Conference Description
Key Takeaways
- Focus on transitioning from regulatory compliance to operational cyber resilience under NIS2, DORA, the Cyber Resilience Act and the EU AI Act
- Designed for CISOs, risk leaders, compliance officers and executive decision-makers in regulated industries
- Addresses governance accountability, AI-driven threats, third-party risk and crisis response at board level
- Relevant to financial services, energy, telecommunications and government sectors across Europe
- Features panels, fireside chats and technical presentations with regulators, policymakers and technology executives
Introduction
The 6th Cybersecurity Conference 2026 convenes senior cybersecurity and risk professionals in Nicosia, Cyprus, on 15 September 2026 to examine how organisations can move beyond checkbox compliance toward genuine operational resilience. With European regulations including NIS2, DORA, the Cyber Resilience Act and the EU AI Act now reshaping accountability requirements across critical sectors, the conference addresses the practical challenges executives face when translating regulatory obligations into sustainable security programmes. The timing reflects an inflection point for European enterprises: regulators increasingly expect boards and senior leadership to demonstrate not merely that controls exist, but that organisations can withstand disruption and maintain continuity during active cyber incidents.
About This Event
Held at the Hilton Nicosia Hotel, the conference brings together regulators, policymakers, CISOs, chief risk officers, technology executives and compliance leaders from Cyprus and the broader European region. The programme combines panel discussions, fireside chats and technical presentations designed for executive-level participants. Rather than focusing narrowly on technical implementation, sessions examine how cybersecurity has evolved into a governance discipline requiring direct board engagement and clear lines of accountability.
Regulatory Pressures Reshaping Cybersecurity Governance
The conference programme reflects the convergence of several major European regulatory frameworks that collectively raise the bar for organisational preparedness. NIS2 extends cybersecurity obligations to a broader range of essential and important entities while introducing personal liability provisions for senior management. DORA imposes specific operational resilience requirements on financial institutions and their critical ICT providers, mandating incident reporting, resilience testing and third-party risk management. The Cyber Resilience Act introduces security-by-design requirements for products with digital elements, while the EU AI Act establishes risk-based obligations for artificial intelligence systems.
For organisations operating across multiple jurisdictions or sectors, these overlapping frameworks create complexity that extends well beyond technical security teams. Compliance now demands coordinated effort across legal, risk, procurement and executive functions, with boards expected to understand and oversee cyber risk as a strategic concern rather than delegating it entirely to IT departments.
From Compliance Documentation to Operational Capability
A central theme throughout the conference is the distinction between demonstrating compliance on paper and building genuine resilience in practice. Regulatory frameworks increasingly require organisations to prove they can detect, respond to and recover from incidents while maintaining essential operations. This shift demands investment in crisis response capabilities, regular testing of incident management procedures and clear escalation pathways that reach board level when necessary.
Sessions address how leadership teams can prepare for decision-making under pressure, including scenarios where technical teams may be overwhelmed and business continuity depends on rapid executive judgement. The conference also examines third-party and supply chain risk, recognising that operational resilience extends beyond organisational boundaries to encompass critical vendors and service providers.
AI-Driven Threats and Defensive Applications
The programme explores how artificial intelligence is transforming both the threat landscape and defensive capabilities. Adversaries increasingly leverage AI to automate reconnaissance, craft convincing social engineering attacks and identify vulnerabilities at scale. Simultaneously, security teams are deploying AI-powered tools for threat detection, behavioural analysis and incident response automation. The conference examines how organisations can harness these defensive capabilities while managing the risks that AI systems themselves introduce, particularly as the EU AI Act imposes new obligations on high-risk applications.
Who Should Attend
The conference is designed for senior professionals with responsibility for cybersecurity strategy, risk management, regulatory compliance and operational resilience. This includes CISOs, chief technology officers, chief risk officers, chief compliance officers and chief information officers, as well as managing directors and general managers with oversight of security functions. The programme is also relevant for security architects, risk analysts, legal advisors, data protection officers and consultants advising regulated organisations. Sectors particularly well-represented include financial services, telecommunications, energy, government and large enterprises subject to European cybersecurity regulations.
Industry Context
The conference arrives as European organisations face implementation deadlines for multiple regulatory frameworks simultaneously. Many enterprises are discovering that compliance programmes developed for earlier directives require substantial enhancement to meet the operational resilience standards now expected. The challenge is compounded by a persistent shortage of experienced cybersecurity professionals and the increasing sophistication of threat actors targeting critical infrastructure. For boards and executive teams, the reputational and financial consequences of inadequate cyber resilience have never been higher, making events that bridge technical and governance perspectives particularly valuable.