Zurich, Switzerland, September 23, 2026
Three weeks after GCC26, many of the discussions are still with us.
The main theme of the Global Cyber Conference, held on 1 and 2 September 2026 at The Dolder Grand in Zurich, was CONVERGENCE. Cybersecurity, AI and quantum remain distinct fields, but the challenges they create are becoming increasingly connected.
A few ideas kept coming back across the two days. Security decisions increasingly affect the wider business. AI is shortening the time between identifying a problem and having to respond to it. Resilience needs to be built before something goes wrong. And the role of the CISO is becoming broader, connecting technical risk with business priorities.
That’s the short version. Let’s relive the two days and take a closer look at the topics we covered and the lessons we took away.
Day 1: When the boundaries of security expand
On 1 September 2026, The Dolder Grand opened its doors to more than 300 CISOs, senior cybersecurity and AI executives, academics and technology providers. After registration, participants joined the Networking Breakfast, the first of many opportunities to connect in a unique conference format that balanced 50% networking and 50% learning sessions.
Samir Aliyev, Host, Founder and CEO of the Swiss Cyber Institute, opened the conference with a reflection on the challenges we face in today’s world: exponential technological growth, unpredictability and growing uncertainty. He spoke about the importance of building value-driven businesses and investing in people, their skills, and their ability to adapt. His message set the tone for the two days ahead: navigating technological change requires not only innovation, but also strong communities, continuous learning and a clear sense of responsibility.
Florian Schütz, Director of the National Cyber Security Centre (NCSC), opened the keynote program with Switzerland’s approach to cyber resilience, AI innovation, technological dependencies, and regulation. His message went beyond cyber defense. Resilience also depends on the choices a country makes around innovation, infrastructure, and regulation.
Luca Tagliaretti (European Cybersecurity Competence Centre) widened that perspective to Europe. With critical infrastructure increasingly exposed to geopolitical pressure, he focused on cross-border cooperation, shared capabilities, and earlier warning.
Prof. Dr. Anna-Lena Horlemann (University of St.Gallen) then pushed the risk horizon much further ahead. In The Quantum Threat, she explained why organizations may need to prepare long before quantum computers can challenge today’s cryptography.
Lucas Kello (Oxford University) moved the discussion in another direction. In Corporate Geopolitics, he explored what happens when geopolitical fragmentation and technological disruption begin to challenge the assumptions behind corporate risk strategies.
The Tech Horizon panel brought the conversation closer to decisions businesses are making now. Florian Tramèr (ETH Zurich), Jens Zerbst, CIO at Vattenfall, and Thomas Rhomberg, Global CISO at Hilti, joined Samir Aliyev to discuss which technologies are most likely to reshape business models and risk profiles in the near term.
By lunch, a clear pattern had emerged. Quantum security, geopolitics and national resilience were all raising questions that reach far beyond the security function. They affect investment, governance, infrastructure, and long-term planning. For business leaders, these topics have become part of the same conversation.
The security problem is getting broader
After lunch, Daniel Walther (die Mobiliar) opened the afternoon program with CISO 2.0.
His keynote focused on how the role of the CISO is changing. The technical core remains, but the role increasingly extends into strategy, risk, education, and change, while expectations from boards, regulators, and internal teams continue to grow.
The People panel followed from a different angle. Jonathan Sinclair (Roche), Michael Mullen, Detective Superintendent Cyber at An Garda Síochána, and Rastislav Kovac (CEPOL) discussed what it takes to keep security teams healthy, skilled, and motivated under sustained pressure. Dr. Diana Coman Schmid, CISO at Canton Glarus, moderated the discussion.
At the same time, the program extended beyond the main stage. Smaller roundtables were running in other rooms, giving participants the choice to follow the topics most relevant to them.
One of them, Riskboard, made the problem more concrete. James Packer and Marc Minar (EY Switzerland) asked participants to assess AI, quantum, and geopolitical risks against a sample organization and decide where existing controls might no longer be enough.
The exercise showed how quickly a technical risk can extend beyond security. AI, quantum, or geopolitical risk may begin in very different places, but the decisions around them can involve several parts of the organization.
Fewer security decisions can sit with the security team alone. That creates a practical tension: more people may need to be involved in those decisions, while the time available to make them is getting shorter.
Less time between knowing and acting
The next sessions showed why.
Back on the main stage, Jan Fecko’s Aftermath looked at what organizations change after a major cyber event, while the Culture panel asked how those lessons become everyday behavior.
Both pointed to the same practical issue: when an incident happens, there is little time to build the structures, habits, and ownership that should already be in place.
At the same time, the parallel program became more hands-on.
In the Risk Intelligence roundtable, Mirco Rohr (Mastercard) asked participants to look beyond vulnerability counts and maturity scores and focus instead on exposure, priorities, investment, and the actions that would actually reduce risk.
In The Breach Next Door, Frederic Buchi, CISO at Swiss Securitas Group, and Antonio Mecci (DSwiss AG) worked through a realistic supply-chain scenario: a supplier calls to tell you they have been breached. What happens next? And more importantly: what had already been decided before that call came?
Back on the main stage, AI shortened that window even further.
In his Frontier AI keynote, Roman Haltinner (EY Switzerland) explored what happens when AI identifies vulnerabilities faster than organizations can respond. Better detection can also mean less time to prioritize, contain, and decide what can safely be automated.
Greater capability can also mean less time. The faster organizations identify a problem, the more important it becomes to have priorities, ownership, and response paths already in place.
What security teams need to protect is changing
The final keynote before the afternoon break moved into less familiar territory. In The Brain as Data, Patrick Ghion, Chief Cyber Strategy Officer at Geneva State Police, explored brain-computer interfaces as a new source of highly personal data, raising questions around privacy, unauthorized access, manipulation, and identity.
After a well-deserved coffee break, the conference spread again into smaller roundtables and peer discussions. AI remained one of the strongest threads.
Seamus Lennon, Vice President of Operations for EMEA at ThreatLocker, looked at AI tools already appearing inside organizations without security teams necessarily knowing they are there. Guido Salvaneschi (University of St.Gallen) and Samir Aliyev explored what changes when AI becomes both a tool for building software and part of what organizations need to secure.
Later, Kevin Schwarz (Zscaler) returned to the growing contest between attack and defense as frontier models become more capable. Elsewhere, the Hacking Clinic put participants on the other side: Matthias Gsteiger, Deputy SOC Leader at Canton of Zurich, and Marco Agostini, Lecturer at the Swiss Cyber Institute and Co-Founder of BeeManaged GmbH, walked through the opening moves of an intrusion: find, scan, attack.
By the end of the afternoon, the range stretched from neural data and hidden AI use to frontier models and hands-on attack paths. Security teams are having to understand new assets, tools, and risks while familiar threats continue to evolve.
Recognizing the people behind security leadership
After hours spent discussing the pressures, decisions, and changing expectations facing security leaders, Day 1 closed with the Swiss CISO Awards Ceremony at The Dolder Grand.
Dr. Anatoli Kalysch (Lindenhofgruppe AG) was recognized as Swiss CISO of the Year, while Andra-Irina Vasile (SIX Group) was recognized as the Future Leader category winner. Kai Schramm of TWINT, Tobias Castagna of the National Test Institute for Cybersecurity, and Nathalie Gratzer of NATO CCDCOE were honored with Cybersecurity Excellence Awards. You can read more about the Swiss CISO Awards 2026 winners and their achievements in the official press release.
The Swiss CISO Awards Ceremony and the Gala Dinner is one of the traditions and highlights of the conference. Since four years the Awards have been recognizing established leaders and emerging talent working in Switzerland for their achievements in cybersecurity. They showcase successful approaches, encourage professional exchange, and aim to inspire the next generation of security leaders. A perfect closure of Day 1.
Day 2: When speed meets accountability
Day 2 began with the networking breakfast, as participants returned to conversations started the day before and prepared for another full program of keynotes, panels, and roundtables.
The focus soon shifted back to the main stage, where Dr. Anatoli Kalysch (Lindenhofgruppe AG) returned less than a day after being named the Swiss CISO of the Year.
In Humans vs. AI, he drew on his experience in a Swiss hospital group to explore what happens when AI moves beyond producing outputs and starts planning, acting, and connecting different tools across clinical, financial, and operational decisions.
More autonomy can mean faster decisions. But it also makes responsibility harder to locate when the consequences become more serious.
From individual systems to a wider strategy
The next panel moved the discussion to a broader set of questions.
In Futureproof, Douglas Andrews, CISO at Galenica AG, Jan Fecko (Ericsson), and Simon Ganiere (Lombard Odier), joined moderator Lucas Kello (Oxford University) to look at how cyber, AI, and quantum risks fit into one longer-term strategy.
The question was not simply which technology comes next, but what organizations should already be preparing for.
From there, the morning split across the main stage and parallel roundtables.
Sandro Nafzger, CEO and Co-Founder of SignalFisher, challenged whether two or three penetration tests a year are enough when threats keep changing. In parallel, Sunny Begala (CrowdStrike) explored what happens when AI in the SOC moves from assistance toward automated workflows and more autonomous decisions.
The Data Trust panel focused on what those systems depend on. Arlind Spahija, Head AI at Migros Bank, Francisco Matos, Compliance Director at Legora, and Perry Young (Kyndryl), discussed data quality, ownership, privacy, and provenance, moderated by Monica Kello (King’s College London).
Elsewhere, From Cold to Warm moved the question into the boardroom. Chris Verdonck and Dr. Maya Bundt (Cybersecurity Board Reporting) started from a striking finding: only 31% of directors in the 2025 Cybersecurity Board Reporting study said they received the right information to govern cyber risk.
The issue was not simply how much information reached the board, but whether it helped directors decide.
In his Security at Speed keynote, Perry Young (Kyndryl) drew on the experience of financial markets, where security had to be built into architecture, identity, limits, observability, and recovery from the start. Human intervention alone could not keep pace with the speed of the systems involved.
The morning talks and discussions pointed to the same conclusion from different angles. Testing, trustworthy data, board-level decisions, and built-in controls all need to work together if organizations want to move faster without increasing risk.
When technology becomes an organizational question
After lunch, the conversation continued on the main stage and in the breakout rooms.
Henrique Teixeira (Saviynt) opened the main stage with Identity Security, looking at how AI is expanding identity beyond people to machines and autonomous agents. As more systems can act on behalf of an organization, who or what is allowed to do what becomes a bigger security question.
In parallel, Ivan Kalakashkin (Security Service of Ukraine) brought a very different perspective in Cyber War, focused on detecting, withstanding, and adapting to sustained state-sponsored attacks.
Then AI Governance brought the question inside the organization. Antonio Martiradonna (Orkla ASA), Melanie Kolbe-Guyot, Head of Data Governance and Compliance at Statistisches Amt Basel-Stadt, and Simon Gooch (Saviynt), explored how legal, risk, security, data, and product teams turn governance principles into decisions and oversight. Marc Henauer (National Cyber Security Centre NCSC) moderated.
A technical issue may begin with the security team, but the decisions that follow often involve the wider organization. Governance, investment, operations, and leadership all become part of the response.
The people living through the change
By mid-afternoon, the focus had shifted from governing new technology to the people expected to live through the change.
In Transitions, Malonie Guha (SKF Vertevo) explored how organizations can navigate AI- and quantum-driven change without losing trust or momentum. Communication, reskilling, and organizational design were all part of that challenge.
The New Work panel continued from there. Mustafa Jaffar, Global Head of Talent at Standard Chartered Bank, and Samir Aliyev, Founder and CEO of the Swiss Cyber Institute, discussed how roles are changing, which skills may matter next, and how organizations can support people through that transition.
AI and quantum may drive the change, but people will determine how well organizations adapt to it.
The closing keynotes looked further ahead. Prof. Dr. Anna Zeiter (W Social) explored trust in online spaces through open protocols, verified human identity, and privacy by design in Future of Internet.
Florian Tramèr (ETH Zurich) then closed the formal program with Future of Agents, looking at how quickly AI capabilities have moved and what that trajectory could mean by 2028.
The formal program ended there. The conversations did not.
For another two hours, the Networking Apéro Riche brought speakers, participants, and partners back together to compare notes and continue discussions before leaving The Dolder Grand.
What stayed with us after GCC26
Let’s conclude. Security decisions now involve various parts of the organization. Technical risk, business priorities, regulation, and people are increasingly connected. AI is adding speed and putting more pressure on organizations to make good decisions quickly.
That makes preparation more important: clear ownership, controls built in early, information people can actually use, and the skills to make decisions when pressure arrives. The CISO role is becoming broader not because security should own everything, but because more decisions need to connect security with the rest of the organization.
Visit our photo albums and relive the highlights of the Global Cyber Conference 2026
The dialogue does not end here. Preparations for Global Cyber Conference 2027 are already underway, promising new perspectives, formats, and collaborations.
Stay tuned for updates and be part of the next chapter.
