SecurityCafé

For the first time ever, SecurityCafe breaks its own "no selling" rule. Menno van der Horst and Quint Ketting sit down with Emily Jacometti, co-founder of HackShield, the free game that teaches children aged 7 to 12 to stay safe online. But first: a week of disruptive incidents across Europe.

## Timestamps

00:00 Intro: why we're breaking our own rule

01:15 What HackShield is

02:31 News: hijacked supermarket freezers in France

05:06 Younger victims, younger perpetrators

06:02 News: the Ahold Delhaize security incident

07:17 News: Danish data leak behind a 123456 password

09:10 Why gamification beats traditional awareness

12:48 Why start at age 7: the swimming lessons analogy

14:10 Home, school and community: reaching every child

17:09 One in three kids talks to strangers in games

19:19 From serious gaming to HackShield: Emily's story

22:08 The model: free, no advertising, no data sales

24:42 How cybersecurity companies contribute and volunteer

26:47 The Europol Wi-Fi sniffer case

28:14 Golden tickets and the path to ethical hacking

31:26 Nine countries, aiming for 10,000,001 kids by 2030

33:49 Why a social media ban alone is not the answer

35:42 What's in it for companies: tenders, marketing, people

40:19 Creativity and adaptability as the skills of the future

44:41 Recommendations

## Key takeaways

- Predictable passwords still cause major incidents, from supermarket freezers to millions of citizen records.

- Cybercrime perpetrators are getting younger, and criminals use gamification to recruit them.

- People learn by doing: a game lets kids fail safely and try again.

- Start before a child gets their first device, not after.

- HackShield is free, ad-free and does not sell data; public and private partners fund it.

- For partners: social return in tenders, soft marketing, purpose for employees and an early view of talent.

- Bans alone don't work. Teach kids to swim instead of draining the pool.

## A note on facts

- News items reflect what was known at the time of recording; investigations into the French freezer incident and the Ahold Delhaize incident were ongoing, and reported figures for the Danish leak vary.

- Survey figures and country-specific observations are HackShield's own data and experience.

- The Europol Wi-Fi sniffer case is discussed as the guest understands it; the case involves minors.

## Mentioned

- HackShield: https://joinhackshield.com

- DIVD Academy: https://www.divd.nl

- The Social Reckoning (film, 2026)

- Jane McGonigal, Reality Is Broken

- David Dewulf, Lateral Movement (October 2026, featuring Quint Ketting, Dimitri van Zantvliet and Max Heinemeier)

---

Powered by Atos

Note: the video focus slipped during this live recording at the

booth. The conversation is the point, and the audio version is

unaffected.

Recorded at the Atos booth, CybersecNL 2026, minutes after Martin's

main stage talk. Martin de Vries has worked in security across

three sectors: banking, higher education and industry. He was CISO

at a Dutch university when it was hit by a cyberattack, and now

works in the industrial sector. Hosted by Menno van der Horst with

Quint Ketting.

## Timestamps

00:00 Straight from the main stage

00:50 Three sectors: banking, higher education, industry

01:41 What changes when you move sectors: culture

02:26 What doesn't: listening, relationships, threats and risks

02:50 From highly regulated to compliance as an afterthought

03:20 The CISO as facilitator

04:20 "I own the process, not the risk"

05:28 Why "I told you so" isn't the answer

05:49 Accepting risk at the right level

06:24 Acquisitions, due diligence and security

07:28 The shelved report, and the ransomware that followed

09:42 You don't spend a million to avoid 1.2

10:12 The cyberattack on the university

12:18 A Signal message on a Saturday evening

13:19 Deciding near midnight without the business present

13:43 Having the mandate versus taking it

15:00 IT back online within a week

15:41 Postponing an entire exam week

17:13 Research grant deadlines and month-end salaries

18:20 Disconnecting the network, and session tokens expiring

19:01 Restoring, and in which order to reconnect

19:39 Taking care of your teams

21:59 Sending a whole team home for twelve hours

22:21 Quint: Slammer, and sleeping at the office at twenty

23:08 Room for the personal during a crisis

25:07 Sunday 9 a.m.: what do we share?

25:44 At a university, internal communication is public

26:17 One update per day, at a fixed time

28:32 Openness as part of the culture

29:44 Closing: talk to your counterparts in other sectors

## Key takeaways

- Moving sectors changes the culture and maturity you work in.

Threats, risks, measures and the need to listen stay the same.

- The CISO owns the risk process, not the risk. The job is to

find the risk owner and make sure the risk is understood and

accepted at the right level.

- After an incident, fix first. Then revisit the trade-off between

impact and the cost of prevention.

- Write down the mandate to disconnect, and make sure the rest of

the organisation knows it exists.

- Technical recovery within a week came from years of investing

in processes. The business impact, from exams to grants to

payroll, ran much longer.

- Look after your people. Rotate shifts, and when needed send a

whole team home.

- Communicate once a day at a fixed time, identically internally

and externally. It prevents everyone from refreshing for news.

- Share what happened, so others don't make the same mistakes.

## Mentioned

Fox-IT, which presented the incident analysis

Maastricht University, which shared openly after its 2019

ransomware attack

## The full series

Ramsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmer,

Mandy Andress, Gilad Friedman and Martin de Vries.

---

SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Gilad Friedman is part of the agentic AI protection team at Radware, a cybersecurity company with nearly 30 years in the business. Hosted by Menno van der Horst with Quint Ketting. Atos and Radware are partners.

## Timestamps

00:00 Recording number seven or eight — nobody is counting anymore

00:35 Gilad: Radware and agentic AI protection

01:40 The first AI risk isn't security. It's governance.

02:05 Then compliance and data leakage, then security

02:40 What people put into AI, and why they bypass the approved tools

03:40 AI-first boards and private accounts at work

04:55 Where are the agents, how many, and what access do they have?

05:15 Shadow AI

05:40 "Our AI policy is simple: it's not allowed"

06:10 Why blocking doesn't work

06:46 A policy is not protection

07:15 One enforcement point instead of twenty vendors

07:40 How do you get visibility on shadow AI?

08:15 Desktop, cloud, mobile and gateway

09:07 The hotel guest, the telecom and legal liability

10:00 On the verge of an explosion

10:30 Connecting AI the way we connected to the internet in the 90s

11:40 Customers: stop the fear, show us enablement

12:45 Build processes that expect the unexpected

13:04 Are today's controls enough for what is already out there?

13:50 What changes is the speed of response

14:20 Prompt injection: planted yesterday, triggered today

15:10 Stopping it, not only detecting it

16:10 Looking back: is your baseline good enough?

16:30 Indirect prompt injection, hallucinations and tool misuse

17:15 Agents inherit the credentials of the user

18:00 How many agents do you have? A silent audience

18:40 Radware drinks its own champagne

19:45 Most of it isn't malicious

20:05 Is credential inheritance simply bad design?

20:30 LLMs can't tell instructions from data

20:55 Infrastructure, architecture, governance, visibility, control

21:25 The major AI incident will come. We just don't know when.

## Key takeaways

- The first AI risk organisations run into is governance: they do

not know which AI tools and agents exist. Compliance and data

leakage come second, security third.

- Blocking AI does not stop its use. People move to private

accounts, other devices and the web. A policy only works when

you can enforce it.

- Visibility has to cover desktop, cloud, mobile and the network

edge, ideally from one enforcement point rather than a tool per

vendor.

- Agents inherit the credentials and permissions of the user who

runs them. That turns every shared document into a possible

attack path.

- LLMs cannot distinguish instructions from data. An instruction

hidden in an email, file, image or voice message gets executed

with the victim's access.

- Detection alone is not enough. When an agent asked to review a

document starts touching financial systems, it has to be

stopped automatically.

- Most shadow AI is not malicious. It is people trying to keep up

with an AI-first mandate. Enablement works better than fear.

## Mentioned

Radware — https://www.radware.com

## Also in this series

Ramsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmer

and Mandy Andress — out now.

Martin de Vries on securing different sectors — the series finale.

---

SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Mandy Andress is CISO
at Elastic, where she has worked for eight years. She was at
CybersecNL to deliver a keynote on moving security from human
speed to machine speed. Hosted by Menno van der Horst with Quint
Ketting. Atos and Elastic work together in several areas,
including search and SOC operations.

## Timestamps
00:00 Welcome, third recording of day two
00:16 Mandy: CISO at Elastic, and why she came to CybersecNL
00:58 How Atos and Elastic already work together
01:30 Speed, trust and instinct: incidents at human speed
02:06 Processes built on human delay no longer hold
02:47 The AI-native mindset security needs
03:22 Real-time analysis, and grounding AI with context
04:21 Drinking your own champagne
05:08 Open code, public detection rules, no black box
05:50 Sharing how the security team works, not only what it ships
06:16 "If I keep it to myself, I'm safer"
06:49 Security by obscurity is dead
07:29 Isn't all that openness a risk?
08:15 Knowing your coverage and your gaps as a practitioner
09:05 Security first versus commercial reality
10:14 Eight years at Elastic, and running security on the ELK stack
11:44 "Everything is a search problem"
13:28 Deciding without information: the TU/e breach
13:56 Log4j as a search problem
14:59 The client that went looking with paper and pen
15:40 Never waste a good crisis, and a business that didn't feel the risk
16:10 What if Slammer had targeted Log4j?
16:56 Mandy's keynote: from human speed to machine speed
17:49 Security hasn't changed. The speed has.
18:40 How many agents do you run, and what access do they have?

## Key takeaways
- Most security processes are built on the delays that come with
human speed. Those delays are gone, and many processes need to
be turned around rather than tuned.
- Security by obscurity relied on attackers lacking time,
imagination or capability. AI agents have all three.
- Openness is a security strength. Public code and public
detection rules bring in the insight of the global community.
- For practitioners, transparency means knowing exactly what a
product covers and where you need to augment. A black box
leaves you guessing whether you are safe.
- Share how you work, not only what you build. Elastic's security
team publishes what works, what doesn't, and what it is still
figuring out.
- Security is a search problem: finding patterns in data. When
Log4j hit, knowing where it ran made the difference between
acting in minutes and searching by hand.
- Security itself hasn't changed. The speed at which we have to
act on it has.

## Mentioned
Elastic — https://www.elastic.co
Elastic detection rules — https://github.com/elastic/detection-rules
Elastic Security Labs — https://www.elastic.co/security-labs


## Also in this series Ramsés Gallego, Kelvin Rorive, Marianne Schinkel and Aernout Reijmer — out now. Gilad Friedman on AI as an attack vector — coming next. Martin de Vries on securing different sectors — the series finale.

---
SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Aernout Reijmer was

CISO at ASML for seven to eight years and now runs Cyber Alloy.

He co-founded the CISO Circle of Trust and chaired the

Cyberweerbaarheidscentrum Brainport. Hosted by Menno van der Horst

with Quint Ketting.

## Timestamps

00:00 Day two, back on the conference floor

00:25 Aernout: from CISO at ASML to Cyber Alloy

01:16 We will not win this fight in our own bubbles

02:19 CISO Circle of Trust, Brainport, and what he learned there

03:10 ISACs are good. They are not enough.

03:46 Metcalfe's law, and the CISO as bottleneck

04:46 Meeting at events is easy. Building something is the point.

05:52 No more talk shops: deliverables and orchestration

07:25 Attackers do not wait for signed agreements

07:45 Which deliverables? Intelligence, awareness, vulnerability triage

09:32 A preview of his talk: the urgency of protecting the digital economy

11:04 A prediction on enterprises breached through AI

11:44 Fighting AI with AI, and investing in trust

12:46 From Slammer to LLMs: machine speed meets APT intelligence

14:10 Why the company is called Cyber Alloy

14:48 Twenty-five years of experience, combined with AI natives

15:48 The short passwords an LLM will find first

16:19 Non-human identities: do we even know how many we have?

16:46 The race for AI talent

17:17 Why this needs to be European

17:33 Brain drain and fragmented capital

18:35 Pension funds, risk appetite and a larger European fund

19:07 Wrap-up, and an invitation to the studio

## Key takeaways

- Sharing threat detection is only the start. Share how you fight

a threat actor, what you learned after a breach, and how you

improved.

- The value of a network grows with the number of nodes. That only

works if subject matter experts share, not only the CISOs.

- CISOs build the trust at their level, then give their teams

explicit permission and the task to share. It is part of work.

- Collaboration without deliverables is a talk shop. Add an

orchestrator: someone tasked by the group to turn a shared

problem into a shared result.

- Organisations produce awareness material and assess the same

vulnerabilities in parallel. Doing it together multiplies the

effect.

- Trust built on a Friday evening at nine is too late. Put it on

the agenda for Monday at ten.

- Machine-speed attacks are not new. What is new is that LLMs

combine that speed with the intelligence of APT groups. Days

to respond become seconds.

- Europe needs larger, less fragmented capital to keep its

security companies and talent from leaving.

## Mentioned

ASML

Cyber Alloy - https://www.cyberalloy.eu

CISO Circle of Trust

Cyberweerbaarheidscentrum Brainport

Non-human identities also came up with Ramsés Gallego in

episode 1.

## Also in this series

Ramsés Gallego, Kelvin Rorive and Marianne Schinkel — out now.

Mandy Andress on open source culture — coming next.

---

SecurityCafe. Powered by Atos.

Recorded at the Atos booth, at Cybersec NL 2026. Marianne Schinkel sits

on the CybersecNL advisory board and works as an interim CISO and

coach, with 24 years in the field and a background in marketing.

Earlier that day she joined the panel on the CISO under pressure.

Hosted by Menno van der Horst with Quint Ketting.

## Timestamps

00:00 Welcome to episode three

00:16 Why Marianne is at CybersecNL: advisory board and community

00:54 The panel: the CISO under pressure

01:25 Responsibility without mandate, sometimes without budget

01:46 Taking care of yourself means more than sport

02:04 SOAP: Security Organisation, Awareness, Portfolio management

03:23 Too many topics, and an audience that can't take more

04:30 Enabling the business, a callback to Andreas Wuchner

05:55 From marketing to CISO: business process first

06:23 No IT degree. Can you still become a CISO?

08:08 "Do you know who you are?" Purpose before security

09:13 First question for the board: what is the purpose?

09:35 What is your definition of a CISO?

10:16 When the CEO forwards every risk question to the CISO

11:01 How a missing mandate turns into frustration and burnout

11:30 The risk is not yours. It is the board's.

11:52 How security teams can support their CISO

12:29 Ask how people are doing, top down and bottom up

13:01 Dutch directness versus American small talk

14:04 Make wellbeing part of your dailies and weeklies

14:47 But under pressure, who has the time?

15:32 The value of idle time

16:31 A generation that sets boundaries, and the surfer

17:46 Mental health, and why we didn't talk about it

18:31 Agents work day and night. Use the time for people.

19:44 Dealing with threats all day takes its toll

20:05 What a breach does to the people behind it

22:17 Closing message: expectations and personal leadership

## Key takeaways

- CISO pressure comes from the threat landscape, but just as much

from missing mandate, missing budget and unclear expectations.

- Taking care of yourself starts with your position: arrange the

mandate and agree with the board what they expect from you.

- Marianne's SOAP model: security organisation, awareness and

portfolio management together give a CISO a solid footing.

- A business or marketing background is no barrier to the CISO

role. At that level the work is stakeholder management and

understanding how the business wants to innovate.

- Start with purpose. Ask the board what the organisation is for,

which risks it accepts and which it does not.

- The risk belongs to the board. The CISO helps them understand

and own it.

- Ask your team how they are doing, and let them ask you. It is

the question that gets skipped when the pressure is highest.

- Major incidents leave a lasting mark on the people who handle

them, well beyond the technical recovery.

## Mentioned

CybersecNL — https://www.cybersecnl.nl

SecurityCafe episode with Andreas Wuchner

## Also in this series

Ramsés Gallego and Kelvin Rorive — out now.

Martin de Vries on sector differences — publishing October 6th

---

SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Kelvin Rorive is CISO at ICT Group and runs the Cyber Chain Resilience Consortium

(CCRC), which prepares organisations and their suppliers to handle

a crisis together. Hosted by Menno van der Horst with Quint

Ketting.

## Timestamps

00:00 Day one, and nobody is quite awake yet

01:12 Kelvin: CISO at ICT Group, and what CCRC does

02:05 Why this conference feels like a family reunion

03:09 The message at the booth: practice for the worst

03:34 Survivability — a word picked up from a Ukrainian speaker

04:03 Weerbaarheid, veerkracht, and a telco under drone attack

05:25 Fine for the top 10. What about everyone below?

06:09 "My IT manager will handle it" — and why he won't

07:00 Quint: I talk about business risk, not about cyber

08:31 Crisis in the chain: rehearse it with your supplier present

10:08 Exercises spill over into day-to-day cooperation

10:28 The factory that has to stop because the trucks don't come

12:02 One organisation escalates 1-2-3. The other runs it in reverse.

13:23 CEOs walking out of the room with a list

13:44 Putting the CEO in the hot seat, and not letting them delegate

15:11 What not to do: questionnaire bombardment, and AI filling them in

15:47 Know the CISOs of your critical suppliers personally

16:21 The security family, and why you don't abuse it

18:14 FI-ISAC: competitors around one table, one shared goal

19:41 Compliance is not security

20:11 An APT campaign where every control was green

20:42 NIS2, and whether Europe adapts fast enough

22:11 The balance is shifting from prevention to resilience

22:40 The most important word is not cyber. It is resilience.

## Key takeaways

- Survivability sits one level beyond resilience. It starts from

the assumption that everything can be broken: people, buildings,

data, networks.

- A cyber crisis gets handed to the IT manager and then escalates

into a chain crisis long before anyone at board level notices.

- A crisis exercise only tests the chain if your critical supplier

is in the room. Mismatched escalation ladders, unclear

responsibilities and missing contacts surface in minutes.

- Supplier questionnaires are close to worthless now. They are

answered by AI, approved unread, and can be manipulated with

instructions hidden in the document.

- What works instead is a real relationship with the CISOs of

your critical suppliers, used sparingly enough that a call

means something.

- Compliance is the floor, not the ceiling. Green controls and a

long-running intrusion coexist comfortably.

- Preventive measures still matter, but the centre of gravity has

moved to resilience. Assume something gets through and train

the goalkeeper.

## Mentioned

Cyber Chain Resilience Consortium — https://ccrc.nl

ICT Group — https://ict.eu

FI-ISAC, the financial sector information sharing community

CybersecNL 2026 — https://www.cybersecnl.nl

## Also in this series

Ramsés Gallego on speed and governance — out now.

Martin de Vries on sector differences — publishing 24 September.

---

SecurityCafe. Powered by Atos.

# Speed, governance and a changing landscape — Ramsés Gallego

Special: Live from CybersecNL — Episode 1 of 7

Recorded live at the Atos booth, CybersecNL 2026. Ramsés Gallego

is Chief Technologist at DXC, ISACA Hall of Fame, and president of

the ISACA Barcelona chapter. Hosted by Menno van der Horst with

Quint Ketting.

## Timestamps

00:00 Welcome and introductions

00:42 Why DXC came to CybersecNL: detect more, respond faster

01:28 Rivals, never enemies — why competitors share a stage

02:24 The other side collaborates better than we do

04:28 What integrators owe their customers: service over technology

06:34 A second risk equation: means, motives, opportunities

07:32 Are our frameworks still fit for purpose?

08:29 COBIT 2019 is ageing, and ISACA's AI certification track

09:53 "The human in the loop is dead" — as a reflex, not as a role

10:35 Quantum: RSA, Diffie-Hellman and elliptic curve on the clock

11:55 The part nobody talks about: code signing and certificates

12:38 ISACA Quantum Pulse Poll — the skills gap in numbers

13:21 It is not IT you are protecting. It is the business.

14:01 Trucks that stop delivering, invoices quietly altered

15:02 Why risk has to come from the business, not only the CISO

16:26 Enterprise risk management: risk is always plural

17:22 Should we still be calling it cybersecurity at all?

18:17 Business continuity is not resilience

18:54 The positive side of risk

19:34 Why a car has brakes

20:22 Three pillars: identity, data, applications

21:51 Non-human identities and the 100-to-1 future

23:18 Governance is not management, and we need AI-natives

## Key takeaways

- The classic risk equation still holds, but means, motives and

opportunities now sits next to it. AI has collapsed the cost of

all three.

- Business first. Customers do not speak Kubernetes, they speak

euros. The database was not hacked — the business was.

- Identity remains the cornerstone. Two of the three major

incidents discussed on the CybersecNL main stage were identity

related.

- Non-human identity is the governance problem of the next few

years. Almost nobody can say how many agents they run, let

alone which accounts sit behind them.

- Quantum is not only an encryption story. Code signing,

certificates and anything that depends on keeping a secret are

in scope.

- Brakes let you go fast. Security exists so the business can

move, not so it can stop.

- Ramsés states that ISACA is already building COBIT 7, returning

to a numbered release. Not independently confirmed at the time

of publishing.

- The 10-to-1 non-human to human identity ratio, and the

projected 100-to-1, are cited from industry statistics and not

sourced on air.

- The 5-to-12-year window for cryptographically relevant quantum

computing is Ramsés' own estimate.

- ISACA Quantum Pulse Poll figures (2,586 respondents, 67 percent

expecting new skill requirements) are quoted from memory.

## Mentioned

ISACA — https://www.isaca.org

DXC Technology — https://dxc.com

Quantum World Association

The brakes analogy is credited to Art Wong.

## Also in this series

Martin de Vries on sector differences and why we may need a

NIST 3 — referenced in this episode, publishing 24 September.

Aernout Reijmer on collaboration after ASML — publishing

29 September.

---

SecurityCafe. Powered by Atos.

Andreas Wuchner ran large-scale security organisations for some 30 years and now invests in and advises startups, family offices, VC and PE firms. On geopolitical risk, AI governance, and what AI actually costs.

• 00:00 — Welcome
• 01:00 — In the news: 900+ agents coordinating over a shared channel
• 05:07 — Geopolitical risk is real, and NIST/ISO don't map it
• 07:39 — The CybersecNL keynote: is what we built still good enough?
• 11:40 — "What brings you in jail is non-compliance"
• 13:00 — The AI governance tooling wave
• 14:44 — Punish vs enable: pocket money for Big Tech kills a startup
• 16:53 — The minimum viable control set
• 17:43 — Fines: where does that money actually go?
• 22:50 — What AI means for the business, from a board seat
• 26:30 — Three types of adopters, and AI-native hiring in seven days
• 32:04 — "Meat proxies": what the AI-native crowd calls the rest of us
• 34:47 — AI is not cheap: what a €200 subscription really costs
• 37:10 — $20 per run vs $2.84, same job
• 39:22 — Outsourcing efficiency promises vs rising AI costs
• 41:44 — Augmentation vs a greenfield agentic machine room
• 43:43 — Cooling, solar, subsea, space: the infrastructure race
• 47:19 — What to read, what to watch

A policy keeps you out of jail — and that's all it does. Regulators ask for governance; many tick that box with a document. Anyone declaring AI governance "done" is at the beginning.

Define the non-negotiables, then get out of the way. The organisations doing this well name 10 to 50 controls that are not up for discussion and let the rest develop over time — a minimum viable control set. The alternative is the department of no.

Token economics is a skill, not a budget line. The same investment-document analysis ran at roughly $20 per company; converting inputs to markdown first brought it to $2.84. A week-long AI strategy course for managers does nothing for the layer that spends the money.

• Log Force — a project in Spain predicting indicators of compromise before they become threats, and spotting when agentic systems start hallucinating. Not a commercial product yet.
• Tehran — the espionage series from What to Watch
• Uber's €824,990,000 fine from the Dutch DPA for fully automated driver deactivation, under GDPR Article 22: https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking
• The Odido breach (February 2026): some 6.4 million people and 600,000 companies, including over 5 million ID document numbers. https://nos.nl/artikel/2604461-odido-hackers-publiceren-resterende-klantdata-ook-miljoenen-id-nummers
• Meta's settlement over harm to minors: up to $17.1 billion, with 52 US attorneys general — not an EU case. https://www.npr.org/2026/08/26/nx-s1-5944781/meta-settlement-child-safety-lawsuit

Powered by Atos

Hosts: Menno van der Horst & Quint Ketting Guest: Mika Lauhde, Luxembourg House of Cybersecurity (linkedin.com/in/mika-lauhde-4270711)

Mika Lauhde spent 30 years across Nokia, Huawei, and ENISA before landing at Luxembourg House of Cybersecurity, the national hub keeping Luxembourg's municipalities, SMEs, and economy cyber-resilient. His argument: Europe has the wrong word. Not "sovereignty" — hard borders around who owns what — but autonomy: acting independently while still sharing tools and trust. From GPS glitches during US foreign policy disputes, to Europe always getting the second-best tech (fighter jets included), to a national CERT running entirely on open source — this one covers a lot of ground.

• 00:11 — Welcome & Mika's background (Nokia, Huawei, ENISA, Luxembourg House of Cybersecurity)
• 02:08 — News: an integrator data-leak claim ("888") and what makes integrator breaches different
• 06:06 — Android's new developer certificate as a "kill switch," African nations building their own internet, UK VPN/age-verification rollout, an EU "tech sovereignty" proposal that leans on non-European hardware
• 09:11 — A US court ruling that may have quietly broken a GDPR assumption on data transfers
• 10:34 — NIS2 finally live in NL (15 Aug) — are our laws fast enough for machine-speed attacks?
• 19:20 — The "SplinterNet," and why Mika argues for shared autonomy over walled-garden sovereignty
• 23:46 — The Cyber Resilience Act's unprecedented recognition of open source (79 mentions)
• 24:19 — AI models as the new trade weapon — allies get the previous generation, like fighter jets
• 26:50 — The GPS/Galileo story, and SES's Iris² as Europe's answer to Starlink
• 30:15 — EU tax rules that quietly disadvantage open source; the Nokia N900 as Europe's "Sputnik moment"
• 33:00 — Luxembourg's national CERT runs entirely on open-source tools
• 34:40 — The call to action: a free open-source toolkit so any EU SME can stand up a cyber ops center
• 36:41 — What to read: Quint's, Mika's, and Menno's picks
• 41:04 — Wrap-up

• Autonomy, not sovereignty — sharing open standards beats walling off borders
• Dependency is invisible until it breaks — GPS glitches led to Galileo, now to Iris²
• New tech follows old patterns — AI models, like military hardware, come second-best to allies
• Open source is operational, not aspirational — Luxembourg's CERT proves it at national scale

Accenture leak claims (unconfirmed) · NIS2 (NL) · Cyber Resilience Act · European OSPO network · SES Iris² · Trump v. Slaughter ruling Reads: The Subtle Art of Not Giving a Fck* by Mark Manson (markmanson.net/books/subtle-art) · Max Schrems / noyb (noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers) · Bert Hubert's blog (berthub.eu)

SecurityCafe is hosted by Menno van der Horst and Quint Ketting. Powered by Atos.