--- title: "Cybersec Summit 2026 — San José | Model Diplomat" description: "Cybersec Summit 2026 is a professional conference in San José, Costa Rica, Aug 12, 2026. Organized by Cybersec Summit. Full prep on Model Diplomat." url: "https://modeldiplomat.com/conferences/professional/cybersec-summit-2026" --- # Cybersec Summit 2026 Aug 12, 2026[San José, Costa Rica](https://www.google.com/maps/search/?api=1\&query=San%20Jos%C3%A9%2C%20Costa%20Rica)In-person [Registration open](https://cybersec-summit.com/) The Cybersec Summit is an annual gathering focused on cybersecurity, bringing together experts and stakeholders to address the evolving landscape of cyber threats. Held in San José, CRI, the event provides a forum for discussing critical issues, sharing insights, and fostering collaboration to enhance global cybersecurity measures. It aims to facilitate dialogue on emerging challenges and best practices in the field. ## Committees & topics - Topics Global Cybersecurity Governance · Digital Resilience of Critical Infrastructure · Emerging Technological Risks · The Global Ransomware Threat · Coordinated Vulnerability Disclosure and Software Supply Chains · Securing the Digital Economy and Citizen Services · Cybersecurity Trends and the Threat Landscape · Cross-Border Data Protection ## Why it matters In an increasingly interconnected world, cybersecurity is not merely a technical concern but a critical component of national security, economic stability, and public trust. The summit's focus on international collaboration underscores the reality that cyber threats transcend national borders, requiring coordinated responses. Discussions at such events contribute to the development of robust defense strategies and proactive measures against malicious cyber activities. The insights shared and connections made at the summit can influence policy-making and technological advancements, ultimately strengthening global resilience against cyberattacks. The event serves as a vital platform for understanding the complex interplay between technology, governance, and international relations in the digital age. By convening diverse perspectives, it helps to identify common ground and areas for cooperation in a domain often characterized by competition and conflict. ## How to prepare Delegates preparing for this summit should focus on understanding the multifaceted nature of cybersecurity, particularly as it relates to international cooperation and national interests. A strong grasp of current cyber threats, including state-sponsored attacks, ransomware, and data breaches, will be essential. Consider how different nations approach cybersecurity from strategic and operational standpoints, and how these approaches might intersect or conflict in a multilateral setting. Familiarity with various frameworks for international cyber governance and the challenges associated with their implementation will be beneficial. Delegates should also be prepared to discuss the ethical implications of cybersecurity technologies and the importance of balancing security with privacy and human rights. Engaging with concepts such as "[Digital diplomacy](https://modeldiplomat.com/learn/glossary/digital-diplomacy)" and "Digital Literacy" will provide a comprehensive understanding of the broader context. ## Country perspectives Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile. [Costa Rica](https://modeldiplomat.com/country/costa-rica) [As the host nation, CRI is likely to emphasize regional cybersecurity cooperation and the importance of international partnerships to protect its digital infrastructure and economy.](https://modeldiplomat.com/country/costa-rica) [Role in topic](https://modeldiplomat.com/country/costa-rica) [CRI plays a crucial role by hosting this significant event, providing a neutral ground for international discussions on cybersecurity. Its position in North America also highlights the regional importance of cyber defense strategies.](https://modeldiplomat.com/country/costa-rica) ## Topics & background The background behind each topic and the actors that shape it. 1 ### Global Cybersecurity Governance Cybersecurity has evolved from a technical specialty into a core dimension of national security and international relations. Since the late 1990s, when the first cross-border worms and denial-of-service campaigns demonstrated the fragility of networked systems, states have struggled to agree on norms governing behavior in cyberspace. The UN Group of Governmental Experts (GGE) processes from 2004 onward produced foundational consensus that international law applies online, but disagreements between Western states and Russia and China over sovereignty, content control, and the role of the private sector have repeatedly stalled progress. The parallel UN Open-Ended Working Group (OEWG), established in 2018 and renewed through 2025, broadened participation but did not resolve the core split. Meanwhile, major incidents — NotPetya in 2017, SolarWinds in 2020, the Colonial Pipeline attack in 2021, and a steady drumbeat of state-linked intrusions against critical infrastructure — have raised the political stakes. Today, the central dispute is whether to consolidate a binding cybercrime treaty (adopted by the UN General Assembly in late 2024 but controversial among rights groups), expand existing voluntary norms, or pursue regional frameworks such as the EU's NIS2 directive and the African Union's Malabo Convention. Key players - [United States](https://modeldiplomat.com/country/united-states) [Leads Western coalition promoting an open, interoperable internet and offensive cyber deterrence.](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Advocates cyber sovereignty and state-centric governance models.](https://modeldiplomat.com/country/china) - [Russia](https://modeldiplomat.com/country/russia) [Originator of the OEWG track and the UN cybercrime treaty initiative.](https://modeldiplomat.com/country/russia) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [Major NCSC-led capacity-building donor and norms entrepreneur.](https://modeldiplomat.com/country/united-kingdom) - [Estonia](https://modeldiplomat.com/country/estonia) [Hosts NATO CCDCOE and serves as a model for national cyber resilience.](https://modeldiplomat.com/country/estonia) - [Israel](https://modeldiplomat.com/country/israel) [Significant offensive and defensive cyber capability and exporter of cyber tools.](https://modeldiplomat.com/country/israel) 2 ### Digital Resilience of Critical Infrastructure Digital resilience — the capacity of systems, organizations, and societies to anticipate, withstand, and recover from cyber disruptions — has become a defining policy concern after a decade of escalating attacks on energy grids, hospitals, water utilities, and financial systems. The 2015 and 2016 attacks on Ukraine's power grid, attributed to Russian state actors, were a watershed; subsequent incidents against Saudi Aramco, Irish health services, and U.S. pipelines underscored that even short outages can cascade into systemic crises. Responses have diverged. The European Union enacted NIS2 (2023) and the Digital Operational Resilience Act (DORA, in force 2025) to harden essential entities; the United States issued executive orders mandating zero-trust architectures and Secure-by-Design principles. Many developing economies, however, lack the regulatory bandwidth or incident-response capacity to keep pace, raising concerns about a widening 'cyber resilience divide.' Current debates center on minimum global standards for critical infrastructure protection, mandatory incident reporting, software bills of materials (SBOMs), and cross-border mutual assistance during major cyber events. Key players - [United States](https://modeldiplomat.com/country/united-states) [CISA-led Secure-by-Design agenda and operator of the Joint Cyber Defense Collaborative.](https://modeldiplomat.com/country/united-states) - [Germany](https://modeldiplomat.com/country/germany) [Implements NIS2 and runs BSI, Europe's largest national cyber authority.](https://modeldiplomat.com/country/germany) - [Japan](https://modeldiplomat.com/country/japan) [Promotes industrial control system resilience through the Quad and G7.](https://modeldiplomat.com/country/japan) - [Ukraine](https://modeldiplomat.com/country/ukraine) [Real-world testbed for wartime cyber resilience of civilian infrastructure.](https://modeldiplomat.com/country/ukraine) - [Singapore](https://modeldiplomat.com/country/singapore) [Regional capacity-building hub via the ASEAN-Singapore Cybersecurity Centre.](https://modeldiplomat.com/country/singapore) 3 ### Emerging Technological Risks The convergence of artificial intelligence, quantum computing, autonomous systems, and ubiquitous connectivity has created a new risk landscape that traditional cybersecurity frameworks were not designed to address. Generative AI has lowered the barrier to producing convincing phishing, deepfakes, and polymorphic malware, while large language models themselves introduce novel attack surfaces such as prompt injection and data exfiltration through model APIs. Quantum computing threatens to break current public-key cryptography within the coming decade, prompting NIST's 2024 standardization of post-quantum algorithms. Governance is fragmented. The EU AI Act (2024), the Bletchley and Seoul AI Safety Summit declarations (2023–2024), and the U.S.–led Hiroshima AI Process represent overlapping but uncoordinated efforts. Developing states warn that risk-management standards are being set by a small group of technology exporters. The central questions facing policymakers are how to mandate post-quantum migration timelines, regulate dual-use AI capabilities, secure supply chains for semiconductors and cloud services, and ensure that technological risk assessments incorporate the perspectives of states outside the OECD core. Key players - [United States](https://modeldiplomat.com/country/united-states) [Hosts leading AI labs and drives post-quantum cryptography standards via NIST.](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Major investor in quantum communications and AI governance regulations.](https://modeldiplomat.com/country/china) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [Convened the inaugural AI Safety Summit and hosts the AI Safety Institute.](https://modeldiplomat.com/country/united-kingdom) - [South Korea](https://modeldiplomat.com/country/south-korea) [Co-host of Seoul AI Summit and leader in semiconductor supply chains.](https://modeldiplomat.com/country/south-korea) - [France](https://modeldiplomat.com/country/france) [Advocate for inclusive AI governance through the Paris AI Action Summit.](https://modeldiplomat.com/country/france) 4 ### The Global Ransomware Threat Ransomware has shifted from opportunistic criminal nuisance to a strategic threat to public services and economies. The 2017 WannaCry and NotPetya campaigns — leveraging leaked NSA exploits — caused billions in global damage. By the early 2020s, professionalized ransomware-as-a-service (RaaS) ecosystems such as Conti, LockBit, BlackCat/ALPHV, and Cl0p had industrialized double- and triple-extortion tactics, hitting hospitals (Ireland's HSE, 2021), pipelines (Colonial, 2021), governments (Costa Rica's national emergency, 2022), and supply chains (MOVEit, 2023). Most high-impact actors operate from or through jurisdictions, particularly Russia, that do not extradite cybercriminals, complicating law enforcement. The Counter Ransomware Initiative (CRI), launched in 2021 and now encompassing more than 60 states, has produced joint statements discouraging ransom payments, sanctions against crypto mixers, and coordinated takedowns such as the LockBit disruption in 2024. Open questions include whether to ban ransom payments outright, how to regulate cyber-insurance markets that may incentivize payment, and how to extend support to lower-income states that are increasingly targeted. Key players - [United States](https://modeldiplomat.com/country/united-states) [Leads the Counter Ransomware Initiative and conducts most major takedown operations.](https://modeldiplomat.com/country/united-states) - [Russia](https://modeldiplomat.com/country/russia) [Permissive environment for many leading ransomware affiliates.](https://modeldiplomat.com/country/russia) - [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [Co-chair of CRI policy pillar and active sanctions issuer against ransomware actors.](https://modeldiplomat.com/country/united-kingdom) - [Australia](https://modeldiplomat.com/country/australia) [Co-leads CRI and pioneered mandatory ransomware payment reporting legislation.](https://modeldiplomat.com/country/australia) - [Costa Rica](https://modeldiplomat.com/country/costa-rica) [Symbolic case study after the 2022 national emergency declared in response to Conti.](https://modeldiplomat.com/country/costa-rica) 5 ### Coordinated Vulnerability Disclosure and Software Supply Chains Software vulnerabilities lie at the root of most major cyber incidents, yet the global system for discovering, disclosing, and patching them remains uneven. The CVE program, run by MITRE under U.S. government sponsorship since 1999, is the de facto global registry, but its funding model and U.S. dependency have become contested. National vulnerability databases in China (CNNVD) and Russia (BDU) operate on different timelines and disclosure norms, and researchers have documented cases where vulnerabilities were withheld for intelligence use before public disclosure. The 2021 Log4Shell incident, the 2020 SolarWinds compromise, and the 2024 XZ Utils backdoor attempt revealed how deeply open-source dependencies permeate critical systems. Policy responses include the EU Cyber Resilience Act (2024), U.S. Executive Order 14028 mandating SBOMs, and ongoing ISO/IEC standards work on coordinated vulnerability disclosure (ISO/IEC 29147 and 30111). Key debates concern mandatory disclosure timelines, legal protections for security researchers, government stockpiling of zero-day exploits under vulnerabilities-equities processes, and securing the open-source maintainer ecosystem. Key players - [United States](https://modeldiplomat.com/country/united-states) [Hosts CVE/NVD and shapes global disclosure norms via CISA and NIST.](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [Operates CNNVD and requires domestic vulnerability reporting to authorities within 48 hours.](https://modeldiplomat.com/country/china) - [Netherlands](https://modeldiplomat.com/country/netherlands) [Pioneer of responsible disclosure policies and home to influential CERT and research community.](https://modeldiplomat.com/country/netherlands) - [Germany](https://modeldiplomat.com/country/germany) [Major contributor to EU Cyber Resilience Act and open-source security funding.](https://modeldiplomat.com/country/germany) - [Japan](https://modeldiplomat.com/country/japan) [Operates JPCERT/CC, a leading coordination center in the Asia-Pacific.](https://modeldiplomat.com/country/japan) 6 ### Securing the Digital Economy and Citizen Services As governments digitize identity, payments, health, and welfare services, the surface area for cyber attacks against ordinary citizens has expanded enormously. India's Aadhaar, Brazil's Pix, and the EU's eIDAS 2.0 digital identity wallet represent transformative public infrastructure, but breaches and identity-theft incidents — from the 2022 Optus and Medibank attacks in Australia to repeated breaches affecting hundreds of millions of records globally — have eroded public trust. Mobile money platforms in Africa and Southeast Asia face particular pressure from social-engineering fraud. International cooperation is fragmented across forums: the ITU's Global Cybersecurity Agenda, the OECD Digital Security Recommendations, the Budapest Convention on Cybercrime (2001), and the newer UN Convention against Cybercrime (2024). Capacity-building remains uneven, and many states lack national CERTs or basic incident-response legislation. Current debates focus on baseline security standards for digital public infrastructure, consumer protection, regulation of secure-by-default device design, and ensuring that security obligations do not become a pretext for surveillance or restrictions on encryption. Key players - [India](https://modeldiplomat.com/country/india) [Operator of the world's largest digital identity system and a leading DPI exporter.](https://modeldiplomat.com/country/india) - [Brazil](https://modeldiplomat.com/country/brazil) [Pix instant-payment system and LGPD data-protection regime offer Global South model.](https://modeldiplomat.com/country/brazil) - [Estonia](https://modeldiplomat.com/country/estonia) [Long-standing reference case for secure e-government services.](https://modeldiplomat.com/country/estonia) - [Kenya](https://modeldiplomat.com/country/kenya) [Mobile-money pioneer grappling with fraud and identity-system security.](https://modeldiplomat.com/country/kenya) - [Singapore](https://modeldiplomat.com/country/singapore) [Singpass and Smart Nation initiatives shape regional digital-security standards.](https://modeldiplomat.com/country/singapore) 7 ### Cybersecurity Trends and the Threat Landscape The current threat landscape is shaped by four interacting trends: the professionalization of cybercrime through RaaS and initial-access brokers; the integration of cyber operations into hybrid warfare, most visibly in the Russia–Ukraine war since 2022; the weaponization of AI for both offense and defense; and growing state regulatory assertiveness over the technology stack. Microsoft, Google, Mandiant, and ENISA annual threat reports converge on the finding that critical infrastructure, managed service providers, and identity systems are the most targeted assets. Attribution remains contested. Western intelligence services regularly name Russian, Chinese, North Korean, and Iranian actors behind specific campaigns; targeted states reject these attributions. North Korean operations stand out for their financial dimension, with UN Panel of Experts reports estimating billions of dollars in cryptocurrency thefts funding the DPRK weapons program. The strategic question for international forums is whether to formalize attribution mechanisms, expand sanctions tools, and develop confidence-building measures comparable to those in nuclear and conventional arms control. Key players - [Russia](https://modeldiplomat.com/country/russia) [Source of leading state-aligned APTs and ransomware ecosystems.](https://modeldiplomat.com/country/russia) - [China](https://modeldiplomat.com/country/china) [Conducts large-scale cyber-espionage campaigns documented by multiple states.](https://modeldiplomat.com/country/china) - [North Korea](https://modeldiplomat.com/country/north-korea) [Uses cyber operations, especially crypto theft, to evade sanctions.](https://modeldiplomat.com/country/north-korea) - [Iran](https://modeldiplomat.com/country/iran) [Active in disruptive and influence operations across the Middle East.](https://modeldiplomat.com/country/iran) - [United States](https://modeldiplomat.com/country/united-states) [Primary intelligence source for public attribution and indictments.](https://modeldiplomat.com/country/united-states) - [Ukraine](https://modeldiplomat.com/country/ukraine) [Front line of state-on-state cyber conflict since 2022.](https://modeldiplomat.com/country/ukraine) 8 ### Cross-Border Data Protection Data protection has become inseparable from cybersecurity, as breaches expose personal data and surveillance practices undermine trust in cross-border data flows. The EU's General Data Protection Regulation (GDPR, 2018) set a global benchmark and has been emulated, with variations, in Brazil (LGPD), India (DPDPA 2023), China (PIPL 2021), and many African states under the AU's Malabo Convention. Yet enforcement varies dramatically, and the invalidation of the EU–U.S. Privacy Shield in Schrems II (2020) showed how data-protection law can collide with national-security surveillance. The EU–U.S. Data Privacy Framework (2023) restored a limited transfer mechanism but faces legal challenges. China's data-export rules and India's evolving sectoral guidance create additional fragmentation, while Convention 108+ of the Council of Europe offers the only binding multilateral instrument open to non-European states. Debates now focus on interoperability of consent and transfer regimes, protection of children's data, regulation of biometric and health data, government access standards, and aligning data-protection enforcement with cybersecurity incident reporting. Key players - [Belgium](https://modeldiplomat.com/country/belgium) [Seat of EU institutions driving the global GDPR standard.](https://modeldiplomat.com/country/belgium) - [United States](https://modeldiplomat.com/country/united-states) [Negotiates sectoral and trans-Atlantic frameworks absent a federal privacy law.](https://modeldiplomat.com/country/united-states) - [China](https://modeldiplomat.com/country/china) [PIPL and Data Security Law impose strict data-localization and export controls.](https://modeldiplomat.com/country/china) - [India](https://modeldiplomat.com/country/india) [DPDPA 2023 shapes data governance for over a billion users.](https://modeldiplomat.com/country/india) - [Brazil](https://modeldiplomat.com/country/brazil) [LGPD and ANPD anchor data protection across Latin America.](https://modeldiplomat.com/country/brazil) - [Japan](https://modeldiplomat.com/country/japan) [Champion of 'Data Free Flow with Trust' through the G7 and OECD.](https://modeldiplomat.com/country/japan) ## Resources News, lessons, and country profiles to prep for Cybersec Summit 2026. Recent reporting to ground your prep [Nepal's Digital Fraud Crisis: Bank Accounts A](https://modeldiplomat.com/story/nepals-digital-fraud-wave-is-emptying-bank-accounts) [Rahul Gandhi’s CBSE Marking Controversy](https://modeldiplomat.com/story/rahul-gandhis-cbse-marking-controversy) [IIT-Madras Investigates CBSE Portal Issues](https://modeldiplomat.com/story/iit-madras-investigates-cbse-portal-issues) [EEUU activa ley contra deepfakes sexuales](https://modeldiplomat.com/story/eeuu-activa-ley-contra-deepfakes-sexuales-un-cambio-regulatorio) Lessons Bite-sized lessons to build the basics [Hidden Stakeholders](https://modeldiplomat.com/learn/lessons/hidden-stakeholders) [Engagement Strategies](https://modeldiplomat.com/learn/lessons/engagement-strategies) [Dynamic Analysis](https://modeldiplomat.com/learn/lessons/dynamic-analysis) [Stakeholder Mapping Workshop](https://modeldiplomat.com/learn/lessons/stakeholder-workshop) Courses Guided courses that go deeper on the topic [Advanced Negotiation](https://modeldiplomat.com/learn/courses/advanced-negotiation) [Multilateral Negotiation](https://modeldiplomat.com/learn/courses/multilateral-negotiation) [Policy Brief Writing](https://modeldiplomat.com/learn/courses/policy-brief) [Conflict Resolution](https://modeldiplomat.com/learn/courses/conflict-resolution) The states in play, with the data that shapes their stance [Costa Rica](https://modeldiplomat.com/country/costa-rica) [Country dossier](https://modeldiplomat.com/country/costa-rica) [United States](https://modeldiplomat.com/country/united-states) [Country dossier](https://modeldiplomat.com/country/united-states) [China](https://modeldiplomat.com/country/china) [Country dossier](https://modeldiplomat.com/country/china) [Russia](https://modeldiplomat.com/country/russia) [Country dossier](https://modeldiplomat.com/country/russia) [United Kingdom](https://modeldiplomat.com/country/united-kingdom) [Country dossier](https://modeldiplomat.com/country/united-kingdom) [Estonia](https://modeldiplomat.com/country/estonia) [Country dossier](https://modeldiplomat.com/country/estonia) [Israel](https://modeldiplomat.com/country/israel) [Country dossier](https://modeldiplomat.com/country/israel) [Germany](https://modeldiplomat.com/country/germany) [Country dossier](https://modeldiplomat.com/country/germany) [Japan](https://modeldiplomat.com/country/japan) [Country dossier](https://modeldiplomat.com/country/japan) [Ukraine](https://modeldiplomat.com/country/ukraine) [Country dossier](https://modeldiplomat.com/country/ukraine) [Singapore](https://modeldiplomat.com/country/singapore) [Country dossier](https://modeldiplomat.com/country/singapore) [South Korea](https://modeldiplomat.com/country/south-korea) [Country dossier](https://modeldiplomat.com/country/south-korea) [France](https://modeldiplomat.com/country/france) [Country dossier](https://modeldiplomat.com/country/france) [Australia](https://modeldiplomat.com/country/australia) [Country dossier](https://modeldiplomat.com/country/australia) [Netherlands](https://modeldiplomat.com/country/netherlands) [Country dossier](https://modeldiplomat.com/country/netherlands) [India](https://modeldiplomat.com/country/india) [Country dossier](https://modeldiplomat.com/country/india) [Brazil](https://modeldiplomat.com/country/brazil) [Country dossier](https://modeldiplomat.com/country/brazil) [Kenya](https://modeldiplomat.com/country/kenya) [Country dossier](https://modeldiplomat.com/country/kenya) [North Korea](https://modeldiplomat.com/country/north-korea) [Country dossier](https://modeldiplomat.com/country/north-korea) [Iran](https://modeldiplomat.com/country/iran) [Country dossier](https://modeldiplomat.com/country/iran) [Belgium](https://modeldiplomat.com/country/belgium) [Country dossier](https://modeldiplomat.com/country/belgium) ## Frequently asked questions - - - Free account Save conferences, research any topic with AI, build position papers, and keep your daily prep streak — free. [Create free account](https://modeldiplomat.com/sign-up?next=%2Fconferences%2Fprofessional%2Fcybersec-summit-2026) Already a member? [Log in](https://modeldiplomat.com/sign-in?next=%2Fconferences%2Fprofessional%2Fcybersec-summit-2026) Free account Save conferences, research any topic with AI, build position papers, and keep your daily prep streak — free. [Create free account](https://modeldiplomat.com/sign-up?next=%2Fconferences%2Fprofessional%2Fcybersec-summit-2026) Already a member? [Log in](https://modeldiplomat.com/sign-in?next=%2Fconferences%2Fprofessional%2Fcybersec-summit-2026)