Cybersecurity supply chains have become one of Europe’s most pressing security challenges. Increasingly sophisticated attacks targeting software dependencies, managed service providers and critical technology suppliers have demonstrated that a single compromised vendor can have cascading consequences across governments, businesses and critical infrastructure. As organisations become increasingly reliant on complex ecosystems of cloud providers, software vendors, telecommunications infrastructure, open source components and AI models, managing third-party risk has become central to Europe’s cybersecurity and economic resilience.

The European Commission’s proposed revision of the Cybersecurity Act (CSA2) represents a significant evolution of Europe’s approach to securing critical ICT supply chains. Alongside the new EU ICT Supply Chain Security Toolbox, the proposal would establish a harmonised framework for assessing critical ICT supply chains, identifying high-risk suppliers and, where necessary, restricting their use across sectors covered by NIS2. For the first time, the Commission proposes Union-level powers to assess non-technical risks linked to foreign ownership, control and influence, moving beyond the fragmented implementation of previous initiatives such as the EU 5G Toolbox. Together, these initiatives seek to strengthen trust, improve transparency and promote a more consistent approach to managing cyber risk across the Single Market, while reducing strategic dependencies and encouraging greater supplier diversification.

As cyber threats continue to evolve and geopolitical tensions reshape global technology markets, important questions remain. How can Europe strike the right balance between security, openness and competitiveness? Will the proposed CSA2 framework provide the consistency and resilience needed to secure Europe’s digital infrastructure, or introduce additional complexity for governments, operators and technology providers?

Possible panel questions:

• How transformative are the ICT supply chain provisions within the proposed Cybersecurity Act?
• To what extent will the new high-risk supplier framework deliver greater consistency than previous initiatives such as the 5G Toolbox?
• What practical implications could the proposed high-risk supplier framework have for public procurement, operators of essential services and technology providers?
• How can organisations improve visibility across increasingly complex supplier ecosystems and reduce concentration risk without significantly increasing costs or slowing innovation?
• What role should certification, standards and international cooperation play in strengthening trusted ICT supply chains?

Europe possesses a vibrant cybersecurity ecosystem, producing world-leading research, innovative startups and globally respected technology companies. Despite these strengths, the block continues to face significant challenges in scaling cybersecurity businesses, attracting investment and translating innovation into globally competitive companies.

As cybersecurity becomes a cornerstone of Europe’s economic security, competitiveness and digital sovereignty, policymakers are increasingly recognising that reducing strategic dependencies requires more than regulation alone. Building a trusted European cybersecurity ecosystem will depend upon stronger industrial policy, greater investment in innovation, improved access to finance, more effective public procurement, a genuine single market for cybersecurity products and services, and continued investment in research, skills and talent.

Initiatives such as the European Cybersecurity Competence Centre (ECCC), the Cyber Resilience Act and the revision of the Cybersecurity Act all seek to strengthen Europe’s cyber capabilities while supporting a more competitive digital economy. At the same time, Europe faces important choices over how to strengthen strategic autonomy without undermining competition, openness or international collaboration. This session will explore how Europe can build a trusted and globally competitive cybersecurity ecosystem capable of supporting long-term innovation, resilience and technological leadership.

Possible panel questions:

• What should European cyber sovereignty mean in practice, and what industrial policies are needed to build globally competitive European cybersecurity champions?
• How can Europe create a genuine single market for cybersecurity by reducing fragmentation in procurement, certification and regulation?
• To what extent can public procurement play a greater role in supporting trusted European cybersecurity providers?
• What are the biggest barriers preventing European cybersecurity startups and scale-ups from competing globally, and how can Europe improve access to investment, accelerate commercialisation and support growth?
• How can governments, industry and academia work together to address Europe’s cybersecurity skills gap?
• What role should open source software, international standards and trusted international partnerships play in strengthening Europe’s cybersecurity ecosystem while supporting Europe’s strategic autonomy?

Cyber threats are becoming faster, more sophisticated and increasingly interconnected. From ransomware and AI-enabled attacks to supply chain compromises and state-sponsored operations, incidents now spread rapidly across borders and sectors, making collective preparedness and coordinated response more important than ever. As critical infrastructure operators become more digitally interconnected and operational technology environments face growing cyber risks, strengthening resilience across essential sectors has become a strategic priority for Europe.

Through initiatives including NIS2, the Cyber Solidarity Act, the Critical Entities Resilience (CER) Directive, the revised EU Cybersecurity Blueprint and the proposed revision of the Cybersecurity Act, the EU is building a more coordinated operational cybersecurity framework focused on intelligence sharing, crisis response and resilience. As attention turns from legislation to implementation, this session will explore how Europe can strengthen collective cyber resilience by improving operational cooperation, protecting critical infrastructure, enhancing cross-sector resilience and ensuring governments, industry and EU institutions can respond effectively to increasingly complex cyber and hybrid threats.

Possible questions:

• How can Europe move from fragmented cybersecurity efforts towards a genuine model of collective cyber resilience?
• To what extent can the Cybersecurity Blueprint and the Cyber Solidarity Act fundamentally improve Europe’s ability to prepare for and respond to large-scale cyber crises?
• To what extent will the provisions of the Digital Omnibus Package and the proposed Single Entry Point simplify incident reporting while improving Europe’s collective situational awareness?
• What practical steps are needed to encourage governments, industry and critical sectors to share high-quality threat intelligence more openly and securely?
• What more is needed to strengthen cyber resilience across Europe’s critical infrastructure sectors as NIS2 and the CER Directive move into implementation?
• How can Europe improve coordination between ENISA, national CSIRTs, EU-CyCLONe, CERT-EU, Europol and Member States during cross-border cyber incidents?
• As cyber threats increasingly converge with hybrid and geopolitical risks, how should the EU strengthen cooperation with NATO and international partners?

Artificial intelligence is transforming cybersecurity at unprecedented speed, accelerating both attack and defence. Recent developments, including Anthropic’s restricted release of Claude Mythos and the emergence of other frontier cyber-capable AI models, demonstrate that AI is becoming far more than another cybersecurity tool. It is rapidly evolving into a strategic capability capable of dramatically reducing the time between discovering and exploiting vulnerabilities, raising important questions about resilience, governance and who should have access to these powerful technologies.

As organisations increasingly deploy AI agents and integrate foundation models into critical business processes, policymakers must also address emerging risks including model manipulation, shadow AI, data leakage and increasingly complex AI supply chains. Against this backdrop, the European Commission’s Cybersecurity AI Action Plan set outs a strategic vision for strengthening Europe’s cyber resilience through AI while supporting innovation, investment and trusted deployment. Together with the AI Act, the Cyber Resilience Act and the wider European cybersecurity framework, it will help shape the next phase of Europe’s approach to AI-enabled cyber defence.

This session will examine how Europe can harness AI to strengthen cyber resilience while ensuring governance, regulation and operational capabilities evolve quickly enough to keep pace with rapidly advancing autonomous cyber threats. It will also explore the growing debate over frontier cyber-capable AI models, asking whether restricting access to the most advanced capabilities can meaningfully reduce cyber risk, how such decisions should be governed, and what they mean for innovation, open research and Europe’s long-term cybersecurity competitiveness.

Possible questions:

• To what extent does the emergence of frontier models such as Claude Mythos represent a turning point for cybersecurity policy? Is Europe prepared for a future where vulnerabilities can be identified and exploited within hours rather than weeks?
• How can organisations move from reactive cybersecurity to AI-native resilience and automated defence?
• Should access to highly capable cybersecurity AI models be restricted to trusted organisations, or made broadly available with appropriate safeguards?
• How should governments balance security, innovation and international competitiveness when considering export controls, open-source development and access restrictions for frontier cyber-capable AI models?
• How should the AI Act, and wider cybersecurity legislation evolve to address autonomous cyber threats?
• What role should public-private collaboration play in ensuring Europe develops both the governance frameworks and defensive capabilities needed to compete in the AI-driven cyber era?
• How can Europe continue to support responsible vulnerability research and offensive security capabilities while preventing misuse by increasingly autonomous AI systems?
• Beyond AI, how can organisations prepare today for the long-term cybersecurity implications of quantum computing and the transition to post-quantum cryptography?

16:00 – 16:45 Discussion: What Does Europe’s Evolving Cybersecurity Agenda Mean for CISOs in Practice?

Throughout the day, participants will have explored the latest developments shaping Europe’s cybersecurity landscape, from trusted ICT supply chains and cyber sovereignty to collective cyber defence, AI-enabled threats and operational resilience. This closing session brings the discussion from policy to practice. Drawing on the day’s debates and audience polling results, senior cybersecurity leaders will reflect on what Europe’s rapidly evolving cybersecurity agenda means for organisations on the ground. Rather than revisiting the policy detail, the discussion will focus on implementation, operational realities and the strategic decisions CISOs are making as they navigate an increasingly complex threat environment.

From managing AI-enabled cyber risks and securing increasingly interconnected supply chains to building resilience across critical infrastructure, responding to new regulatory obligations and preparing for the next generation of cyber threats, the session will provide an opportunity for participants to challenge assumptions, compare experiences and identify the practical priorities that should shape Europe’s cybersecurity agenda going forward.

Possible questions:

• Looking back at today’s discussions and polling results, where is there greatest consensus, and where do significant differences remain between policymakers and practitioners?
• What are the biggest cybersecurity challenges keeping CISOs awake today that are still not being adequately addressed by policy?
• How should organisations adapt their security strategies as AI accelerates both cyber attacks and defensive capabilities, while managing increasingly complex supply chains and regulatory obligations?
• What practical lessons are organisations learning about building cyber resilience, improving crisis preparedness and responding to increasingly sophisticated cyber and hybrid threats?
• Looking ahead, what should be Europe’s top cybersecurity priorities over the next three to five years?

16:45 – 17:45 Cyber Mixer: Cocktail Reception