SecurityCafé

For the first time ever, SecurityCafe breaks its own "no selling" rule. Menno van der Horst and Quint Ketting sit down with Emily Jacometti, co-founder of HackShield, the free game that teaches children aged 7 to 12 to stay safe online. But first: a week of disruptive incidents across Europe.## Timestamps00:00 Intro: why we're breaking our own rule01:15 What HackShield is02:31 News: hijacked supermarket freezers in France05:06 Younger victims, younger perpetrators06:02 News: the Ahold Delhaize security incident07:17 News: Danish data leak behind a 123456 password09:10 Why gamification beats traditional awareness12:48 Why start at age 7: the swimming lessons analogy14:10 Home, school and community: reaching every child17:09 One in three kids talks to strangers in games19:19 From serious gaming to HackShield: Emily's story22:08 The model: free, no advertising, no data sales24:42 How cybersecurity companies contribute and volunteer26:47 The Europol Wi-Fi sniffer case28:14 Golden tickets and the path to ethical hacking31:26 Nine countries, aiming for 10,000,001 kids by 203033:49 Why a social media ban alone is not the answer35:42 What's in it for companies: tenders, marketing, people40:19 Creativity and adaptability as the skills of the future44:41 Recommendations## Key takeaways- Predictable passwords still cause major incidents, from supermarket freezers to millions of citizen records.- Cybercrime perpetrators are getting younger, and criminals use gamification to recruit them.- People learn by doing: a game lets kids fail safely and try again.- Start before a child gets their first device, not after.- HackShield is free, ad-free and does not sell data; public and private partners fund it.- For partners: social return in tenders, soft marketing, purpose for employees and an early view of talent.- Bans alone don't work. Teach kids to swim instead of draining the pool.## A note on facts- News items reflect what was known at the time of recording; investigations into the French freezer incident and the Ahold Delhaize incident were ongoing, and reported figures for the Danish leak vary.- Survey figures and country-specific observations are HackShield's own data and experience.- The Europol Wi-Fi sniffer case is discussed as the guest understands it; the case involves minors.## Mentioned- HackShield: https://joinhackshield.com- DIVD Academy: https://www.divd.nl- The Social Reckoning (film, 2026)- Jane McGonigal, Reality Is Broken- David Dewulf, Lateral Movement (October 2026, featuring Quint Ketting, Dimitri van Zantvliet and Max Heinemeier)---Powered by Atos

Note: the video focus slipped during this live recording at thebooth. The conversation is the point, and the audio version isunaffected.Recorded at the Atos booth, CybersecNL 2026, minutes after Martin'smain stage talk. Martin de Vries has worked in security acrossthree sectors: banking, higher education and industry. He was CISOat a Dutch university when it was hit by a cyberattack, and nowworks in the industrial sector. Hosted by Menno van der Horst withQuint Ketting.## Timestamps00:00 Straight from the main stage00:50 Three sectors: banking, higher education, industry01:41 What changes when you move sectors: culture02:26 What doesn't: listening, relationships, threats and risks02:50 From highly regulated to compliance as an afterthought03:20 The CISO as facilitator04:20 "I own the process, not the risk"05:28 Why "I told you so" isn't the answer05:49 Accepting risk at the right level06:24 Acquisitions, due diligence and security07:28 The shelved report, and the ransomware that followed09:42 You don't spend a million to avoid 1.210:12 The cyberattack on the university12:18 A Signal message on a Saturday evening13:19 Deciding near midnight without the business present13:43 Having the mandate versus taking it15:00 IT back online within a week15:41 Postponing an entire exam week17:13 Research grant deadlines and month-end salaries18:20 Disconnecting the network, and session tokens expiring19:01 Restoring, and in which order to reconnect19:39 Taking care of your teams21:59 Sending a whole team home for twelve hours22:21 Quint: Slammer, and sleeping at the office at twenty23:08 Room for the personal during a crisis25:07 Sunday 9 a.m.: what do we share?25:44 At a university, internal communication is public26:17 One update per day, at a fixed time28:32 Openness as part of the culture29:44 Closing: talk to your counterparts in other sectors## Key takeaways- Moving sectors changes the culture and maturity you work in. Threats, risks, measures and the need to listen stay the same.- The CISO owns the risk process, not the risk. The job is to find the risk owner and make sure the risk is understood and accepted at the right level.- After an incident, fix first. Then revisit the trade-off between impact and the cost of prevention.- Write down the mandate to disconnect, and make sure the rest of the organisation knows it exists.- Technical recovery within a week came from years of investing in processes. The business impact, from exams to grants to payroll, ran much longer.- Look after your people. Rotate shifts, and when needed send a whole team home.- Communicate once a day at a fixed time, identically internally and externally. It prevents everyone from refreshing for news.- Share what happened, so others don't make the same mistakes.## MentionedFox-IT, which presented the incident analysisMaastricht University, which shared openly after its 2019ransomware attack## The full seriesRamsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmer,Mandy Andress, Gilad Friedman and Martin de Vries.---SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Gilad Friedman is part of the agentic AI protection team at Radware, a cybersecurity company with nearly 30 years in the business. Hosted by Menno van der Horst with Quint Ketting. Atos and Radware are partners.## Timestamps00:00 Recording number seven or eight — nobody is counting anymore00:35 Gilad: Radware and agentic AI protection01:40 The first AI risk isn't security. It's governance.02:05 Then compliance and data leakage, then security02:40 What people put into AI, and why they bypass the approved tools03:40 AI-first boards and private accounts at work04:55 Where are the agents, how many, and what access do they have?05:15 Shadow AI05:40 "Our AI policy is simple: it's not allowed"06:10 Why blocking doesn't work06:46 A policy is not protection07:15 One enforcement point instead of twenty vendors07:40 How do you get visibility on shadow AI?08:15 Desktop, cloud, mobile and gateway09:07 The hotel guest, the telecom and legal liability10:00 On the verge of an explosion10:30 Connecting AI the way we connected to the internet in the 90s11:40 Customers: stop the fear, show us enablement12:45 Build processes that expect the unexpected13:04 Are today's controls enough for what is already out there?13:50 What changes is the speed of response14:20 Prompt injection: planted yesterday, triggered today15:10 Stopping it, not only detecting it16:10 Looking back: is your baseline good enough?16:30 Indirect prompt injection, hallucinations and tool misuse17:15 Agents inherit the credentials of the user18:00 How many agents do you have? A silent audience18:40 Radware drinks its own champagne19:45 Most of it isn't malicious20:05 Is credential inheritance simply bad design?20:30 LLMs can't tell instructions from data20:55 Infrastructure, architecture, governance, visibility, control21:25 The major AI incident will come. We just don't know when.## Key takeaways- The first AI risk organisations run into is governance: they do not know which AI tools and agents exist. Compliance and data leakage come second, security third.- Blocking AI does not stop its use. People move to private accounts, other devices and the web. A policy only works when you can enforce it.- Visibility has to cover desktop, cloud, mobile and the network edge, ideally from one enforcement point rather than a tool per vendor.- Agents inherit the credentials and permissions of the user who runs them. That turns every shared document into a possible attack path.- LLMs cannot distinguish instructions from data. An instruction hidden in an email, file, image or voice message gets executed with the victim's access.- Detection alone is not enough. When an agent asked to review a document starts touching financial systems, it has to be stopped automatically.- Most shadow AI is not malicious. It is people trying to keep up with an AI-first mandate. Enablement works better than fear.## MentionedRadware — https://www.radware.com## Also in this seriesRamsés Gallego, Kelvin Rorive, Marianne Schinkel, Aernout Reijmerand Mandy Andress — out now.Martin de Vries on securing different sectors — the series finale.---SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Mandy Andress is CISOat Elastic, where she has worked for eight years. She was atCybersecNL to deliver a keynote on moving security from humanspeed to machine speed. Hosted by Menno van der Horst with QuintKetting. Atos and Elastic work together in several areas,including search and SOC operations.## Timestamps00:00 Welcome, third recording of day two00:16 Mandy: CISO at Elastic, and why she came to CybersecNL00:58 How Atos and Elastic already work together01:30 Speed, trust and instinct: incidents at human speed02:06 Processes built on human delay no longer hold02:47 The AI-native mindset security needs03:22 Real-time analysis, and grounding AI with context04:21 Drinking your own champagne05:08 Open code, public detection rules, no black box05:50 Sharing how the security team works, not only what it ships06:16 "If I keep it to myself, I'm safer"06:49 Security by obscurity is dead07:29 Isn't all that openness a risk?08:15 Knowing your coverage and your gaps as a practitioner09:05 Security first versus commercial reality10:14 Eight years at Elastic, and running security on the ELK stack11:44 "Everything is a search problem"13:28 Deciding without information: the TU/e breach13:56 Log4j as a search problem14:59 The client that went looking with paper and pen15:40 Never waste a good crisis, and a business that didn't feel the risk16:10 What if Slammer had targeted Log4j?16:56 Mandy's keynote: from human speed to machine speed17:49 Security hasn't changed. The speed has.18:40 How many agents do you run, and what access do they have?## Key takeaways- Most security processes are built on the delays that come with human speed. Those delays are gone, and many processes need to be turned around rather than tuned.- Security by obscurity relied on attackers lacking time, imagination or capability. AI agents have all three.- Openness is a security strength. Public code and public detection rules bring in the insight of the global community.- For practitioners, transparency means knowing exactly what a product covers and where you need to augment. A black box leaves you guessing whether you are safe.- Share how you work, not only what you build. Elastic's security team publishes what works, what doesn't, and what it is still figuring out.- Security is a search problem: finding patterns in data. When Log4j hit, knowing where it ran made the difference between acting in minutes and searching by hand.- Security itself hasn't changed. The speed at which we have to act on it has.## MentionedElastic — https://www.elastic.coElastic detection rules — https://github.com/elastic/detection-rulesElastic Security Labs — https://www.elastic.co/security-labs## Also in this series Ramsés Gallego, Kelvin Rorive, Marianne Schinkel and Aernout Reijmer — out now. Gilad Friedman on AI as an attack vector — coming next. Martin de Vries on securing different sectors — the series finale.---SecurityCafe. Powered by Atos.

Recorded at the Atos booth, CybersecNL 2026. Aernout Reijmer wasCISO at ASML for seven to eight years and now runs Cyber Alloy.He co-founded the CISO Circle of Trust and chaired theCyberweerbaarheidscentrum Brainport. Hosted by Menno van der Horstwith Quint Ketting.## Timestamps00:00 Day two, back on the conference floor00:25 Aernout: from CISO at ASML to Cyber Alloy01:16 We will not win this fight in our own bubbles02:19 CISO Circle of Trust, Brainport, and what he learned there03:10 ISACs are good. They are not enough.03:46 Metcalfe's law, and the CISO as bottleneck04:46 Meeting at events is easy. Building something is the point.05:52 No more talk shops: deliverables and orchestration07:25 Attackers do not wait for signed agreements07:45 Which deliverables? Intelligence, awareness, vulnerability triage09:32 A preview of his talk: the urgency of protecting the digital economy11:04 A prediction on enterprises breached through AI11:44 Fighting AI with AI, and investing in trust12:46 From Slammer to LLMs: machine speed meets APT intelligence14:10 Why the company is called Cyber Alloy14:48 Twenty-five years of experience, combined with AI natives15:48 The short passwords an LLM will find first16:19 Non-human identities: do we even know how many we have?16:46 The race for AI talent17:17 Why this needs to be European17:33 Brain drain and fragmented capital18:35 Pension funds, risk appetite and a larger European fund19:07 Wrap-up, and an invitation to the studio## Key takeaways- Sharing threat detection is only the start. Share how you fighta threat actor, what you learned after a breach, and how youimproved.- The value of a network grows with the number of nodes. That onlyworks if subject matter experts share, not only the CISOs.- CISOs build the trust at their level, then give their teamsexplicit permission and the task to share. It is part of work.- Collaboration without deliverables is a talk shop. Add anorchestrator: someone tasked by the group to turn a sharedproblem into a shared result.- Organisations produce awareness material and assess the samevulnerabilities in parallel. Doing it together multiplies theeffect.- Trust built on a Friday evening at nine is too late. Put it onthe agenda for Monday at ten.- Machine-speed attacks are not new. What is new is that LLMscombine that speed with the intelligence of APT groups. Daysto respond become seconds.- Europe needs larger, less fragmented capital to keep itssecurity companies and talent from leaving.## MentionedASMLCyber Alloy - https://www.cyberalloy.euCISO Circle of TrustCyberweerbaarheidscentrum BrainportNon-human identities also came up with Ramsés Gallego inepisode 1.## Also in this seriesRamsés Gallego, Kelvin Rorive and Marianne Schinkel — out now.Mandy Andress on open source culture — coming next.---SecurityCafe. Powered by Atos.