by When in Rome, do as the Romans do. We talked about AI, debated cybersecurity, questioned our readiness for quantum computing, and spent a considerable amount of time discussing regulations. We’re not entirely sure that’s what the Romans had in mind, but we’ll call it a modern interpretation.
As you may have heard and seen, #PECBConf26 has officially wrapped up, and we’re back home, still processing everything that happened, and no, we don’t mean how much pasta we managed to eat.
This year’s conference brought together more than 250 attendees from over 200 companies, alongside 30+ speakers and sessions covering everything from agentic AI and cybersecurity to regulatory headaches that aren’t going away anytime soon. Rome has spent centuries building a reputation for things that last, and we gathered to discuss whether our digital systems could manage the same.
The day started with AI Under Attack, Atıl Samancıoğlu exploring the risks facing the very technologies designed to protect us. Because apparently, securing our systems wasn’t enough. Now we also need to make sure our security tools aren’t the ones getting themselves into trouble.
Meanwhile, over on our Interactive Stage, were the AI agents taking over the SOC, or was Lorena Bravo simply telling us how it all unfolds? Moderated by Alex Carroll, The Skills That Matter Now: What I Wish I’d Learned Before Agents Joined Our SOC explored the skills professionals need to keep up as AI agents join the team.
The workplace is changing, job descriptions are evolving, and the list of things professionals need to learn keeps growing. But as AI reshapes how we work, we can’t afford to ignore another question: how do we protect the systems we all depend on? In Strengthening National Cyber Resilience, Phedra Clouner explored the importance of building resilience at a national level. Because cybersecurity isn’t just an organizational concern. When critical systems and national infrastructure are involved, preparation and coordination matter just as much as knowing what to do when things go wrong.
…have you ever wondered what is next? We did, and we explored another trending technology that could fundamentally change our security landscape: quantum computing.
André M. König presented The Quantum Deadline: Leading the Quantum-Safe Transition, examining the need to prepare for a future in which quantum advances could challenge today’s cryptographic protections. Just when we thought we had enough things to worry about, the future arrived with another calendar reminder. The quantum-safe transition isn’t something organizations can simply postpone until it becomes urgent.
At the same time, our Live Duel tackled a very different challenge: Identity Crisis: Deepfake KYC Failures Mean What — Reverse to In-Person or Trust AI Detection? Moderated by Marco Angelini, the debate featured Aaron Kalvani arguing in favor and Maha Al Saadi taking the opposing position. As deepfakes become increasingly convincing, organizations face a difficult choice between relying on AI detection and bringing back more traditional identity verification methods.
Remember when a blurry webcam was the biggest problem with online meetings? Those were simpler times. The question now is how to make identity verification secure without turning the process of opening a bank account into an application for international diplomatic clearance.
By the afternoon, the conversation shifted toward the regulatory landscape. In Preparing for Omnibus and How DORA, NIS2, and the EU AI Act Shape the Next EU Compliance Era, Adedayo Adeniji, Henri Haenni, Joerg Asma, and Sina Khatibi joined the discussion about the evolving compliance environment.
In parallel, Rinske Geerlings led The Road to 2030: Technology Surprises & Regulatory Shifts No One Saw Coming, a live team scenario challenge. Predicting the future is difficult; predicting the future of technology and regulation is even harder. Doing it as a team, under pressure, with unexpected developments thrown into the mix? Now that sounds like a perfectly reasonable way to spend a conference afternoon.
We continued with AI in the Supply Chain: Third-Party Risk in the Age of Autonomous Systems, moderated by Ine Segers, with Derek Tata, Fabrizio Degni, Greg Evseev, and Willy Fabritius. The panel explored how organizations can assess risks across their supply chains and maintain trust when autonomous systems are involved.
…and then came the rain. But a little autumn weather wasn’t going to stop the show! Day two kicked off with fresh coffee, fresh conversations, and plenty more to explore, proving that not even Rome’s rain could put a damper on our plans.
We opened the morning with The Human-Agent SOC and the Future of Security Operations, where Dave Lewis explored the changing relationship between human professionals and AI agents in security operations. As AI agents become more capable, the question is no longer simply whether machines can help us work faster. It’s how humans and AI can work together without turning the security operations center into a very expensive experiment.
Meanwhile, Tania Postil moderated The Humans Behind the Incidents: What We Forget in Cybersecurity, featuring Jean Luc Peters. We then continued with a CISO’s journey in When Your Board Asked, ‘Are We Ready for DORA?’, featuring Hector Agustin Cozzeti.
And would it really be a PECB Conference if we didn’t discuss some of the industry’s biggest dilemmas? That’s why we invited Joseph Carson to present The AI Dual-Use Dilemma: When Defense Tools Become Attack Vectors, exploring how technologies designed to defend systems can also create opportunities for attackers.
Meanwhile, on our Interactive Stage, Nathalie Claes moderated Agentic AI Security: Governing Autonomous Systems in Production, joined by Davorin Kacian, Sara Magdalena Goldberger, and Stephanie Itimi, for a discussion on the challenges of securing and governing autonomous systems.
By the afternoon, it was time for a reality check. Not for ourselves, of course, but for DORA.
In DORA Reality Check: First-Year Implementation Lessons & Audit Failures, moderated by Gry Evita Sivertsen, Mostafa Alshamy, Wesley Venstermans, and Valeri Milke explored the realities of putting regulatory requirements into practice.
At the same time, Matija Veric led the workshop of Offensive & Defensive AI Security: Prompt Injection, AI-Driven Threat Hunting, and Reverse Engineering. Participants got the opportunity to explore the practical side of AI security, from understanding prompt injection to examining AI-driven threats and defensive techniques.
Meanwhile, our AMA session, Understanding the EU AI Act: Rewriting the Rules for the Future of AI, featured Anja Wyrobek and allowed attendees to ask questions about the evolving regulatory landscape. That is the beauty of an Ask Me Anything session: you can arrive with one carefully prepared question, hear someone else’s answer, and suddenly realize you have approximately seventeen more.
And just like that, Rome was over.
As the closing speech brought the conference to an end, we said our goodbyes, collected our final thoughts, and headed home. We may have left Rome, but the conversations about the future of digital trust are far from over.
Now, the next chapter takes us to Prague, a new city, new conversations, new challenges, and probably a whole new set of acronyms for everyone to learn. We’d say we’re taking a break until then, but we all know how that goes.
Dov’è il prossimo caffè? Actually, never mind. We have a conference to plan.