AI is accelerating both sides of the fight, which forces an uncomfortable question: where does a machine get to act on its own, and where does a human still have to sign off? This panel digs into how organisations are actually redrawing those lines — decision rights, accountability, and what “trustworthy automation” looks like in practice.

• What should security teams automate — and what should remain human-controlled?
• Redefining decision rights in AI-enabled security operations
• How much autonomy should AI-driven security systems have?
• Building trust in automated detection and response
• Preparing security teams for increasingly autonomous threats

If attackers are using automation to move faster, defenders need the same edge. This session covers what AI-assisted detection, investigation and automated containment look like in practice — and how much of that can run without a human in the loop before it starts creating new risk of its own.

• AI-assisted detection and investigation
• Automated response and containment
• Reducing time-to-detect and time-to-respond
• Human oversight of autonomous security operations

Six months into CRA implementation, the gap between the regulation on paper and what it actually demands from engineering, security and compliance teams has become clear.

This keynote shares what’s worked, what hasn’t, and what still needs to change before the next compliance milestone.

• Lessons from early CRA reporting requirements
• Where product-security processes are proving most difficult
• Aligning security, engineering, product and compliance teams
• Building security into the product lifecycle
• Preparing for the next stage of CRA implementation

For Nordic tech and industrial firms, CRA compliance is starting to shape how products get designed, sold and trusted — not just how they get certified. This panel debates whether that shift is a cost centre in disguise or a genuine differentiator, and what it takes to make that case internally.

• What has CRA implementation exposed inside organisations?
• Who should own product cybersecurity?
• Integrating security into product development and engineering
• Managing vulnerability disclosure and software supply chains
• Can secure-by-design become a competitive differentiator?

Product security doesn’t stop at ship date — it has to follow the product through deployment, patching and eventual end-of-life. This session walks through practical approaches to secure-by-design development, supply chain visibility and coordinated disclosure that hold up across that whole lifecycle.

• Secure-by-design development
• Software supply chain visibility
• Vulnerability management and coordinated disclosure
• Continuous product security assurance

Employees and customers are no longer the majority of identities in most enterprises — applications, workloads and increasingly autonomous AI agents are. As those non-human identities pick up access to critical systems, the old assumptions behind identity governance stop holding.

This keynote covers what visibility and control actually look like once machines outnumber people in the directory.

• The rise of non-human identities
• Securing AI agents and autonomous systems
• Privileged access for machines and workloads
• Identity governance across hybrid and cloud environments
• Establishing accountability for autonomous actions

Traditional IAM was built around people, and it’s showing its age now that non-human identities can outnumber the human workforce several times over. Security leaders discuss what’s actually changing in how machine and AI agent access gets provisioned, scoped and revoked.

• Managing machine and workload identities at scale
• Governing AI agents and autonomous access
• Privileged access and least privilege in an automated environment
• Visibility and accountability for non-human identities
• Balancing security with the speed of digital transformation

Service accounts, workloads and AI agents have quietly become their own access layer — one most IAM systems were never designed to govern. This session covers the practical mechanics of finding them, managing their privileges and keeping tabs on what they’re doing.

• Machine identity lifecycle management
• Securing AI agent access
• Privilege management
• Continuous identity monitoring

Nordic organisations run on a dense web of global cloud providers, software vendors and infrastructure partners — and geopolitical tension is putting new pressure on how much of that can still be assumed to hold.

This keynote looks at how CISOs are re-mapping their real dependencies, not just their contractual ones.

• Understanding strategic technology dependencies
• Cloud and SaaS concentration risk
• Geopolitical risk and cybersecurity
• Data and technology sovereignty
• Knowing what your organisation truly depends on

The annual vendor questionnaire was never built for a world of concentrated cloud dependency and shifting geopolitics. This panel asks a harder question than “is this supplier secure”: can we keep depending on them at all, and what changes when the answer becomes no?

• Moving beyond traditional third-party risk assessments
• Managing concentration and systemic supplier risk
• Cloud, SaaS and critical technology dependencies
• Software supply chain security
• Geopolitical considerations in technology sourcing
• What should happen when trust in a critical supplier changes?

You can’t manage a dependency you can’t see. This session looks at how organisations are mapping suppliers, software and infrastructure deep enough to catch concentration risk before it becomes a headline.

• Third-party and supply chain visibility
• Continuous risk monitoring
• Identifying critical dependencies
• Managing concentration risk
• Building resilience across the digital ecosystem

Four parallel, CISO-led discussions — each mapped to one of the day’s chapters. Participants join the tables where the questions matter most to their organisation.

01 · Operating at Machine Speed — Focus: AI-Driven Attacks & Human Capacity

As AI accelerates the speed and scale of cyber attacks, security organisations must rethink how decisions are made and how much autonomy can safely be given to machines.

• Where should AI be allowed to act autonomously?
• Which security decisions still require human judgement?
• How are organisations redesigning SOC operating models?
• How do we measure readiness for machine-speed attacks?

02 · CRA in the Real World — Focus: CRA & Product Security

The CRA is moving cybersecurity deeper into product development and organisational processes. CISOs and product security leaders discuss the practical challenges of turning regulatory requirements into sustainable product-security practices.

• What has been hardest about implementing CRA requirements?
• Who owns product cybersecurity?
• How are engineering and security teams collaborating?
• Can product security become a competitive advantage?

03 · The Non-Human Identity Explosion — Focus: Identity & AI Agents

The number of machine identities, workloads and AI agents is rapidly expanding. Security leaders discuss how organisations can maintain control when non-human identities increasingly interact with critical systems.

• How are organisations discovering non-human identities?
• How should AI agents be governed?
• How do you prevent privilege from spreading across autonomous systems?
• Who is accountable for an AI agent’s actions?

04 · What Can We Still Trust? — Focus: Third-Party, Supply Chain & Geopolitical Risk

Nordic organisations are increasingly dependent on global technology ecosystems while facing a more complex geopolitical environment. This discussion explores how CISOs are reassessing technology and supplier trust.

• Which dependencies create the greatest strategic risk?
• How should organisations assess concentration risk?
• What happens when a trusted supplier becomes a geopolitical concern?
• How much visibility do CISOs really have across their digital supply chains?