Room 2.1 Public Access

10:15h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

At the DNA of every company: Identity and Access Management

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 10:15 2026-11-03 11:00 Europe/Madrid At the DNA of every company: Identity and Access Management There is one discipline that connects customers and products; one technology that build bridges between users and data; one IT angle that links employers and employees. This very dimension sits at the core of every organization and it is critical to understand who has access to what, how the access was granted, for how long, from where to where. There is one business need that is covered by the approach of providing full control and visibility on who is touching sensitive data and it is instrumental for the success of the risk management function. This is Identity Management and Access Governance and it should be the foundations for any Security program and has to do with design, architecture and even beauty. This is the opportunity for righting a wrong and providing answers to the business. This should be how we govern our an Enterprise IT. The DNA of company that connects and builds. Level 0 - Room 2.1

Tue 3

10:15h - 11:00h Level 0 - Room 2.1 Public Access

10:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk

Cybersecurity. Business. Disruption. New angles for a new era

Xavier Vila ISACA Barcelona Board Member Speaker

Schedule

10:00h - 10:15h

Welcome and introductions

Ramsés Gallego ISACA Barcelona Chapter President Host

10:15h - 11:00h

At the DNA of every company: Identity and Access Management

Ramsés Gallego ISACA Barcelona Chapter President Speaker

11:00h - 11:45h

It’s not Machine Learning. It’s Human Teaching!

Ramsés Gallego ISACA Barcelona Chapter President Speaker

11:45h - 12:15h

Navigating the future: Cybersecurity Trends and ISACA Certifications for 2026

Théo Nottelet ISACA Regional Development Manager Iberian Market Speaker

12:15h - 13:00h

AI, PQC and the overloaded CISO: From exhausted gatekeeper to ecosystem coach

Xavier Vila ISACA Barcelona Board Member Speaker

13:00h - 13:45h

Protecting and defending at machine speed. A New Beginning

Ramsés Gallego ISACA Barcelona Chapter President Speaker

2026-11-03 10:00 2026-11-03 13:45 Europe/Madrid Cybersecurity. Business. Disruption. New angles for a new era

- At the DNA of every company: Identity and Access Management

- Building and running a SOC… from scratch

- Privacy as the pillar of every society

- The Perfect Storm: Threats & Risks IN the Cloud, FROM the Cloud, THROUGH the Cloud

- It’s not Machine Learning. It’s Human Teaching!

Level 0 - Room 2.1

Tue 3

10:00h - 13:45h Level 0 - Room 2.1 Public Access

16:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Systemic, cyber-physical and supply chain resilience Compliance & Data Protection

From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

Harald Messemer MessemerTech OÜ SO 27001 Lead Auditor Speaker

#ComplianceAsCode, #ContinuousAssurance, #ISO27001, #OSCAL, #SGSI

2026-11-03 16:00 2026-11-03 16:30 Europe/Madrid From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL The ISMS and ISO 27001 are often perceived as bureaucratic processes disconnected from day-to-day cybersecurity operations. This talk proposes a different approach: integrating the ISMS into development and operations pipelines until it becomes part of the operational model. The key is to build systems that generate structured, signed evidence, traceably linked to policies, standards and legal requirements. OSCAL provides a common layer to continuously track the implementation and effectiveness of each control. The result is a shift from preparing for audits as one-off exercises to demonstrating an ongoing, living process. When facing an ISO 27001 audit or a customer request, traceability, evidence and the evolution of each control are already in place. Networking Hub

Tue 3

16:00h - 16:30h Networking Hub Public Access

15:30h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

Jornada Anual DCA Ciberseguretat

Alba Barrientos DCA Gestora de la Comunitat Ciberseguretat Host

José Nicolás Castellano Cybersecurity Consultant Speaker

Xavier Pi UPC School Co-director Máster Industria 4.0 Speaker

Olga Sánchez Caixabank IT Manager Speaker

Barbara Eisele DCA Gestora Blockchain Speaker

2026-11-03 15:30 2026-11-03 17:30 Europe/Madrid Jornada Anual DCA Ciberseguretat La comunitat de ciberseguretat de la Digital Catalonia Alliance (DCA) celebra la seva jornada anual en el marc del Barcelona Cybersecurity Congress, un punt de trobada per a empreses, professionals i agents de l’ecosistema digital. La sessió donarà visibilitat a solucions tecnològiques innovadores en els àmbits de la ciberseguretat i el blockchain, i abordarà els reptes de la confiança digital des de diferents perspectives. El programa inclourà demostracions i casos pràctics, una sessió sobre com s’executa un ciberatac i una taula rodona amb experts en ciberseguretat, compliance i blockchain. La jornada finalitzarà amb un espai de networking per fomentar connexions i noves oportunitats de col·laboració Level 0 - Room 2.1

Tue 3

15:30h - 17:30h Level 0 - Room 2.1 Invitation required

16:20h

Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Improve security posture: Start with your endpoints

Juan José González NinjaOne Level 2 Solutions Engineer Speaker

2026-11-03 16:20 2026-11-03 16:45 Europe/Madrid Improve security posture: Start with your endpoints

Many organizations continue to invest heavily in advanced cybersecurity solutions in efforts to better defend against attacks that are not only increasing in frequency but also becoming more complex and difficult to detect. However, the importance of good cyber hygiene, starting with the endpoint, is often overlooked.

NinjaOne consolidates workflows, reduces silos, and provides a single source of truth for all your security and endpoint data.

Join NinjaOne's Solutions Engineer Juan José González as he demonstrates the power and simplicity of the NinjaOne platform and how it can enable you to achieve these benefits:

Detect and respond to threats faster with real-time visibility and control over your entire IT environment.

Harden endpoints by removing unnecessary software and minimizing your attack surface through automated device configuration at scale.

Make sure systems are always secure and up to date with automated patch management.

Recover quickly in the event of an attack with secure, cloud-based backup.

Auditorium II

Tue 3

16:20h - 16:45h Auditorium II Full Congress Pass

15:45h

Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Assume breach, prepare for recovery: Why data resilience is mandatory for business survival

Miguel Tena Martin Object First Field Sales Engineer Speaker

#BusinessContinuity, #CyberResilience, #DataProtection, #DataResilience, #DisasterRecovery, #Ransomware, #Recovery

2026-11-03 15:45 2026-11-03 16:10 Europe/Madrid Assume breach, prepare for recovery: Why data resilience is mandatory for business survival

Zero Trust teaches us to assume that there’s a breach, but what’s the worst that could happen when there is a breach? And how do you mitigate against that?

Join Miguel Tena, Object First Field Sales Engineer as he discusses why data resilience is critical in the evolving cybersecurity landscape and what that means in practice. Leveraging insights from research on data protection and ransomware trends, Miguel will explore how organisations can prepare for the worst-case scenario: where a cybercriminal has access to all passwords and secrets. Meeting regulatory and cyberinsurance requirements and, ultimately, guaranteeing business survival mean this is no longer ‘just’ an IT topic, it’s a board-level imperative.

Auditorium II

Tue 3

15:45h - 16:10h Auditorium II Full Congress Pass

15:45h

Conference | Congress Cybersecurity as a strategic business and reputational risk IT & Infrastructure

Are you okay, Internet? The state of the internet in 2026

Martijn Grooten Censys Principal Security Researcher Speaker

#AttackSurface, #CyberRisk, #InfrastructureSecurity, #InternetExposure, #InternetSecurity

2026-11-03 15:45 2026-11-03 16:10 Europe/Madrid Are you okay, Internet? The state of the internet in 2026 In this presentation, Censys researcher Martijn Grooten walks through interesting findings from the 2026 Censys State of the Internet report and will answer questions such as: what trends do we see when it comes to Internet-connected services? Who are the major players? What are the vulnerabilities that should concern us? How is the rapid adoption of AI affecting the Internet map. Auditorium I

Tue 3

15:45h - 16:10h Auditorium I Full Congress Pass

Wed 04

16:30h

Awards | Awards Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

The CISO Leadership Awards Ceremony

2026-11-04 16:30 2026-11-04 17:30 Europe/Madrid The CISO Leadership Awards Ceremony 28 of the most influential cybersecurity leaders in Europe and beyond are competing across 7 categories. The winners will be revealed live at Barcelona Cybersecurity Congress on 4 November at 16:30. Make sure you are in the room. Auditorium I

Wed 4

16:30h - 17:30h Auditorium I Full Congress Pass

15:10h

Conference | Hacking Partner Cybersecurity as a strategic business and reputational risk IT & Infrastructure

See NinjaOne in action: Vulnerability remediation in the age of AI-driven exploits

Wladimir Rojo NinjaOne Team Lead Solutions Engineer for EMEA Speaker

2026-11-04 15:10 2026-11-04 15:35 Europe/Madrid See NinjaOne in action: Vulnerability remediation in the age of AI-driven exploits

What you'll see: Live in NinjaOne, watch a vulnerable application get patched on the spot, an endpoint get hardened against real world attack paths like open USB ports and outdated protocols, and a device recovered from a ransomware style incident using backups, all in a matter of minutes.

Why it matters: Endpoints are now where 90% of cyberattacks originate and where 90% of ransomware incidents begin, with endpoint attacks up 300% quarter over quarter and nearly 40,000 new CVEs published last year alone. This session shows attendees exactly how to close that gap before an attacker gets there first.

Auditorium II

Wed 4

15:10h - 15:35h Auditorium II Full Congress Pass

10:45h

Conference | Congress Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem

Rob Harrison Sophos Vice President Speaker

#Accountability, #Compliance, #Compliance&DataProtection, #CyberRegulation, #CyberResilience, #DORA, #Governance, #NIS2, #RiskManagement

2026-11-04 10:45 2026-11-04 11:10 Europe/Madrid No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem Europe's regulators have quietly redrawn the cybersecurity poverty line - the gap between the few organisations that can run security as a system and the millions that have the tools but not the capability to make them work. Under NIS2 and DORA, that gap is no longer a social problem; it's a legal one, and it runs straight through your supply chain. When an under-resourced supplier or ICT provider sits below the line, you inherit both the breach and the regulatory exposure and, increasingly, your board inherits personal liability for it. This session examines how MDR and an agentic SOC scale security operations across 40,000 organizations, and why the harder, unsolved problem is scaling strategy and governance. That's the gap Sophos CISO Advantage is built to close: scaling the judgment of a world-class CISO, continuous control validation, and regulator-ready metrics to organisations with or without a CISO, so they can both deliver their security strategy and prove it, and lift their whole ecosystem above the line. Auditorium I

Wed 4

10:45h - 11:10h Auditorium I Full Congress Pass

Track: Cybersecurity as a strategic business and reputational risk

#BCC26

October is Cyber Month.

Track: Cybersecurity as a strategic business and reputational risk