People remain the biggest target – yet artificial intelligence is taking social engineering to a whole new level. Deceptively realistic voice clones, AI-generated deepfakes and hyper-personalised phishing campaigns are rendering traditional awareness training increasingly ineffective.

The panel will discuss how organisations can protect themselves against AI-enabled attacks when identities can be manipulated and communication is no longer reliably authentic. The focus will be on new defensive approaches, ranging from identity verification and zero-trust communication to organisational safeguards that go beyond mere training.

Brain–Computer Interfaces are moving from lab to street, turning the human brain into a new data source and marking the shift from cyber-security to neuro-security. This keynote examines what BCIs mean for policing and justice — the opportunities, the threats of neural-data misuse, and the human-rights stakes around mental privacy and cognitive liberty — and makes the case for legal boundaries, oversight, and international cooperation before neuro-enabled crime arrives.

Artificial intelligence is no longer merely a tool, but an active player in cyberspace. Whilst defensive AI detects anomalies in real time, automates incident response and enables security operations centres to operate with increasing autonomy, attackers are developing AI-powered exploits, generative malware and adaptive attack campaigns that dynamically adapt to defensive mechanisms.

The panel will examine the new reality of an AI-driven arms race: just how resilient are autonomous SOCs really? Will AI agents themselves become a target? And how great is the risk posed by model manipulation, data poisoning or prompt injection? The discussion will focus on where automation makes sense, where human control remains indispensable, and whether we are heading towards a future in which machines fight each other whilst humans merely monitor.

Digital supply chains have long since become a strategic target. With NIS2, the Cyber Resilience Act and stricter transparency requirements, the focus is increasingly shifting from technical security to the issue of responsibility and liability. Today, companies must not only manage third-party risks, but also ensure that their entire software and OT landscape is resilient and ‘secure by design’.

The panel will discuss how supply chain security, software liability and regulatory requirements can be implemented in practice – from SBOMs and open-source risks to the protection of critical infrastructure. The focus will be on how trust in networked ecosystems must be redefined when it can become the greatest vulnerability.

Authorities log data, monitor networks and analyse threat intelligence – NIS2 makes this mandatory. But are authorities also permitted to demonstrate that their security measures are actually effective? This is precisely where a gap exists that is rarely discussed in practice. Using Bavaria as an example, the presentation demonstrates just how precisely the BayDiG regulates monitoring by the State Office for Information Security – with a narrow purpose, strict retention periods and clear boundaries. Surprisingly, even the State Office itself comes up against these boundaries as soon as it seeks to quantify its own successes: how many attacks have been thwarted, and how effective are the measures in place?

The presentation explores whether a new legal basis is required for this, or whether the more pragmatic approach is closer at hand than one might initially think. It is precisely this precision that becomes a challenge as soon as other authorities wish to use the same data to evaluate the effectiveness of their security measures: is the GDPR sufficient for this? Is a different legal basis required? And where does Article 89 of the GDPR, with its requirements on anonymisation and pseudonymisation, come into play? A look at Hesse and Baden-Württemberg shows that the Bavarian example is not unique. The presentation provides clear, practical guidance for anyone who wishes to view cybersecurity monitoring and data protection not as opposing concepts, but as a task to be tackled jointly.

When AI attacks and defends autonomously, geopolitical conflicts escalate digitally and supply chains become politicised, an uncomfortable question arises: are we still striving for security – or merely for damage control?

An international panel takes an honest look ahead and discusses what strategic decisions need to be made today to ensure that by 2030 we are not just compliant, but truly resilient.

The traditional Security Operations Centre is on the cusp of a fundamental transformation. AI-powered detection, automated response playbooks and agent-based systems are taking on an increasing number of operational tasks. The key question is no longer whether the SOC is operated internally or externally – but how autonomous it can be.
This panel will discuss how ‘AI-first’ architectures, autonomous decision-making processes and new MDR models are transforming security operations. What role remains for humans in the ‘human-in-the-loop’ model? Where are the limits of automation? And when does efficiency become a new risk?
The focus is on the strategic evolution of security operations away from reactive alarm management towards adaptive, semi-autonomous cyber defence.

How information security can be strategically developed over the course of a year: through clear governance, effective security operations, robust IT business continuity management (BCM) and enhanced incident response processes. Honest lessons learnt from real-world transformation experience show why effective information security requires, above all, clarity regarding responsibilities, risks and operational capability.

The question is no longer whether quantum computers can break cryptographic methods – but how long existing systems will remain secure. As the first post-quantum algorithms are being standardised and implemented, businesses face a complex challenge: how can they migrate without operational risks?

This panel discusses concrete roadmaps for the post-quantum transformation – from crypto inventories and risk assessment through hybrid cryptography models to long-term migration strategies. The focus is on practical implementation: Which systems need to be migrated first? How significant is the ‘harvest now, decrypt later’ risk really? And how can organisations ensure that the migration itself does not become a security vulnerability?

With the widespread integration of copilots, agent-based automation and self-executing workflows, new digital actors are emerging within organisations. These systems make decisions, access data and carry out actions – often with far-reaching permissions.

The panel will discuss the new security landscape: how can AI agents that act autonomously be secured? What risks arise from prompt injection, tool abuse or manipulated training data? And how can organisations prevent autonomous systems from becoming invisible attack surfaces?

The focus is on governance models for agent-based systems, identity and rights concepts for machine agents, and strategies to ensure that innovation is not achieved at the cost of losing control.

Whilst security strategies have focused on human identities for years, the number of non-human identities is growing exponentially. Workloads, containers, APIs, bots and autonomous systems are constantly communicating with one another – secured by certificates, tokens and secrets that are often created and expire unchecked.

This panel explores the growing challenges surrounding workload and API identities, secret sprawl and ‘certificate chaos’. How do organisations keep track of millions of machine identities? What role do identity fabrics, automated certificate lifecycle management and zero-trust architectures play? And how do organisations prevent expired certificates or compromised secrets from becoming systemic vulnerabilities?

The focus is on the question of how identity security can be reimagined now that machines have long since become the majority of actors on the network.

Cyber risks are no longer purely an IT issue, but affect the entire organisation at a strategic level. With increasing regulation and a growing threat landscape, the question arises as to how companies can clearly define responsibilities and effectively allocate them between the CISO, CRO and CIO.

The panel will examine how governance models, decision-making structures and responsibilities need to be designed to manage cyber and resilience risks holistically. The focus will be on who ultimately bears responsibility – and how collaboration at C-level works in practice.