What happens when a security conference turns twenty and AI finds a live flaw?

Four days, one anniversary

The conference marked twenty years since the first edition. Each day followed a distinct theme. Day one opened with a review of the global security landscape and the evolution of the threat environment. Day two focused on cloud, SaaS, OT and IoT product security including mobile applications. Day three covered networks and telecom security with a use case on SMS blaster attacks. Day four opened with a keynote on education in standardisation and closed with a final session on the Cyber Resilience Act.

AI found a flaw while experts watched

During the same week a critical PHP security flaw was detected by AI. The vulnerability affected millions of websites. Speakers used the real‑time example to illustrate the need for security by design. One presenter noted that vulnerability disclosure adoption and standardisation matter more than ever in 2026. Another warned that a “slopdemic” is already here and a “vulnpocalypse” is around the corner. A third pointed out that security for AI is now as critical as AI for security. AI was also used to discover vulnerabilities in international standards under supervised expert oversight.

Standards for AI security take shape

ETSI EN 304 223, the baseline security standard for AI systems and models, was introduced in a dedicated session.

The “Women in Cyber” session began with an emotional homage to Issy Hall. She passed away at the age of 30 in September 2026. Issy had been active in ETSI Cyber and Securing AI committees and helped build the conference programme. She also contributed to EN 304 223. Key messages to women included understanding your strengths and building self‑confidence. Remain curious and do not wait until you are one hundred percent ready. Bring a colleague or peer into the community. Stay creative.

Quantum readiness and the Cyber Resilience Act

The third afternoon was devoted to cryptography and quantum readiness. Experts discussed post‑quantum cryptography, crypto‑agility and strategies for mitigating “harvest now, decrypt later” threats. A speaker said that in security you do not need to be perfect, you just need to be on the right path. The Cyber Resilience Act was under the spotlight as industry prepares for implementation. The final day concluded with another CRA session alongside AI security and resilience.

What the presentations do not show

David Boswarthinck, ETSI Director of Strategy, said the challenge is not to predict 2046 but to make it open through global partnerships, trusted with security by design, proven with continued evidence, and accountable with human and machine oversight. The announcement links to presentation decks for each day. It does not say how many of the demonstrated tools are already deployed in production networks. It does not quantify the reduction in vulnerability exposure that the new AI standard might achieve. The record stops at the conference room door.