Where is the Cybersec Summit held?

The Cybersec Summit is held in San José, CRI.

When does the Cybersec Summit take place?

The Cybersec Summit takes place in August.

Cybersec Summit 2026

Name: Cybersec Summit 2026
Start: 2026-08-12T00:00:00Z
End: 2026-08-12T00:00:00Z
Location: San José

Aug 12, 2026San José, Costa RicaIn-person

The Cybersec Summit is an annual gathering focused on cybersecurity, bringing together experts and stakeholders to address the evolving landscape of cyber threats. Held in San José, CRI, the event provides a forum for discussing critical issues, sharing insights, and fostering collaboration to enhance global cybersecurity measures. It aims to facilitate dialogue on emerging challenges and best practices in the field.

Committees & topics

Topics
Global Cybersecurity Governance · Digital Resilience of Critical Infrastructure · Emerging Technological Risks · The Global Ransomware Threat · Coordinated Vulnerability Disclosure and Software Supply Chains · Securing the Digital Economy and Citizen Services · Cybersecurity Trends and the Threat Landscape · Cross-Border Data Protection

Why it matters

In an increasingly interconnected world, cybersecurity is not merely a technical concern but a critical component of national security, economic stability, and public trust. The summit's focus on international collaboration underscores the reality that cyber threats transcend national borders, requiring coordinated responses. Discussions at such events contribute to the development of robust defense strategies and proactive measures against malicious cyber activities.

The insights shared and connections made at the summit can influence policy-making and technological advancements, ultimately strengthening global resilience against cyberattacks. The event serves as a vital platform for understanding the complex interplay between technology, governance, and international relations in the digital age. By convening diverse perspectives, it helps to identify common ground and areas for cooperation in a domain often characterized by competition and conflict.

How to prepare

Delegates preparing for this summit should focus on understanding the multifaceted nature of cybersecurity, particularly as it relates to international cooperation and national interests. A strong grasp of current cyber threats, including state-sponsored attacks, ransomware, and data breaches, will be essential. Consider how different nations approach cybersecurity from strategic and operational standpoints, and how these approaches might intersect or conflict in a multilateral setting.

Familiarity with various frameworks for international cyber governance and the challenges associated with their implementation will be beneficial. Delegates should also be prepared to discuss the ethical implications of cybersecurity technologies and the importance of balancing security with privacy and human rights. Engaging with concepts such as "Digital diplomacy" and "Digital Literacy" will provide a comprehensive understanding of the broader context.

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Costa Rica

As the host nation, CRI is likely to emphasize regional cybersecurity cooperation and the importance of international partnerships to protect its digital infrastructure and economy.

Role in topic

CRI plays a crucial role by hosting this significant event, providing a neutral ground for international discussions on cybersecurity. Its position in North America also highlights the regional importance of cyber defense strategies.

Topics & background

The background behind each topic and the actors that shape it.

Global Cybersecurity Governance

Cybersecurity has evolved from a technical specialty into a core dimension of national security and international relations. Since the late 1990s, when the first cross-border worms and denial-of-service campaigns demonstrated the fragility of networked systems, states have struggled to agree on norms governing behavior in cyberspace. The UN Group of Governmental Experts (GGE) processes from 2004 onward produced foundational consensus that international law applies online, but disagreements between Western states and Russia and China over sovereignty, content control, and the role of the private sector have repeatedly stalled progress. The parallel UN Open-Ended Working Group (OEWG), established in 2018 and renewed through 2025, broadened participation but did not resolve the core split. Meanwhile, major incidents — NotPetya in 2017, SolarWinds in 2020, the Colonial Pipeline attack in 2021, and a steady drumbeat of state-linked intrusions against critical infrastructure — have raised the political stakes. Today, the central dispute is whether to consolidate a binding cybercrime treaty (adopted by the UN General Assembly in late 2024 but controversial among rights groups), expand existing voluntary norms, or pursue regional frameworks such as the EU's NIS2 directive and the African Union's Malabo Convention.

Key players

Digital Resilience of Critical Infrastructure

Digital resilience — the capacity of systems, organizations, and societies to anticipate, withstand, and recover from cyber disruptions — has become a defining policy concern after a decade of escalating attacks on energy grids, hospitals, water utilities, and financial systems. The 2015 and 2016 attacks on Ukraine's power grid, attributed to Russian state actors, were a watershed; subsequent incidents against Saudi Aramco, Irish health services, and U.S. pipelines underscored that even short outages can cascade into systemic crises. Responses have diverged. The European Union enacted NIS2 (2023) and the Digital Operational Resilience Act (DORA, in force 2025) to harden essential entities; the United States issued executive orders mandating zero-trust architectures and Secure-by-Design principles. Many developing economies, however, lack the regulatory bandwidth or incident-response capacity to keep pace, raising concerns about a widening 'cyber resilience divide.' Current debates center on minimum global standards for critical infrastructure protection, mandatory incident reporting, software bills of materials (SBOMs), and cross-border mutual assistance during major cyber events.

Key players

Emerging Technological Risks

The convergence of artificial intelligence, quantum computing, autonomous systems, and ubiquitous connectivity has created a new risk landscape that traditional cybersecurity frameworks were not designed to address. Generative AI has lowered the barrier to producing convincing phishing, deepfakes, and polymorphic malware, while large language models themselves introduce novel attack surfaces such as prompt injection and data exfiltration through model APIs. Quantum computing threatens to break current public-key cryptography within the coming decade, prompting NIST's 2024 standardization of post-quantum algorithms. Governance is fragmented. The EU AI Act (2024), the Bletchley and Seoul AI Safety Summit declarations (2023–2024), and the U.S.–led Hiroshima AI Process represent overlapping but uncoordinated efforts. Developing states warn that risk-management standards are being set by a small group of technology exporters. The central questions facing policymakers are how to mandate post-quantum migration timelines, regulate dual-use AI capabilities, secure supply chains for semiconductors and cloud services, and ensure that technological risk assessments incorporate the perspectives of states outside the OECD core.

Key players

The Global Ransomware Threat

Ransomware has shifted from opportunistic criminal nuisance to a strategic threat to public services and economies. The 2017 WannaCry and NotPetya campaigns — leveraging leaked NSA exploits — caused billions in global damage. By the early 2020s, professionalized ransomware-as-a-service (RaaS) ecosystems such as Conti, LockBit, BlackCat/ALPHV, and Cl0p had industrialized double- and triple-extortion tactics, hitting hospitals (Ireland's HSE, 2021), pipelines (Colonial, 2021), governments (Costa Rica's national emergency, 2022), and supply chains (MOVEit, 2023). Most high-impact actors operate from or through jurisdictions, particularly Russia, that do not extradite cybercriminals, complicating law enforcement. The Counter Ransomware Initiative (CRI), launched in 2021 and now encompassing more than 60 states, has produced joint statements discouraging ransom payments, sanctions against crypto mixers, and coordinated takedowns such as the LockBit disruption in 2024. Open questions include whether to ban ransom payments outright, how to regulate cyber-insurance markets that may incentivize payment, and how to extend support to lower-income states that are increasingly targeted.

Key players

Coordinated Vulnerability Disclosure and Software Supply Chains

Software vulnerabilities lie at the root of most major cyber incidents, yet the global system for discovering, disclosing, and patching them remains uneven. The CVE program, run by MITRE under U.S. government sponsorship since 1999, is the de facto global registry, but its funding model and U.S. dependency have become contested. National vulnerability databases in China (CNNVD) and Russia (BDU) operate on different timelines and disclosure norms, and researchers have documented cases where vulnerabilities were withheld for intelligence use before public disclosure. The 2021 Log4Shell incident, the 2020 SolarWinds compromise, and the 2024 XZ Utils backdoor attempt revealed how deeply open-source dependencies permeate critical systems. Policy responses include the EU Cyber Resilience Act (2024), U.S. Executive Order 14028 mandating SBOMs, and ongoing ISO/IEC standards work on coordinated vulnerability disclosure (ISO/IEC 29147 and 30111). Key debates concern mandatory disclosure timelines, legal protections for security researchers, government stockpiling of zero-day exploits under vulnerabilities-equities processes, and securing the open-source maintainer ecosystem.

Key players

Securing the Digital Economy and Citizen Services

As governments digitize identity, payments, health, and welfare services, the surface area for cyber attacks against ordinary citizens has expanded enormously. India's Aadhaar, Brazil's Pix, and the EU's eIDAS 2.0 digital identity wallet represent transformative public infrastructure, but breaches and identity-theft incidents — from the 2022 Optus and Medibank attacks in Australia to repeated breaches affecting hundreds of millions of records globally — have eroded public trust. Mobile money platforms in Africa and Southeast Asia face particular pressure from social-engineering fraud. International cooperation is fragmented across forums: the ITU's Global Cybersecurity Agenda, the OECD Digital Security Recommendations, the Budapest Convention on Cybercrime (2001), and the newer UN Convention against Cybercrime (2024). Capacity-building remains uneven, and many states lack national CERTs or basic incident-response legislation. Current debates focus on baseline security standards for digital public infrastructure, consumer protection, regulation of secure-by-default device design, and ensuring that security obligations do not become a pretext for surveillance or restrictions on encryption.

Key players

Cybersecurity Trends and the Threat Landscape

The current threat landscape is shaped by four interacting trends: the professionalization of cybercrime through RaaS and initial-access brokers; the integration of cyber operations into hybrid warfare, most visibly in the Russia–Ukraine war since 2022; the weaponization of AI for both offense and defense; and growing state regulatory assertiveness over the technology stack. Microsoft, Google, Mandiant, and ENISA annual threat reports converge on the finding that critical infrastructure, managed service providers, and identity systems are the most targeted assets. Attribution remains contested. Western intelligence services regularly name Russian, Chinese, North Korean, and Iranian actors behind specific campaigns; targeted states reject these attributions. North Korean operations stand out for their financial dimension, with UN Panel of Experts reports estimating billions of dollars in cryptocurrency thefts funding the DPRK weapons program. The strategic question for international forums is whether to formalize attribution mechanisms, expand sanctions tools, and develop confidence-building measures comparable to those in nuclear and conventional arms control.

Key players

Cross-Border Data Protection

Data protection has become inseparable from cybersecurity, as breaches expose personal data and surveillance practices undermine trust in cross-border data flows. The EU's General Data Protection Regulation (GDPR, 2018) set a global benchmark and has been emulated, with variations, in Brazil (LGPD), India (DPDPA 2023), China (PIPL 2021), and many African states under the AU's Malabo Convention. Yet enforcement varies dramatically, and the invalidation of the EU–U.S. Privacy Shield in Schrems II (2020) showed how data-protection law can collide with national-security surveillance. The EU–U.S. Data Privacy Framework (2023) restored a limited transfer mechanism but faces legal challenges. China's data-export rules and India's evolving sectoral guidance create additional fragmentation, while Convention 108+ of the Council of Europe offers the only binding multilateral instrument open to non-European states. Debates now focus on interoperability of consent and transfer regimes, protection of children's data, regulation of biometric and health data, government access standards, and aligning data-protection enforcement with cybersecurity incident reporting.

Key players

Resources

News, lessons, and country profiles to prep for Cybersec Summit 2026.

Recent reporting to ground your prep

Nepal's Digital Fraud Crisis: Bank Accounts A

Rahul Gandhi’s CBSE Marking Controversy

IIT-Madras Investigates CBSE Portal Issues

EEUU activa ley contra deepfakes sexuales

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

Conflict Resolution

Costa Rica August 2026

By committee

Frequently asked questions

Cybersec Summit 2026

Aug 12, 2026San José, Costa RicaIn-person

Starts in 4 daysRegistration open

Committees & topics

Topics
Global Cybersecurity Governance · Digital Resilience of Critical Infrastructure · Emerging Technological Risks · The Global Ransomware Threat · Coordinated Vulnerability Disclosure and Software Supply Chains · Securing the Digital Economy and Citizen Services · Cybersecurity Trends and the Threat Landscape · Cross-Border Data Protection

Why it matters

How to prepare

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Costa Rica

As the host nation, CRI is likely to emphasize regional cybersecurity cooperation and the importance of international partnerships to protect its digital infrastructure and economy.

Role in topic

Topics & background

The background behind each topic and the actors that shape it.

Global Cybersecurity Governance

Key players

Digital Resilience of Critical Infrastructure

Key players

Emerging Technological Risks

Key players

The Global Ransomware Threat

Key players

Coordinated Vulnerability Disclosure and Software Supply Chains

Key players

Securing the Digital Economy and Citizen Services

Key players

Cybersecurity Trends and the Threat Landscape

Key players

Cross-Border Data Protection

Key players

Resources

News, lessons, and country profiles to prep for Cybersec Summit 2026.

Recent reporting to ground your prep

Nepal's Digital Fraud Crisis: Bank Accounts A

Rahul Gandhi’s CBSE Marking Controversy

IIT-Madras Investigates CBSE Portal Issues

EEUU activa ley contra deepfakes sexuales

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

Conflict Resolution

Costa Rica August 2026

By committee

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

International Conference on Discourse and Globalization (ICDG)

International Conference on Political Discourse and Democracy (ICPDCD)

PwnedCR 0x9 — Conferencia de hacking y ciberseguridad en Costa Rica

International Conference on Peacebuilding, Human Security, and Global Development (ICPHSGD)

VI Congreso Internacional Economía de Francisco en América Latina y el Caribe 2026

International Conference on Political Sociology and Global Governance

Frequently asked questions

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

International Conference on Discourse and Globalization (ICDG)

International Conference on Political Discourse and Democracy (ICPDCD)

PwnedCR 0x9 — Conferencia de hacking y ciberseguridad en Costa Rica

International Conference on Peacebuilding, Human Security, and Global Development (ICPHSGD)

VI Congreso Internacional Economía de Francisco en América Latina y el Caribe 2026

International Conference on Political Sociology and Global Governance

Frequently asked questions