Transitioning from sovereignty to security, the program for the first day, SECURITY DAY, reflects the dynamic evolution of threats in 2026.

Throughout both days, the ITAPA EXPO ZONE will feature interactive demonstrations of the latest innovations and MASTERCLASSES focused on practical skill-building in security and artificial intelligence.

The future of AI will no longer be determined solely in laboratories and companies, but also by those who control infrastructure, data, and the rules. Europe has much at stake: its sovereignty, its security, and its ability to remain a relevant power in the digital age.

AI agents are emerging as a new class of "digital workers"—tireless, scalable, and increasingly empowered to act without direct human intervention. However, this very autonomy fundamentally reshapes organizational security models and introduces entirely new classes of risk. Beyond legitimate use, agentic AI is becoming a potent tool for adversaries, enabling the automation of reconnaissance, social engineering, attack generation, and the bypassing of security mechanisms at unprecedented scale and speed. A featured case study will demonstrate how a beneficial tool can transform into an active threat vector the moment autonomy outpaces control mechanisms. This session will focus on emerging threats associated with AI agent deployment, their exploitation in offensive scenarios, and strategies for managing these risks—from permission mapping and oversight to implementing security frameworks for agentic systems.

The cloud can help the state overcome its own outdated infrastructure. However, it can also render it dependent on technologies it does not control. This panel will examine where enhanced security ends and a new form of vulnerability begins.

In modern manufacturing, attacks are no longer confined to computers. They target the very continuity of operations. Every new integration, remote access point, or IT/OT convergence enhances performance - yet simultaneously increases the risk of production halts, supply chain disruptions, or extortion schemes where companies are forced to pay for their own operations. This panel will demonstrate where modernization ends and vulnerability begins.

The best defense does not begin at the moment of impact, but long before it. This panel will demonstrate how people, technology, processes, and monitoring converge to build true organizational resilience - the capacity to preempt attacks, detect them in their early stages, mitigate their impact, and restore operations without collapse.

Growing regulatory requirements are placing increasing demands on organizations, many of which lack sufficient financial and human resources. According to surveys, only a small fraction of organizations consider their preparedness for new obligations to be adequate, with regulations becoming a significant source of pressure on IT and security management. This session will focus on identifying the minimum viable measures needed to meet legislative requirements and practical approaches to effective implementation—even within a limited budget. It will present risk prioritization and pragmatic strategies for leveraging existing resources.

The year 2026 marks a pivotal milestone in the field of cybersecurity. Post-quantum cryptography (PQC) is progressively moving from academic theory into practical application, as the anticipated arrival of quantum computers (the so-called "Q-Day") pressures organizations to protect sensitive data well in advance. This session will focus on the practical implications of this transformation—specifically the need for crypto-agility: the ability of organizations to flexibly change and update cryptographic mechanisms without major disruptions to their infrastructure. It will present the current state of standardization, migration strategies to PQC, and demonstrate why preparedness for these changes is becoming not only a security necessity but also a significant competitive advantage.

Today, a national cyber incident means more than just an IT outage. It can halt social benefits, disrupt financial flows, jeopardize sensitive data, and erode public trust. How are individual ministries preparing for these risks? What are their experiences in building oversight, response capabilities, and resilient operations for systems that the state simply cannot afford to shut down?

Cyber Fraud, Deepfake Scams, and Child Safety.