“Strong together against cyberattacks!” With this motto, it-sa invites visitors to Nuremberg from 27 to 29 October 2026. I like that. But together should mean more than vendors and security teams working side by side. Our colleagues at work belong to it too.
A look at the program shows a strong focus on regulation, AI and digital sovereignty, and with it the question of compliance vs resilience. NIS2, the Cyber Resilience Act and the AI Act sit alongside AI-supported defense and the question of how much control companies have over their data and infrastructure. AI appears both as a tool for attackers and as help for defenders.
The forums also show how vendors translate these challenges into concrete solutions. That is helpful, but naturally not free of vendor interests, our own contribution included. The vendor-neutral “it-sa insights” are a different matter. For me, one question therefore always belongs in the picture: what does this improve when the real attack happens?
Compliance vs resilience: evidence is not yet defense
I am skeptical when more regulation is automatically equated with more security. Requirements must remain workable, including for smaller companies. Additional effort alone is not progress. What matters is whether risks actually go down and whether people do the right thing at the right moment.
That is why I find a forum talk titled “Regulated, but not resilient?” interesting. The special keynote by Patrick Scholl also builds on a cyberattack simulation in which decisions have to be made under time pressure. It shows that the question of practical capability to act is very much on the program.
A look at Switzerland shows how current this question is. In SonntagsBlick, Federal Data Protection Commissioner Adrian Lobsiger reports 455 data security breaches already notified this year, compared with 343 in the whole of the previous year. He also points to human error. My conclusion is not to treat employees even more as a problem. We need to enable them better to be part of the solution.
Source: Adrian Lobsiger, Swiss Federal Data Protection and Information Commissioner, interview in SonntagsBlick, October 2026
From knowledge to behavior
it-sa explicitly describes awareness with the goal of “measurable behavior change”. That is exactly where we start with risk behavior modeling, Behavioral Defense Engineering (BDE): current attack patterns become safe, realistic exercises. We observe the reaction, give feedback and align the next exercise with it. Reports from employees become signals for those responsible for security and starting points for further exercises.
That is also what my 15-minute talk is about: “Not another awareness training: we rebuild vishing and the Berlin hack.”
Starting from the Berlin incident, I use ClickFix and vishing to show how current attack methods become exercises. Realistic right up to the decisive action, followed by a learning moment instead of damage. Not to expose anyone, but to practice secure behavior instead of only testing knowledge.
Especially in Cybersecurity Awareness Month, we should not settle for additional information. My question is: which attack from the news of the past four weeks have our employees already practiced?
The talk takes place on Thursday, 29 October 2026, from 11:45 to 12:00 in Knowledge Forum B.
Visit us in Hall 7, Stand 301a, too. Alongside Swiss chocolate, you can experience an AI-supported vishing call there yourself as a voluntary exercise. I look forward to talking about what actually helps in everyday work.
So long, Palo
