SecurityCafé

# Gamifying cyber safety for the next generation — with Emily Jacometti (HackShield)

For the first time ever, SecurityCafe breaks its own "no selling" rule. Menno van der Horst and Quint Ketting sit down with Emily Jacometti, co-founder of HackShield, the free game that teaches children aged 7 to 12 to stay safe online. But first: a week of disruptive incidents across Europe. ## Timestamps 00:00 Intro: why we're breaking our own rule 01:15 What HackShield is 02:31 News: hijacked supermarket freezers in France 05:06 Younger victims, younger perpetrators 06:02 News: the Ahold Delhaize security incident 07:17 News: Danish data leak behind a 123456 password 09:10 Why gamification beats traditional awareness 12:48 Why start at age 7: the swimming lessons analogy 14:10 Home, school and community: reaching every child 17:09 One in three kids talks to strangers in games 19:19 From serious gaming to HackShield: Emily's story 22:08 The model: free, no advertising, no data sales 24:42 How cybersecurity companies contribute and volunteer 26:47 The Europol Wi-Fi sniffer case 28:14 Golden tickets and the path to ethical hacking 31:26 Nine countries, aiming for 10,000,001 kids by 2030 33:49 Why a social media ban alone is not the answer 35:42 What's in it for companies: tenders, marketing, people 40:19 Creativity and adaptability as the skills of the future 44:41 Recommendations ## Key takeaways - Predictable passwords still cause major incidents, from supermarket freezers to millions of citizen records. - Cybercrime perpetrators are getting younger, and criminals use gamification to recruit them. - People learn by doing: a game lets kids fail safely and try again. - Start before a child gets their first device, not after. - HackShield is free, ad-free and does not sell data; public and private partners fund it. - For partners: social return in tenders, soft marketing, purpose for employees and an early view of talent. - Bans alone don't work. Teach kids to swim instead of draining the pool. ## A note on facts - News items reflect what was known at the time of recording; investigations into the French freezer incident and the Ahold Delhaize incident were ongoing, and reported figures for the Danish leak vary. - Survey figures and country-specific observations are HackShield's own data and experience. - The Europol Wi-Fi sniffer case is discussed as the guest understands it; the case involves minors. ## Mentioned - HackShield: https://joinhackshield.com - DIVD Academy: https://www.divd.nl - The Social Reckoning (film, 2026) - Jane McGonigal, Reality Is Broken - David Dewulf, Lateral Movement (October 2026, featuring Quint Ketting, Dimitri van Zantvliet and Max Heinemeier) --- Powered by Atos

• Transcript

# Three sectors, one crisis — Martin de Vries **Live from CybersecNL — Episode 7 of 7, the finale**

Note: the video focus slipped during this live recording at the booth. The conversation is the point, and the audio version is unaffected. Recorded at the Atos booth, CybersecNL 2026, minutes after Martin's main stage talk. Martin de Vries has worked in security across three sectors: banking, higher education and industry. He was CISO at a Dutch university when it was hit by a cyberattack, and now works in the industrial sector. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Straight from the main stage 00:50 Three sectors: banking, higher education, industry 01:41 What changes when you move sectors: culture 02:26 What doesn't: listening, relationships, threats and risks 02:50 From highly regulated to compliance as an afterthought 03:20 The CISO as facilitator 04:20 "I own the process, not the risk" 05:28 Why "I told you so" isn't the answer 05:49 Accepting risk at the right level 06:24 Acquisitions, due diligence and security 07:28 The shelved report, and the ransomware that followed 09:42 You don't spend a million to avoid 1.2 10:12 The cyberattack on the university 12:18 A Signal message on a Saturday evening 13:19 Deciding near midnight without the business present 13:43 Having the mandate versus taking it 15:00 IT back online within a week 15:41 Postponing an entire exam week 17:13 Research grant deadlines and month-end salaries 18:20 Disconnecting the network, and session tokens expiring 19:01 Restoring, and in which order to reconnect 19:39 Taking care of your teams 21:59 Sending a whole team home for twelve hours 22:21 Quint: Slammer, and sleeping at the office at twenty 23:08 Room for the personal during a crisis 25:07 Sunday 9 a.m.: what do we share? 25:44 At a university, internal communication is public 26:17 One update per day, at a fixed time 28:32 Openness as part of the culture 29:44 Closing: talk to your counterparts in other sectors ## Key takeaways - Moving sectors changes the culture and maturity you work in. Threats, risks, measures and the need to listen stay the same. - The CISO owns the risk process, not the risk. The job is to find the risk owner and make sure the risk is understood and accepted at the right level. - After an incident, fix first. Then revisit the trade-off between impact and the cost of prevention. - Write down the mandate to disconnect, and make sure the rest of the organisation knows it exists. - Technical recovery within a week came from years of investing in processes. The business impact, from exams to grants to payroll, ran much longer. - Look after your people. Rotate shifts, and when needed send a whole team home. - Communicate once a day at a fixed time, identically internally and externally. It prevents everyone from refreshing for news. - Share what happened, so others don't make the same mistakes. ## Mentioned Fox-IT, which presented the incident analysis Maastricht University, which shared openly after its 2019 ransomware attack ## The full series Ramsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmer, Mandy Andress, Gilad Friedman and Martin de Vries. --- SecurityCafe. Powered by Atos.

• Transcript

# Securing agentic AI — Gilad Friedman **Live from CybersecNL — Episode 6 of 7**

Recorded at the Atos booth, CybersecNL 2026. Gilad Friedman is part of the agentic AI protection team at Radware, a cybersecurity company with nearly 30 years in the business. Hosted by Menno van der Horst with Quint Ketting. Atos and Radware are partners. ## Timestamps 00:00 Recording number seven or eight — nobody is counting anymore 00:35 Gilad: Radware and agentic AI protection 01:40 The first AI risk isn't security. It's governance. 02:05 Then compliance and data leakage, then security 02:40 What people put into AI, and why they bypass the approved tools 03:40 AI-first boards and private accounts at work 04:55 Where are the agents, how many, and what access do they have? 05:15 Shadow AI 05:40 "Our AI policy is simple: it's not allowed" 06:10 Why blocking doesn't work 06:46 A policy is not protection 07:15 One enforcement point instead of twenty vendors 07:40 How do you get visibility on shadow AI? 08:15 Desktop, cloud, mobile and gateway 09:07 The hotel guest, the telecom and legal liability 10:00 On the verge of an explosion 10:30 Connecting AI the way we connected to the internet in the 90s 11:40 Customers: stop the fear, show us enablement 12:45 Build processes that expect the unexpected 13:04 Are today's controls enough for what is already out there? 13:50 What changes is the speed of response 14:20 Prompt injection: planted yesterday, triggered today 15:10 Stopping it, not only detecting it 16:10 Looking back: is your baseline good enough? 16:30 Indirect prompt injection, hallucinations and tool misuse 17:15 Agents inherit the credentials of the user 18:00 How many agents do you have? A silent audience 18:40 Radware drinks its own champagne 19:45 Most of it isn't malicious 20:05 Is credential inheritance simply bad design? 20:30 LLMs can't tell instructions from data 20:55 Infrastructure, architecture, governance, visibility, control 21:25 The major AI incident will come. We just don't know when. ## Key takeaways - The first AI risk organisations run into is governance: they do not know which AI tools and agents exist. Compliance and data leakage come second, security third. - Blocking AI does not stop its use. People move to private accounts, other devices and the web. A policy only works when you can enforce it. - Visibility has to cover desktop, cloud, mobile and the network edge, ideally from one enforcement point rather than a tool per vendor. - Agents inherit the credentials and permissions of the user who runs them. That turns every shared document into a possible attack path. - LLMs cannot distinguish instructions from data. An instruction hidden in an email, file, image or voice message gets executed with the victim's access. - Detection alone is not enough. When an agent asked to review a document starts touching financial systems, it has to be stopped automatically. - Most shadow AI is not malicious. It is people trying to keep up with an AI-first mandate. Enablement works better than fear. ## Mentioned Radware — https://www.radware.com ## Also in this series Ramsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmer and Mandy Andress — out now. Martin de Vries on securing different sectors — the series finale. --- SecurityCafe. Powered by Atos.

• Transcript

# Open source culture — Mandy Andress **Live from CybersecNL — Episode 5 of 7**

Recorded at the Atos booth, CybersecNL 2026. Mandy Andress is CISO at Elastic, where she has worked for eight years. She was at CybersecNL to deliver a keynote on moving security from human speed to machine speed. Hosted by Menno van der Horst with Quint Ketting. Atos and Elastic work together in several areas, including search and SOC operations. ## Timestamps 00:00 Welcome, third recording of day two 00:16 Mandy: CISO at Elastic, and why she came to CybersecNL 00:58 How Atos and Elastic already work together 01:30 Speed, trust and instinct: incidents at human speed 02:06 Processes built on human delay no longer hold 02:47 The AI-native mindset security needs 03:22 Real-time analysis, and grounding AI with context 04:21 Drinking your own champagne 05:08 Open code, public detection rules, no black box 05:50 Sharing how the security team works, not only what it ships 06:16 "If I keep it to myself, I'm safer" 06:49 Security by obscurity is dead 07:29 Isn't all that openness a risk? 08:15 Knowing your coverage and your gaps as a practitioner 09:05 Security first versus commercial reality 10:14 Eight years at Elastic, and running security on the ELK stack 11:44 "Everything is a search problem" 13:28 Deciding without information: the TU/e breach 13:56 Log4j as a search problem 14:59 The client that went looking with paper and pen 15:40 Never waste a good crisis, and a business that didn't feel the risk 16:10 What if Slammer had targeted Log4j? 16:56 Mandy's keynote: from human speed to machine speed 17:49 Security hasn't changed. The speed has. 18:40 How many agents do you run, and what access do they have? ## Key takeaways - Most security processes are built on the delays that come with human speed. Those delays are gone, and many processes need to be turned around rather than tuned. - Security by obscurity relied on attackers lacking time, imagination or capability. AI agents have all three. - Openness is a security strength. Public code and public detection rules bring in the insight of the global community. - For practitioners, transparency means knowing exactly what a product covers and where you need to augment. A black box leaves you guessing whether you are safe. - Share how you work, not only what you build. Elastic's security team publishes what works, what doesn't, and what it is still figuring out. - Security is a search problem: finding patterns in data. When Log4j hit, knowing where it ran made the difference between acting in minutes and searching by hand. - Security itself hasn't changed. The speed at which we have to act on it has. ## Mentioned Elastic — https://www.elastic.co Elastic detection rules — https://github.com/elastic/detection-rules Elastic Security Labs — https://www.elastic.co/security-labs ## Also in this series Ramsés Gallego, Kelvin Rorive, Marianne Schinkel and Aernout Reijmer — out now. Gilad Friedman on AI as an attack vector — coming next. Martin de Vries on securing different sectors — the series finale. --- SecurityCafe. Powered by Atos.

• Transcript

# Real collaboration — Aernout Reijmer **Live from CybersecNL — Episode 4 of 7**

Recorded at the Atos booth, CybersecNL 2026. Aernout Reijmer was CISO at ASML for seven to eight years and now runs Cyber Alloy. He co-founded the CISO Circle of Trust and chaired the Cyberweerbaarheidscentrum Brainport. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Day two, back on the conference floor 00:25 Aernout: from CISO at ASML to Cyber Alloy 01:16 We will not win this fight in our own bubbles 02:19 CISO Circle of Trust, Brainport, and what he learned there 03:10 ISACs are good. They are not enough. 03:46 Metcalfe's law, and the CISO as bottleneck 04:46 Meeting at events is easy. Building something is the point. 05:52 No more talk shops: deliverables and orchestration 07:25 Attackers do not wait for signed agreements 07:45 Which deliverables? Intelligence, awareness, vulnerability triage 09:32 A preview of his talk: the urgency of protecting the digital economy 11:04 A prediction on enterprises breached through AI 11:44 Fighting AI with AI, and investing in trust 12:46 From Slammer to LLMs: machine speed meets APT intelligence 14:10 Why the company is called Cyber Alloy 14:48 Twenty-five years of experience, combined with AI natives 15:48 The short passwords an LLM will find first 16:19 Non-human identities: do we even know how many we have? 16:46 The race for AI talent 17:17 Why this needs to be European 17:33 Brain drain and fragmented capital 18:35 Pension funds, risk appetite and a larger European fund 19:07 Wrap-up, and an invitation to the studio ## Key takeaways - Sharing threat detection is only the start. Share how you fight a threat actor, what you learned after a breach, and how you improved. - The value of a network grows with the number of nodes. That only works if subject matter experts share, not only the CISOs. - CISOs build the trust at their level, then give their teams explicit permission and the task to share. It is part of work. - Collaboration without deliverables is a talk shop. Add an orchestrator: someone tasked by the group to turn a shared problem into a shared result. - Organisations produce awareness material and assess the same vulnerabilities in parallel. Doing it together multiplies the effect. - Trust built on a Friday evening at nine is too late. Put it on the agenda for Monday at ten. - Machine-speed attacks are not new. What is new is that LLMs combine that speed with the intelligence of APT groups. Days to respond become seconds. - Europe needs larger, less fragmented capital to keep its security companies and talent from leaving. ## Mentioned ASML Cyber Alloy - https://www.cyberalloy.eu CISO Circle of Trust Cyberweerbaarheidscentrum Brainport Non-human identities also came up with Ramsés Gallego in episode 1. ## Also in this series Ramsés Gallego, Kelvin Rorive and Marianne Schinkel — out now. Mandy Andress on open source culture — coming next. --- SecurityCafe. Powered by Atos.

• Transcript

# The CISO under pressure — Marianne Schinkel Live from CybersecNL — Episode 3 of 7

Recorded at the Atos booth, at Cybersec NL 2026. Marianne Schinkel sits on the CybersecNL advisory board and works as an interim CISO and coach, with 24 years in the field and a background in marketing. Earlier that day she joined the panel on the CISO under pressure. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Welcome to episode three 00:16 Why Marianne is at CybersecNL: advisory board and community 00:54 The panel: the CISO under pressure 01:25 Responsibility without mandate, sometimes without budget 01:46 Taking care of yourself means more than sport 02:04 SOAP: Security Organisation, Awareness, Portfolio management 03:23 Too many topics, and an audience that can't take more 04:30 Enabling the business, a callback to Andreas Wuchner 05:55 From marketing to CISO: business process first 06:23 No IT degree. Can you still become a CISO? 08:08 "Do you know who you are?" Purpose before security 09:13 First question for the board: what is the purpose? 09:35 What is your definition of a CISO? 10:16 When the CEO forwards every risk question to the CISO 11:01 How a missing mandate turns into frustration and burnout 11:30 The risk is not yours. It is the board's. 11:52 How security teams can support their CISO 12:29 Ask how people are doing, top down and bottom up 13:01 Dutch directness versus American small talk 14:04 Make wellbeing part of your dailies and weeklies 14:47 But under pressure, who has the time? 15:32 The value of idle time 16:31 A generation that sets boundaries, and the surfer 17:46 Mental health, and why we didn't talk about it 18:31 Agents work day and night. Use the time for people. 19:44 Dealing with threats all day takes its toll 20:05 What a breach does to the people behind it 22:17 Closing message: expectations and personal leadership ## Key takeaways - CISO pressure comes from the threat landscape, but just as much from missing mandate, missing budget and unclear expectations. - Taking care of yourself starts with your position: arrange the mandate and agree with the board what they expect from you. - Marianne's SOAP model: security organisation, awareness and portfolio management together give a CISO a solid footing. - A business or marketing background is no barrier to the CISO role. At that level the work is stakeholder management and understanding how the business wants to innovate. - Start with purpose. Ask the board what the organisation is for, which risks it accepts and which it does not. - The risk belongs to the board. The CISO helps them understand and own it. - Ask your team how they are doing, and let them ask you. It is the question that gets skipped when the pressure is highest. - Major incidents leave a lasting mark on the people who handle them, well beyond the technical recovery. ## Mentioned CybersecNL — https://www.cybersecnl.nl SecurityCafe episode with Andreas Wuchner ## Also in this series Ramsés Gallego and Kelvin Rorive — out now. Martin de Vries on sector differences — publishing October 6th --- SecurityCafe. Powered by Atos.

• Transcript

# Practice for the worst — Kelvin Rorive Live from CybersecNL — Episode 2 of 7

Recorded at the Atos booth, CybersecNL 2026. Kelvin Rorive is CISO at ICT Group and runs the Cyber Chain Resilience Consortium (CCRC), which prepares organisations and their suppliers to handle a crisis together. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Day one, and nobody is quite awake yet 01:12 Kelvin: CISO at ICT Group, and what CCRC does 02:05 Why this conference feels like a family reunion 03:09 The message at the booth: practice for the worst 03:34 Survivability — a word picked up from a Ukrainian speaker 04:03 Weerbaarheid, veerkracht, and a telco under drone attack 05:25 Fine for the top 10. What about everyone below? 06:09 "My IT manager will handle it" — and why he won't 07:00 Quint: I talk about business risk, not about cyber 08:31 Crisis in the chain: rehearse it with your supplier present 10:08 Exercises spill over into day-to-day cooperation 10:28 The factory that has to stop because the trucks don't come 12:02 One organisation escalates 1-2-3. The other runs it in reverse. 13:23 CEOs walking out of the room with a list 13:44 Putting the CEO in the hot seat, and not letting them delegate 15:11 What not to do: questionnaire bombardment, and AI filling them in 15:47 Know the CISOs of your critical suppliers personally 16:21 The security family, and why you don't abuse it 18:14 FI-ISAC: competitors around one table, one shared goal 19:41 Compliance is not security 20:11 An APT campaign where every control was green 20:42 NIS2, and whether Europe adapts fast enough 22:11 The balance is shifting from prevention to resilience 22:40 The most important word is not cyber. It is resilience. ## Key takeaways - Survivability sits one level beyond resilience. It starts from the assumption that everything can be broken: people, buildings, data, networks. - A cyber crisis gets handed to the IT manager and then escalates into a chain crisis long before anyone at board level notices. - A crisis exercise only tests the chain if your critical supplier is in the room. Mismatched escalation ladders, unclear responsibilities and missing contacts surface in minutes. - Supplier questionnaires are close to worthless now. They are answered by AI, approved unread, and can be manipulated with instructions hidden in the document. - What works instead is a real relationship with the CISOs of your critical suppliers, used sparingly enough that a call means something. - Compliance is the floor, not the ceiling. Green controls and a long-running intrusion coexist comfortably. - Preventive measures still matter, but the centre of gravity has moved to resilience. Assume something gets through and train the goalkeeper. ## Mentioned Cyber Chain Resilience Consortium — https://ccrc.nl ICT Group — https://ict.eu FI-ISAC, the financial sector information sharing community CybersecNL 2026 — https://www.cybersecnl.nl ## Also in this series Ramsés Gallego on speed and governance — out now. Martin de Vries on sector differences — publishing 24 September. --- SecurityCafe. Powered by Atos.

• Transcript

Speed, governance and a changing landscape — Ramsés Gallego

# Speed, governance and a changing landscape — Ramsés Gallego Special: Live from CybersecNL — Episode 1 of 7 Recorded live at the Atos booth, CybersecNL 2026. Ramsés Gallego is Chief Technologist at DXC, ISACA Hall of Fame, and president of the ISACA Barcelona chapter. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Welcome and introductions 00:42 Why DXC came to CybersecNL: detect more, respond faster 01:28 Rivals, never enemies — why competitors share a stage 02:24 The other side collaborates better than we do 04:28 What integrators owe their customers: service over technology 06:34 A second risk equation: means, motives, opportunities 07:32 Are our frameworks still fit for purpose? 08:29 COBIT 2019 is ageing, and ISACA's AI certification track 09:53 "The human in the loop is dead" — as a reflex, not as a role 10:35 Quantum: RSA, Diffie-Hellman and elliptic curve on the clock 11:55 The part nobody talks about: code signing and certificates 12:38 ISACA Quantum Pulse Poll — the skills gap in numbers 13:21 It is not IT you are protecting. It is the business. 14:01 Trucks that stop delivering, invoices quietly altered 15:02 Why risk has to come from the business, not only the CISO 16:26 Enterprise risk management: risk is always plural 17:22 Should we still be calling it cybersecurity at all? 18:17 Business continuity is not resilience 18:54 The positive side of risk 19:34 Why a car has brakes 20:22 Three pillars: identity, data, applications 21:51 Non-human identities and the 100-to-1 future 23:18 Governance is not management, and we need AI-natives ## Key takeaways - The classic risk equation still holds, but means, motives and opportunities now sits next to it. AI has collapsed the cost of all three. - Business first. Customers do not speak Kubernetes, they speak euros. The database was not hacked — the business was. - Identity remains the cornerstone. Two of the three major incidents discussed on the CybersecNL main stage were identity related. - Non-human identity is the governance problem of the next few years. Almost nobody can say how many agents they run, let alone which accounts sit behind them. - Quantum is not only an encryption story. Code signing, certificates and anything that depends on keeping a secret are in scope. - Brakes let you go fast. Security exists so the business can move, not so it can stop. - Ramsés states that ISACA is already building COBIT 7, returning to a numbered release. Not independently confirmed at the time of publishing. - The 10-to-1 non-human to human identity ratio, and the projected 100-to-1, are cited from industry statistics and not sourced on air. - The 5-to-12-year window for cryptographically relevant quantum computing is Ramsés' own estimate. - ISACA Quantum Pulse Poll figures (2,586 respondents, 67 percent expecting new skill requirements) are quoted from memory. ## Mentioned ISACA — https://www.isaca.org DXC Technology — https://dxc.com Quantum World Association The brakes analogy is credited to Art Wong. ## Also in this series Martin de Vries on sector differences and why we may need a NIST 3 — referenced in this episode, publishing 24 September. Aernout Reijmer on collaboration after ASML — publishing 29 September. --- SecurityCafe. Powered by Atos.

• Transcript

SecurityCafe — Andreas Wuchner: AI, the boardroom, and the bill nobody budgeted for

Andreas Wuchner ran large-scale security organisations for some 30 years and now invests in and advises startups, family offices, VC and PE firms. On geopolitical risk, AI governance, and what AI actually costs. Chapters 00:00 — Welcome 01:00 — In the news: 900+ agents coordinating over a shared channel 05:07 — Geopolitical risk is real, and NIST/ISO don't map it 07:39 — The CybersecNL keynote: is what we built still good enough? 11:40 — "What brings you in jail is non-compliance" 13:00 — The AI governance tooling wave 14:44 — Punish vs enable: pocket money for Big Tech kills a startup 16:53 — The minimum viable control set 17:43 — Fines: where does that money actually go? 22:50 — What AI means for the business, from a board seat 26:30 — Three types of adopters, and AI-native hiring in seven days 32:04 — "Meat proxies": what the AI-native crowd calls the rest of us 34:47 — AI is not cheap: what a €200 subscription really costs 37:10 — $20 per run vs $2.84, same job 39:22 — Outsourcing efficiency promises vs rising AI costs 41:44 — Augmentation vs a greenfield agentic machine room 43:43 — Cooling, solar, subsea, space: the infrastructure race 47:19 — What to read, what to watch Key takeaways A policy keeps you out of jail — and that's all it does. Regulators ask for governance; many tick that box with a document. Anyone declaring AI governance "done" is at the beginning. Define the non-negotiables, then get out of the way. The organisations doing this well name 10 to 50 controls that are not up for discussion and let the rest develop over time — a minimum viable control set. The alternative is the department of no. Token economics is a skill, not a budget line. The same investment-document analysis ran at roughly $20 per company; converting inputs to markdown first brought it to $2.84. A week-long AI strategy course for managers does nothing for the layer that spends the money. Mentioned Log Force — a project in Spain predicting indicators of compromise before they become threats, and spotting when agentic systems start hallucinating. Not a commercial product yet. Tehran — the espionage series from What to Watch Uber's €824,990,000 fine from the Dutch DPA for fully automated driver deactivation, under GDPR Article 22: https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking The Odido breach (February 2026): some 6.4 million people and 600,000 companies, including over 5 million ID document numbers. https://nos.nl/artikel/2604461-odido-hackers-publiceren-resterende-klantdata-ook-miljoenen-id-nummers Meta's settlement over harm to minors: up to $17.1 billion, with 52 US attorneys general — not an EU case. https://www.npr.org/2026/08/26/nx-s1-5944781/meta-settlement-child-safety-lawsuit Powered by Atos

• Transcript

"Sovereignty Is the Wrong Word": Digital Autonomy with Mika Lauhde

SecurityCafe — "Sovereignty Is the Wrong Word": Digital Autonomy with Mika Lauhde Hosts: Menno van der Horst & Quint Ketting Guest: Mika Lauhde, Luxembourg House of Cybersecurity (linkedin.com/in/mika-lauhde-4270711) About this episode Mika Lauhde spent 30 years across Nokia, Huawei, and ENISA before landing at Luxembourg House of Cybersecurity, the national hub keeping Luxembourg's municipalities, SMEs, and economy cyber-resilient. His argument: Europe has the wrong word. Not "sovereignty" — hard borders around who owns what — but autonomy: acting independently while still sharing tools and trust. From GPS glitches during US foreign policy disputes, to Europe always getting the second-best tech (fighter jets included), to a national CERT running entirely on open source — this one covers a lot of ground. In this episode 00:11 — Welcome & Mika's background (Nokia, Huawei, ENISA, Luxembourg House of Cybersecurity) 02:08 — News: an integrator data-leak claim ("888") and what makes integrator breaches different 06:06 — Android's new developer certificate as a "kill switch," African nations building their own internet, UK VPN/age-verification rollout, an EU "tech sovereignty" proposal that leans on non-European hardware 09:11 — A US court ruling that may have quietly broken a GDPR assumption on data transfers 10:34 — NIS2 finally live in NL (15 Aug) — are our laws fast enough for machine-speed attacks? 19:20 — The "SplinterNet," and why Mika argues for shared autonomy over walled-garden sovereignty 23:46 — The Cyber Resilience Act's unprecedented recognition of open source (79 mentions) 24:19 — AI models as the new trade weapon — allies get the previous generation, like fighter jets 26:50 — The GPS/Galileo story, and SES's Iris² as Europe's answer to Starlink 30:15 — EU tax rules that quietly disadvantage open source; the Nokia N900 as Europe's "Sputnik moment" 33:00 — Luxembourg's national CERT runs entirely on open-source tools 34:40 — The call to action: a free open-source toolkit so any EU SME can stand up a cyber ops center 36:41 — What to read: Quint's, Mika's, and Menno's picks 41:04 — Wrap-up Key takeaways Autonomy, not sovereignty — sharing open standards beats walling off borders Dependency is invisible until it breaks — GPS glitches led to Galileo, now to Iris² New tech follows old patterns — AI models, like military hardware, come second-best to allies Open source is operational, not aspirational — Luxembourg's CERT proves it at national scale Mentioned Accenture leak claims (unconfirmed) · NIS2 (NL) · Cyber Resilience Act · European OSPO network · SES Iris² · Trump v. Slaughter ruling Reads: The Subtle Art of Not Giving a Fck* by Mark Manson (markmanson.net/books/subtle-art) · Max Schrems / noyb (noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers) · Bert Hubert's blog (berthub.eu) SecurityCafe is hosted by Menno van der Horst and Quint Ketting. Powered by Atos.

• Transcript

AI Where It Matters, Not AI Everywhere — with Zeina Zakhour, Global Cyber CTO Atos/Eviden

AI Where It Matters, Not AI Everywhere — with Zeina Zakhour, Global CTO Cybersecurity at Eviden (Atos) Recorded live at CISO Day, this episode brings Menno van der Horst and co-host Quint Ketting together with Zeina Zakhour, Global CTO for Cybersecurity at Eviden (Atos), for a fast-moving conversation on where cyber is heading and what it really takes to keep up. We open with a sobering reality: many of today's threats are exposing weaknesses that have existed for decades. The panic isn't warranted — but action is. Zeina makes the case that the issue is rarely a lack of technology depth, but a lack of security depth: the basic hygiene and foundational controls that too many organisations still treat as something for "next year." Spoiler — next year is no longer an option. From there we get into the heart of it: — Adaptive, systemic resilience. Security can't be an afterthought bolted on once innovation ships. It has to sit at the core. We dig into why maturity built once and then left alone decays faster than most leaders expect. — Risk first, always. You don't secure a water utility the way you secure a hospital, a retailer or a bank. Every organisation has its own ecosystem and purpose — and that's where Eviden's Prepare, Respond, Adapt approach starts: understanding who you are, then keeping your risk picture live rather than buried in a spreadsheet updated once a year. — AI, agents and the new attack surface. Not "AI everywhere" — AI where the risk, the data and the friction justify it. We talk identity as the number one attack vector, the danger of human-led processes throttling machine-speed tooling, prompt and meta-prompt injection, agent goal drift, kill switches, and what "identity" even means for an autonomous agent that has intent, makes decisions and calls tools. — Chained vulnerabilities. Why "we'll only fix the high-severity CVEs" is the wrong instinct — low-severity issues can be chained into something genuinely exploitable, fast. — Sovereignty vs autonomy. A crucial distinction too many conflate. We get into data residency, technological sovereignty, the model/middleware/GPU reality of "sovereign AI" today, post-quantum, and why Europe can only answer these questions together rather than country by country. We close where good security conversations always seem to land: sharing more, building a bubble of trust, backing European innovation and startups, and staying agile enough to adapt as the ground keeps shifting. Zeina's recommendations: 📑 Atos Cyber Shield blog and Threat Research Center — regular, genuinely interesting analysis on new campaigns and malware variants. 📖 The Five People You Meet in Heaven by Mitch Albom — nothing to do with cyber, everything to do with being worth your time. 🎧 Listen now, and let us know your take in the comments. #SecurityCafe #Cybersecurity #CISO #AISecurity #Resilience #DigitalSovereignty

• Transcript

Data is the New Uranium: Critical Infrastructure, CISOCommunity & AI with Dimitri van Zantvliet (NS)

A SecurityCafe special, recorded live at CISOday 2026 with Dimitri van Zantvliet — CISO & Cybersecurity Director at Nederlandse Spoorwegen (NS), Chairman of the CISO Community NL and co-founder of CISOday. Host Menno van der Horst is joined by co-host Quint Ketting for a wide-ranging conversation on what it actually takes to defend critical infrastructure in a world where the geopolitical, technological and threat landscape is shifting faster than ever. In this episode: - Why CISOday and the CISO Community NL exist, and how community accelerates maturity across the sector - Becoming a NIS1 critical entity in 2021 and how the war in Ukraine reshaped NS's threat model overnight - Belarusian railway wiperware, Iranian-aligned activity, and the recent railway incident in Florida - Working with NCSC, NCTV, AIVD, the Rail-ISAC and Dutch ISAC to exchange threat intel - Building an in-house CTI team of five — strategic, tactical, operational and technical - The NS Cyber Academy: training people from train drivers to office staff into cyber roles, plus SANS, CISSP and CISA tracks - Why stamina and curiosity beat a classic IT background when hiring — including the case for ex-Olympians, HYROX athletes and journalists - The cultural shift from "my threat intel is my IP" to active two-way sharing across the ecosystem - Supplier risk as a knock-out criterion: no ISO 27001 / SOC 2 Type 2, no business - AI and Gen.AI as the new frontier — from "data is the new gold" to "data is the new uranium" - Quantum on the horizon, and why the impact reaches far beyond encryption - The basics still decide everything: MFA, passwords, segmentation — and the move toward real-time patching - Autonomous agents as the next attack vector we don't yet fully understand - Historical parallels, from the AIDS Trojan on floppy disk to ILOVEYOU and SQL Slammer - Nassim Taleb's Antifragile — and why "prepare, respond, adapt" is the cycle every organisation needs - Cybersecurity is no longer an IT conversation; it's geopolitics, brand, and business continuity Book of the episode: - Antifragile — Nassim Nicholas Taleb About the guest: Dimitri van Zantvliet is CISO & Cybersecurity Director at NS, Chairman of the CISO Community NL and co-founder of CISOday. He joined NS five years ago and has led the organisation's response to the post-2021 shift in geopolitical and cyber risk affecting European critical infrastructure. Working at NS: Dimitri's team is hiring. If cybersecurity at one of the Netherlands' most critical infrastructure providers sounds like your kind of challenge, check the openings at werkenbijns.nl. About SecurityCafe: SecurityCafe is hosted by Menno van der Horst with co-host Quint Ketting — an open conversation about the strategic, technical and human sides of cybersecurity. Produced by Quint Ketting. Subscribe wherever you get your podcasts. This CISOday special was made possible in partnership with Atos.

• Transcript

SecurityCafe Special | Mythos – Facts, Fiction and What You Need to Do Now

About this episode In this special edition of SecurityCafe, Quint Ketting and Koen Maris join host Menno van der Horst for an open, no-nonsense conversation about Mythos — Anthropic's frontier AI model expected to become more widely available around mid-August. No panic, no hype — just an honest look at what will actually change, and what your organization should already have been doing. What we cover Mythos: revolution or evolution? Koen opens with a sharp reality check: if it takes five days to build an exploit today and Mythos brings that down to twenty hours — how much really changes? The hype around Mythos risks drawing attention away from what's already happening. Claude Opus 4.7 is already live, carrying many of the same capabilities, with barely anyone noticing. The real shift: accessibility The barrier to sophisticated attacks is dropping fast. It's not that experts are becoming more dangerous — it's the new wave of attackers without deep technical skills that warrants concern. Quint illustrates the point with his own experience using Claude: from building custom tools to recovering audio from a faulty recording. What this means for your organization Cyber hygiene first. If your foundations aren't in order, you already have a problem — Mythos just makes it more visible and more urgent. Third-party contracts. Patch response clauses of 90 days or more are no longer viable. Time to renegotiate. Asset management. If you don't know what you have, you don't know what to protect. A scan often reveals 40% more assets than organizations think they manage. Exposure management. Unmanaged assets are exactly where attackers will strike first. Patch cycles. Microsoft recently released 250 patches in a single Patch Tuesday — normally 10 to 20. That pattern is not a coincidence. Prepare, Respond, Adapt Koen introduces the PRA framework: we are currently in a fragile peace. Use this window well. Organizations that prepare thoroughly will weather the storm quickly. Those that don't may find themselves in a prolonged and costly recovery. Frontier AI: the next buzzword — and what it actually means Mythos is part of a broader phenomenon. Vendors like Palo Alto are already embedding the same AI engines into their defensive toolsets. The question isn't whether this will affect you — it's whether you'll be ready. Project Glasswing & responsible disclosure Anthropic has given early access to a select group of major technology companies, resulting in both an explosion of patches and new AI-powered defenses. Responsible management of this capability is exactly the right approach — and a model the industry should follow. Key takeaways Start an internal working group now. Structure it with proper governance, board-level reporting, and weekly progress reviews. Review your third-party agreements: do your SLAs still hold in a world of 24/7 patching? Don't wait for Mythos to get your basics right. A low security maturity level cannot be fixed in two months. Frontier AI is the bigger frame. Follow developments across Anthropic, Google, and others — not just the Mythos headlines. Guests linkedin.com/in/menno-van-der-horst-74710794 linkedin.com/in/koen-maris linkedin.com/in/quintketting

• Transcript

Navigating the Future of Cybersecurity, Frontier-AI, and Society: Insights from the Security Café

SecurityCafe – Liesbeth Holterman, Cyberveilig Nederland Hosts: Quint Ketting & Menno Recorded: Eindhoven Studio (our first ever in-person guest!) We always say: Prepare. Respond. Adapt. — Quint's microphone broke mid-recording. We practiced what we preached. 🎙️💀 About Our Guest Liesbeth Holterman is Managing Director of Cyberveilig Nederland — the Dutch trade association for the cybersecurity industry, focused on improving quality, transparency, and the digital resilience of the Netherlands. What We Discussed Data leaks — daily news, preventable problems Breaches are no longer weekly — they're daily. Social engineering, not sophisticated hacking, is the attacker's weapon of choice. The Odido case is a perfect example. Basic cyber hygiene remains the answer. Check your credentials: 👉 HaveIBeenPwned.com AI & Mythos — marketing or menace? Agentic AI can scan environments and find zero-days at scale. Bad actors have been using LLMs for a while already — what's new is that low-skill attackers now have access too. Bruce Schneier calls some of the fear "marketing hype" — but the underlying shift is real. The good news: in 4–5 years, defence will benefit just as much. 👉 Schneier on Security NIS2 & EU legislation Don't know where to start with cyber hygiene? Read NIS2 Article 21 — it's a solid baseline checklist. Legislation is finally getting boards to ask the right questions. 👉 NIS2 Directive | Article 21 Dutch critical infrastructure The Netherlands' legendary efficiency — remote dikes, interconnected logistics, everything online — is also its biggest attack surface. The cybersecurity workforce of tomorrow AI will reshape roles like pen testing and SOC analysis. But the need for cyber professionals is still enormous. The sector isn't thinking strategically enough about what this means. Liesbeth's call: reach out, collaborate, have the conversation. 👉 cyberveilignederland.nl 🎬 Recommendations Quint → Hanna (Amazon Prime) A girl targeted by a CIA program for what an algorithm predicts she'll do — not what she's done. A thought-provoking lens on AI, surveillance, and pre-emptive power. 👉 IMDb Liesbeth → The Boys (Amazon Prime) Superheroes in the hands of a private corporation guided by profit, not public interest. Sound familiar? 👉 IMDb SecurityCafe — because good security conversations deserve good coffee.

• Transcript

The Rise of the Agents & Modern Geopolitics

Host: Menno van der Horst Regular Guest & Chief Storyteller: Quint Ketting Special Guest: Jan Paul Oosterom (EMEA Regional Business Lead for Security, Microsoft) Episode Summary In this episode, the trio dives into the rapidly shifting threat landscape. While geopolitical tensions remain the "elephant in the room," the real tactical shift is happening within the realm of AI Agents. Jan Paul explains why identity management is no longer just about people—it’s about governing the thousands of non-human entities now operating within corporate environments. The team discusses the "Assume Breach" mindset, the death of "badly written" phishing emails, and why protecting your Intellectual Property (IP) requires a deep understanding of who exactly is targeting you. Key Takeaways The Identity of Agents: We are moving beyond managing human access. Organizations now face the challenge of managing non-human identities (AI Agents) that have their own permissions, access levels, and potential for "rogue" behavior. Assume Breach as a Culture: Security isn't just a set of tools; it’s a mindset. "Assume Breach" means every employee and executive must operate with the default action of verifying before acting, especially regarding financial transactions or data access. The Intellectual Property Target: Threat intelligence isn't one-size-fits-all. A camera manufacturer faces different risks (IP theft) than a national tax office (financial disruption). Knowing your "Why" helps you build the right "How." Timestamped Highlights [01:10] – Jan Paul Oosterom’s role at Microsoft and his remit across EMEA. [03:45] – The "Elephant in the Room": Geopolitical risks and the pace of AI evolution. [05:50] – The 10,000 Agent Problem: How one customer already has a massive fleet of autonomous agents running. [07:20] – Deep dive into Identity Management: Protecting non-human identities. [12:15] – The evolution of phishing: Why attackers are now "spot on" with their messaging. [15:30] – The "Assume Breach" mindset: Moving from "Can we stop it?" to "How do we respond when it fails?" [18:45] – Threat Intel: Identifying your specific enemies based on your business IP. [24:10] – Closing thoughts: Why the Board needs to be challenged on security. Memorable Quotes "The days that we were able to easily recognize something bad are over." — Jan Paul Oosterom "What you need to protect is probably not what you have budget for. You need to get those things in line." — Quint Ketting "If you cannot truly verify that what you see is real or good—stop it and start asking questions." — Jan Paul Oosterom The Recommendation Corner Movie: Minority Report (Recommended by Jan Paul Oosterom) Why: It explores the philosophical and ethical boundaries of "Predictive Systems"—how far can we go in flagging "criminal behavior" before a crime is even committed? Quint was referring to a movie which was actually a Serie called: Hannah

• Transcript

Bonus Episode: The AI Shift: From Script Kiddies to Agentic Warfare

SecurityCafe Podcast: Bonus Episode The AI Shift: From Script Kiddies to Agentic Warfare In this unplanned, deep-dive "after-talk," Menno Van Der Horst, Quint Ketting, and Max Heinemeyer peel back the curtain on the rapid evolution of AI in cybersecurity. Recorded just weeks after a massive shift in the landscape, the trio discusses why the "old ways" of hacking are being supercharged by AI agents and what this means for national resilience. Key Takeaways The Scaling of Social Engineering: Data leaks (passports, IBANs, addresses) are no longer just static dumps; AI can now process these at scale to create hyper-personalized phishing campaigns for thousands of victims simultaneously. The "Agentic" Shift: We are moving from static scripts to AI Agents. Unlike traditional malware, agents can make autonomous decisions, potentially making them more effective but also far more unpredictable and dangerous (the "Stuxnet with a brain" scenario). The Defender’s Dilemma: While attackers don't care about "breaking" systems as long as they get in, defenders and penetration testers must remain deterministic and safe—a gap that AI is currently making harder to bridge. Systemic Resilience: Cybersecurity is no longer just about protecting a single company; it’s about the "ecosystem." National security now depends on how well the entire supply chain—from big telcos to small vendors—is defended. Timestamped Highlights [00:41] The Four-Week Shift: Max explains how AI has hit the mainstream for both attackers and personal assistance (OpenCloud, NotebookLM). [01:15] Weaponizing Data Dumps: How AI turns old-school data leaks into targeted, automated social engineering machines. [02:45] From SQLi to Prompt Injection: Quint draws a parallel between the early days of SQL injection and the modern "hobby" of breaking LLM guardrails. [04:48] Nation-State Guardrails: A look at how China and other actors use Western AI infrastructure and the risks of "spillover" (WannaCry style) in AI-led operations. [08:27] The "Autonomous Stuxnet": What happens when an attack isn't run by a human, but by an agent with its own prompts? [09:38] The Car Wash Paradox: Menno shares a hilarious (yet scary) anecdote about an AI losing the plot, illustrating why "hallucinations" in autonomous pen-testing are a major liability. [12:39] The End of the Human Bottleneck: Max discusses how AI is removing the "human hands" requirement for vulnerability research and exploit development. [16:40] The "Football Team" Analogy: Quint argues that cybersecurity needs to move past silos—even the best "players" (companies) lose if they don't play as a coordinated unit. [21:17] Reason for Optimism: Why Max believes NIS2 and the rise of ML-driven SOC operations give defenders a fighting chance to regain the upper hand. Links & Resources Mentioned Backtrack / Kali Linux: The "old school" penetration testing roots. DARPA Grand Challenge (2016): The early race for autonomous cyber defense (Shellphish & Mayhem). NIS2 Directive: The evolving European legislation for cybersecurity. Sven Herpig: Mentioned as a leading researcher on nation-state cyber policy.

The Year of the Data Leak: Why SaaS is the New Frontier (with Max Heinemeyer & Quint Ketting)

Show Notes | Episode: The Year of the Data Leak Welcome back to the Security Cafe, the podcast where we discuss cybersecurity with good coffee, questionable humor, and guests who—for their own good—know far too much about the cyber world. In this episode, your host Menno Van Der Horst sits down with regular guest Quint Ketting (our human equivalent of a SIEM) and special guest Max Heinemeyer, a heavyweight in cyber threat intelligence and AI-driven defense. As we kick off 2026, one thing is clear: the battlefield has shifted. We are no longer just fighting off ransomware; we are living in the "Year of the Data Leak." From massive telco breaches to compromised SaaS environments, the tactics are getting louder, faster, and more automated. In this episode, we break down: The Pivot in Tactics: Why attackers are moving away from complex network encryption and towards "low-hanging fruit" like CRM databases and SaaS solutions. The Identity Crisis: How AI-driven social engineering is becoming a machine, making phishing attempts nearly indistinguishable from reality. The "Least Privilege" Paradox: Why do we still struggle with basic principles 20 years later? We discuss how a single helpdesk account can lead to 6 million compromised records. Boardroom Liability & NIS2: Moving from "security as a risk" to personal accountability for the C-suite. The Watchlist: Why Mr. Robot is being outpaced by reality and which "hacker" shows you should avoid at all costs. Special Guest Highlight: Stick around for a meta-moment where Max’s own security team accidentally proves that real-world controls actually work during our recording. Grab your coffee, log your accounts, and join us in the chaos.

Navigating Cybersecurity in a Geopolitical Landscape

Summary: In this episode of the Cybersecurity Cafe, Menno Van Der Horst, Koen, and Quint Ketting delve into the complexities of cybersecurity in the context of geopolitical tensions and digital autonomy. They discuss the importance of preparation, adaptation, and response in maintaining business resilience and sovereignty. The conversation also touches on the role of cybersecurity frameworks like ISO 27001 and NIST in enhancing organizational resilience. Keywords: cybersecurity, digital autonomy, geopolitical tensions, business resilience, ISO 27001, NIST, sovereignty, cyber resilience, cybersecurity frameworks, digital sovereignty Takeaways: Sovereignty is becoming a crucial topic in cybersecurity. Preparation, adaptation, and response are key to resilience. Geopolitical tensions impact digital autonomy. ISO 27001 and NIST frameworks aid in resilience. Understanding your organization's purpose is vital. Cyber resilience protects brand and organization. Frameworks focus on preventing incidents. Resilience ensures business continuity. Digital sovereignty is linked to data control. Effective cybersecurity requires both planning and execution.

What to Expect in 2026?

🎄 Security Café Christmas Special! 🎄 What does the future of cybersecurity look like in 2026? In this episode of the Security Cafe Podcast, host Menno van der Horst and guests Quint Ketting and Fred Streefland discuss the future of cybersecurity, focusing on predictions for 2026. They explore current trends, the impact of AI, the importance of government involvement, and the need for digital education. The conversation highlights the increasing threat of cybercrime and the necessity for organizations to adapt to new challenges in the digital landscape. ✔ AI-driven security & prompt injection challenges ✔ Why government involvement is critical ✔ The role of digital education for future generations ✔ How collaboration can fight cybercrime – now the third-largest economy in the world Grab a coffee (or a mulled wine 🍷) and tune in to this insightful conversation! 🎧 Listen now! #Cybersecurity #ChristmasSpecial #AI #DigitalEducation #Cybercrime #SecurityTrends #Technology

AI and Cybersecurity: A New Frontier

In this episode of the Security Cafe Podcast, host Menno Van Der Horst and guests Ahmed Achchak and Quint Ketting discuss the intersection of AI and cybersecurity. They explore how AI can be both a tool for attackers and a defense mechanism for businesses. The conversation delves into the importance of trust in AI systems, the role of data in enhancing security operations, and the challenges posed by generative AI. The episode emphasizes the need for basic cybersecurity hygiene and the potential of AI to transform security operations while maintaining human oversight. Video Link: SecurityCafe ep29