What European threat intelligence shows about AI-accelerated attacks targeting CEE and Balkan organizations right now. How AI is being weaponized, automated reconnaissance, AI-generated phishing at scale, autonomous lateral movement. Threat actors are moving faster than most organizations can detect. Classified-level insight, declassified for this room.

Attendees will gain a current, intelligence-led picture of the threat landscape specific to this region, not the global averages that dominate most cybersecurity conferences, but the specific actors, techniques, and targets that are active in CEE and the Balkans today.

Organizations that are unaware of the regional threat picture are defending against last year's attacks. The gap between attacker speed and defender awareness is where breaches happen.

Employees are using AI tools the security team never approved. Developers are deploying AI agents with access to sensitive systems. Vendors are selling AI solutions that are not yet mature enough to trust. Three CISOs share how they discovered unauthorized AI inside their organizations, and what governance structure they built afterwards. Attendees will gain honest accounts of how Shadow AI was discovered, what the actual risk exposure looked like, and what governance structures proved effective without killing innovation. This is the conversation most organizations are not yet having internally — but need to. Organizations that assume their AI governance policies are being followed are operating on faith, not visibility. Shadow AI is not a future risk. For most organizations in this room, it is already present.

Tools that give visibility into what AI is doing inside your environment when you did not deploy it yourself, and how to build governance without rebuilding your entire stack. This session focuses exclusively on AI security, addressing the practical challenge of governing Shadow AI within the resource and infrastructure constraints specific to CEE organizations.

Attendees will leave with a clear understanding of what visibility tools exist, how to prioritize governance actions, and how to build an AI security framework that is proportionate to their organization's size and risk profile, without requiring a complete technology overhaul.

Without visibility into unauthorized AI, organizations cannot govern it. And without governance, every AI tool running inside the environment is an unmanaged risk, invisible to security teams until it becomes an incident.

80% of European critical infrastructure is defended by non-EU technology. Your cloud is American. Your endpoint protection is non-EU. Your AI tools are American. This keynote does not pretend this is simple to fix; it maps the dependency honestly and asks what CEE and Balkan organizations can actually do about it, given real budget constraints and a non-EU member context.

Attendees will gain a clear, unsentimental picture of where European technology dependency actually stands and where the realistic options for reducing it exist. The session separates political aspiration from operational reality, giving leaders a framework for making vendor decisions that are strategically informed rather than ideologically driven.

Organizations that ignore vendor dependency are not avoiding the problem; they are deferring it. When the geopolitical environment shifts, the organizations without a dependency strategy will be the least prepared to respond.

Three practitioners who have made real vendor decisions in real CEE organizations. What replacing a core vendor dependency actually looks like operationally. What the regulator expects regarding third-party risk. And what happens when a trusted supplier becomes your biggest vulnerability as it did in a supply chain attack in the region last year.

Attendees will gain direct practitioner insight into the decisions, tradeoffs, and consequences of vendor dependency management in the CEE context, not theoretical frameworks, but real decisions made with real constraints. The discussion will help leaders understand what is actually achievable and where the greatest risks lie.

Organizations that treat vendor dependency as someone else's problem, the regulator's, the vendor's, the government's will find themselves unprepared when a supplier becomes a threat vector. Third-party risk is now a board-level liability.

A straightforward assessment of what European-headquartered security technology can deliver today and what it cannot. No overselling. Practical guidance for organizations that want to reduce strategic dependency without compromising operational capability.

Attendees will leave with a clear-eyed view of the European security technology landscape which categories have credible alternatives, which do not, and how to make procurement decisions that balance sovereignty goals with security performance and budget reality.

Without an honest assessment of what European alternatives can and cannot deliver, organizations risk making vendor decisions based on politics rather than capability or avoiding the question entirely and remaining fully dependent by default.

A real-world debrief from senior cybercrime units across Europe, shifting from theory to operational reality.

How major cyber incidents are handled across jurisdictions, what slows investigations down, and where international cooperation actually breaks or succeeds in practice.

Four senior cybercrime law enforcement voices. Four perspectives. One shared reality. Short, unscripted reflections from experienced cybercrime investigators on what real cases look like beyond headlines — from attribution challenges to cross-border coordination and operational constraints.

The room votes before the debate starts. The room votes again at the end. The shift in the vote is the result. This closing debate puts the day's central tension on trial between the vision of a sovereign European cyber defense and the operational reality facing organizations that cannot afford to rebuild their entire stack.

Before the debate begins, the event chair sets the context in two sentences: In this room we have organizations running predominantly non-EU technology, CISOs with budgets that cannot cover basic hygiene let alone sovereign infrastructure, and a Serbian context where EU alignment is an aspiration not a membership. With that reality in mind, two opposing voices take the stage.

The Idealist: Dependency on foreign technology in critical infrastructure is one political decision away from becoming a strategic crisis. The cost of building sovereignty is high. The cost of not building it is existential.

The Realist: For organizations in this room, full sovereignty is not achievable in any meaningful timeframe without crippling operational capability. Manage dependencies intelligently, invest in what you can control, and stop letting perfection be the enemy of functionality.

Format: 10 minutes each to make their case. With a 10 minutes open floor any delegate may challenge either speaker directly. Final 10 minutes: closing arguments, one minute each, then the room votes.