Thursday 12 November 2026 · Bucharest & online
One day. Seven use cases. Six SOC capabilities in the making. SOC teams, critical infrastructure operators, national authorities, researchers and technology providers, in Bucharest and online.
Come to see where the technology stands, say what your sector actually needs, and shape the recommendations Europe hears next.
The programme brings together institutional, operational and research perspectives. Speakers are being confirmed, and names are announced here as each contributor confirms.
Policy and programme perspective on Europe's SOC ecosystem.
What NIS2 supervision looks like from the regulator's side.
Operational reality: alert volume, staffing, interoperability.
Energy, health, maritime, retail and digital services.
The teams developing the CYBERGUARD capabilities.
More alerts do not make a SOC stronger. What matters is whether the chain holds from the first signal to the fix. The Forum walks through it, link by link.
Spot the anomaly in the traffic, not just the known signature.
AI-driven anomaly and intrusion detection
Work out what the sample or the behaviour actually does.
Advanced malware analysis toolkit
Move the intelligence to the next SOC without leaking what should stay private.
Automated CTI sanitiser and CTI ontology
Put the alert in context so an analyst can rank it against everything else.
Analyst dashboard and knowledge correlation
Contain it, including when the target is the AI system itself.
LLM attack mitigation and defence mechanisms
Turn the finding into steps an operator can actually carry out.
AI-assisted remediation guidance
These capabilities are in development. The Forum shows where each one stands and what it will take to get it into operational use.
CYBERGUARD is validated across seven operational environments. The afternoon sector dialogue brings the operators behind them into the same conversation.
What the operator needed, what the architecture had to accommodate, and where it is now.
How containment is designed when downtime is not an option.
What scales across a large estate of endpoints, and what does not.
Security operations when the asset is at sea and the link is not.
Where automated decisions hold up, and where they need an analyst.
What changes in a SOC's own posture once its AI tooling is in scope.
How a threat travels from one operator's detection to a coordinated response.
A single track on Thursday 12 November 2026, 09:30 to 16:00, in the room and streamed. Two panels, a technical snapshot of what the project has built, and a sector dialogue with the operators running the pilots.
Provisional programme. Times are local (EET) and contributors are still being confirmed.
Join the listYou collect your badge and your node number.
CYBERGUARD and the European cyber resilience agenda.
Strengthening Europe's SOC ecosystem through AI, threat intelligence and cooperation.
Objectives, consortium, use cases and expected impact.
What the regulation asks for, and what it takes to deliver it on the ground.
Why intelligence still does not move cleanly between SOCs, CSIRTs and operators.
Malware analysis, CTI, AI-supported detection and incident response.
The networking hour, with something to actually do.
Cybersecurity needs in energy, healthcare, maritime, retail and digital services.
First directions from CYBERGUARD, and what the room would change.
The wall is photographed before anyone leaves.
Resilience is a property of the network, not of any one organisation. So we made the network visible: a three-metre panel at the entrance, two hundred empty circles, one of them yours.
The number is printed on your badge.
Inside the circle, in marker.
To every person you actually meet.
At 09:00 the wall is blank. At 17:30 it is a map of the room, drawn by the room.
A national authority, the vendor shipping the patch, the CSIRT that saw it first and the operator running the plant rarely plan together. For one day, they do.
12 November 2026, in Bucharest and online. Leave your details and you will hear from us before registration opens publicly — the room is capped, and the list is how we fill it.
We use your details only to contact you about this event. Nothing else, no newsletter by default, no sharing with partners.
We will write to you before registration opens. Your node is reserved — find it on the wall when you arrive.
Thursday 12 November 2026, 09:30 to 16:00 (EET), in Bucharest and streamed online. The venue is being finalised and goes out with your confirmation.
Nothing. Attendance is free. Travel and accommodation are your own.
Yes. The Forum is hybrid. The full programme is streamed, and the sessions that take questions take them from both rooms.
The venue is being confirmed. It will be centrally located and step-free, with the full address sent with your confirmation.
Seats in Bucharest are limited and allocated from the list. Online places are not.
English throughout, including the sector dialogue and the policy session.
Panel places are being confirmed with the consortium, but the policy session takes contributions from the floor. Say so in the form and we will get in touch.
The event is streamed. Which sessions stay available afterwards is still being agreed with the speakers.
There will be a photographer. You will be asked for consent at registration, and you can decline without any fuss.
No. It is an invitation, not an obligation. Plenty of people will just look at it.