Cyberhagen 2026 Presentations

Non-technical

Panel Discussion

Intelligence-sharing communities are becoming a standard part of national and regulatory resilience programmes. As organisations become less concerned about the perceived challenges and settle into intelligence sharing as part of their BAU Security operations, we explore what intelligence sharing communities are doing in Europe. Rob Dartnall, who has built and runs intelligence-sharing communities across different parts of the world and multiple industries, explores the benefits and challenges of these frameworks by bringing together an expert panel from different intelligence-sharing communities in Europe. The panel will explore the good, the bad and the ugly of intelligence sharing, and what future initiative will look like.

Operational Technology Track

AI now lets attackers scan, exploit and pivot into OT networks faster than most patch cycles or change windows can react — piling straight onto a discipline that was already brutally hard to get right. This talk goes straight to the field experience — real utilities, energy, mining and manufacturing sites where AI-accelerated threats collide with legacy PLCs, blind asset inventories and IT/OT teams still not speaking the same language. Complexity isn’t slowing down, so neither can we: this session delivers concrete concepts and methodologies to confront OT security’s exploding complexity head-on, giving practitioners experience-based insights into OT Security.

Risk Management Track

Requirements for digital products have tightened significantly in a short period of time, and for good reason. A growing number of successful cyberattacks can be traced back to vulnerabilities in software and hardware, security gaps introduced during design, or delayed and missing security updates in operation. The EU’s response is the Cyber Resilience Act (CRA), which will start applying in part from 2026 and imposes concrete obligations across the value chain, including manufacturers, importers, and distributors of products with digital elements. This session provides an executive-level overview of the key CRA requirements and the latest practical guidance. We anchor the discussion in the questions we most frequently see in the market and translate the regulation into leadership decisions. What should be in place for product governance? What is required for vulnerability handling, update obligations, and documentation? How does CRA impact contracts, supplier management, and time-to-market? And what it means in practice for EU market access and compliance risk?

Incident Response Track

How do you manage a cyber crisis when both business operations and critical infrastructure are under pressure? In this session, Michael Sjøberg, Founder at Delta Crisis Management and former intelligence officer, takes the stage alongside with Thomas Zakarias, Vice President / CISO & head of Information Security & Compliance at DSV who has personally experienced a real cyberattack. Together, they offer unique insight into how cyber crises are handled in practice – from negotiation, crisis leadership and difficult decisions and dilemmas under extreme pressure to the most important lessons learned afterwards. The session highlights why it is no longer a question of if you get hit, but when, and why ransomware should never be seen as only an IT crisis. It also explores how crisis negotiations are fundamentally about risk and cost management, because without negotiation there is no control, only reaction. At the same time, negotiation does not equal payment; in many cases, time is one of the most valuable currencies leaders can control during a cyber crisis. A timely and compelling session on preparedness, leadership and action when a cyberattack strikes.

Threat Research Track

Walkthrough of ways to bypass Endpoint Detection and Response (EDR) systems like Microsoft Defender for Endpoint. We show our research into several novel EDR bypass techniques used in real attacks, and will go into detail of what it means for defenders, how to detect & migitate them at scale.
Endpoint Detection and Response (EDR) systems are widely considered a cornerstone of modern defensive security. Yet in practice, they are increasingly being bypassed by adversaries who understand their inner workings – and how to disable them.
This session presents a deep dive into contemporary EDR evasion techniques observed in real-world attacks. Drawing on original research, we examine how attackers leverage living-off-the-land kernel drivers to tamper with or unload security products, and how these techniques are actively used by ransomware operators to neutralise endpoint visibility at critical stages of an intrusion.
Rather than focusing solely on offensive tradecraft, the session centres on the defensive implications. What telemetry remains when EDR is degraded or disabled? Where are the blind spots? And how can organisations detect and mitigate these techniques at scale across complex environments?
Attendees will gain a practical understanding of how modern EDR bypasses work, why they are effective, and what concrete steps can be taken to reduce exposure – moving from assumptions of protection to a more resilient, evidence-driven defensive posture.

Threat Research Track

Phishing-as-a-Service (PhaaS) has industrialized cybercrime, allowing actors to defraud victims on a global scale. Traditional technical remediation—blocking IPs and taking down domains—often devolves into a game of Whac-A-Mole against resilient transnational adversaries. This talk explores a more impactful disruption strategy: civil litigation.
Using Chinese-linked PhaaS operations as a primary case study, this presentation details how Google’s threat intelligence analysts partnered with their legal teams to build a precedent-setting lawsuit against the operators’ unnamed actors. We will walk through the strategic shift from merely tracking infrastructure to purposefully gathering forensic evidence for the courtroom. Furthermore, the session will candidly address the realities and limitations of legal disruption, exploring how threat actors retaliated by rebuilding their backend infrastructure after the lawsuit was filed. Attendees will leave with a clear understanding of the frameworks required for public-private collaboration and the strategic realities of using the law to combat borderless cybercrime.

Operational Technology Track

This presentation will explore IT/OT convergence for cyber security across a global organisation with a heavy dependency on production sites, focusing on three key areas:

– Cyber security challenges across a global organization with heavy dependency on production sites
– Engineers first, cyber security strategy from a site perspective and why this matters
– Integration into a global cyber defence centre

The presentation will also expand on areas including business case and ease of operation.

Risk Management Track

This talk walks through the journey of setting up a Vulnerability Disclosure Program and moving toward Bug Bounty. It covers how to get internal buy-in, learn from others, start with a safe scope, andestablishing governance. A focus on shifting the mindset from risk to resilience and scaling through collaboration with the security and aviation communities.

Risk Management Track

A wave of digital regulation has reshaped how European companies must manage technology, data, and cybersecurity. NIS2, DORA, GDPR, AI Act, Data Act, and related regimes share a clear message. Senior management must be able to evidence robust governance, mapped digital dependencies, effective risk management, and a clear link between corporate strategy and operational prioritization of security, compliance, and investments.

This session maps the regulatory landscape for boards, executive teams and other stakeholders being responsible for legal compliance, and makes the requirements actionable in a leadership context. We explain where obligations overlap and where they differ, what regulators and supervisory authorities typically focus on, and where companies most often fall short in practice, including organizational setup and legal documentation. We also share experience-based lessons from some of the early supervisory activities and the largest Danish fine cases in this area, focusing on what genuinely reduces risk and what it takes to be prepared when the authorities or your best customer comes knocking.

Crisis Management Track

Real-world experience shows: Resilient response to cybersecurity incidents requires:

– Precision in identifying attackers’ activities

– Priorities to efficiently make decisions in high-stress situations and

– Poise to guide teams through challenging times coming out stronger and united

Jan and Lisa will share insights from actual incidents they worked on to show make-it-or-break-it factors determining if teams can solve cases successfully using educated decision-making capabilities, triaging analysis and remediation  as well as crisis management efforts to limit the blast. 

Red Team Track

Many organizations test extensively yet learn the wrong lessons. They validate technical controls, produce findings, and walk away with more confidence than actual resilience. The problem is not the effort; it’s the assumption that pointing tools at an environment, replaying known techniques, and running scripted playbooks represent a motivated and thinking adversary. This talk explores why genuine resilience depends on testing that reflects real pressure, real tradecraft, and real adaptation, not only to find technical security weaknesses but to understand whether an organisation can stay standing when attackers refuse to follow the script.

Chinese Threat Actor Track

A new podcast series from Bloomberg News on Chinese industrial espionage — called The Sixth Bureau — is the culmination of years of investigation by reporters Jordan Robertson and Drake Bennett into China’s use of the world’s largest intelligence service to steal sensitive technologies from the West. Through the story of Xu Yanjun, a Ministry of State Security officer who led a unit focused on stealing jet-engine secrets from aerospace companies in the US and Europe, the reporters got an inside view into what Western officials have described as China’s IP theft machine and the spies — and their co-opted insiders — who make industrialized trade secret theft possible. Through Xu’s rigorous and secretive documentation of his activities on an iPhone that was later obtained by the FBI, he inadvertently created a rare opening into a system and a practice that has helped China accelerate its ascent into a tech superpower. This talk will explore what the reporters learned from their investigation and the many lessons the case holds about the threats to corporate intellectual property from state-backed actors and strategies for protecting against the theft of sensitive information.

Red Team Track

Historically, offensive and defensive teams have been competitors, eyeballing each other with suspicion. This approach has proven to be suboptimal for cybersecurity.

Givan’s talk will highlight the benefits of purple teaming in facilitating communication, knowledge sharing, and problem-solving based on real-life attack scenarios and practical examples. He will explore various approaches (or shades) one can take with purple teaming, how each one has its own characteristics and benefits, and how these shades can provide the best learning experiences for cyber defense and enable a more proactive response to emerging threats.

Crisis Management Track

We explore the most common flaws we see in the market – from mismatched coverage and unrealistic expectations to policies that fail when an incident occurs.

At the same time, we highlight when cyber insurance actually works, and what it takes to make sure your coverage truly supports crisis management and recovery.

Chinese Threat Actor

Providing a blueprint for translating private-sector intelligence into effective law enforcement action, this joint session explores the measures taken under INTERPOL Operation Nebula against a prevalent Organised Crime Group (OCG).

From the initial establishment of trust – to the joint formation of operational and intelligence actions – participants will experience a walk though of how a united partnership between law enforcement agencies (LEA) and private-sector partners, identified and disrupted an OCG, including its threat actors, infrastructure, and attack chain, helping protect victims and strengthen the global cyber ecosystem.

Risk Management Track

Risk management is, at its core, an attempt to predict the future.
But how do you do so in a way that genuinely supports prioritisation in an organisation with limited resources?
In this presentation, partner and risk specialist Bo Thygesen from ACI Risk Measure focuses on the fundamental challenge in modern risk management: Cyber competes with other risk areas for budgets, employee time and management attention. When resources are limited, it is not sufficient to place risks in red, yellow or green categories. It must be possible to prioritise – and prioritisation requires a transparent and consistent decision-making basis.
The presentation challenges the classic qualitative risk matrix and questions whether it provides sufficient precision and comparability over time. How is uncertainty managed? How is consistency in assessments ensured? And how do we know whether our risk management is actually effective – or whether it is genuinely building organisational resilience?
Drawing on practical experience, Bo Thygesen demonstrates how organisations can work more systematically with their assumptions, reduce bias and create greater transparency in their risk assessments – without necessarily starting from scratch.

We cannot avoid predicting the future.

But we can choose whether we do it systematically.

Non-technical

Cecilie Fjellhøy – known from Netflix’s The Tinder Swindler and host of Love Con Revenge – draws on her own story and the cases she sees advising organisations on scam defense to show how manipulation actually works. Not the technology. The human mechanics: how trust is built, weaponised, and broken, and why these crimes succeed against anyone, regardless of intelligence or awareness.

Expect real stories, the psychology behind how these scams are engineered to work, and concrete takeaways for you and your organisation in a world where social engineering – now supercharged by AI – is the threat no firewall can stop.

Non-technical

How do you prepare for a threat you can’t see? In today’s interconnected business environment, your security is only as strong as your weakest link – and sometimes, that link is one you’ve just acquired. A real-world cyber event taught Danfoss that true security isn’t just about prevention; it’s about building resilience.

This presentation moves beyond hypotheticals to share the hard-won lessons from the front lines. Danfoss’ CISO will discuss why a proactive resilience framework is non-negotiable for protecting your business and your customers. Gain practical insights from Danfoss’ own experience that have been instrumental in shaping their security strategy and learn how to turn even the most significant challenges into a stronger defence.

Live Crisis Simulation

Live Cyber Crisis Response: Decisions Across Disciplines

A cyber crisis does not unfold in silos – and neither should the response.

In this live, cross-disciplinary session, a realistic incident scenario brings together leading experts across legal, technical, negotiation and communications disciplines, with contributors from organisations such as Bech-Bruun, CSIS, ACRIM, Delta Crisis Management and bro.

Each expert responds in real time to the same evolving situation, revealing where priorities align, collide and change under pressure.

The result is a more dynamic alternative to the standard panel: practical, fast-moving and immediately relevant.

A session for anyone interested in what real crisis leadership looks like when the stakes are high.