Where is the CyberSecThailand Summit 2026 being held?

The CyberSecThailand Summit 2026 will take place in the city of Bangkok, Thailand.

What is the primary focus of the CyberSecThailand Summit 2026?

The summit focuses on addressing the evolving landscape of cyber threats and developing defensive strategies, with a particular emphasis on regional collaboration in Southeast Asia.

Who is the target audience for this event?

The event is designed for experts, policymakers, and industry leaders involved in cybersecurity from across the region and beyond.

CyberSecThailand Summit 2026

Name: CyberSecThailand Summit 2026
Start: 2026-10-08T00:00:00Z
End: 2026-10-08T00:00:00Z
Location: Bangkok

Oct 8, 2026Bangkok, ThailandIn-person

Registration open

The CyberSecThailand Summit 2026 is a key regional event dedicated to addressing the complex and evolving challenges within the cybersecurity landscape. Hosted in Bangkok, Thailand, this summit serves as a critical platform for experts, policymakers, and industry leaders to converge and deliberate on strategies for enhancing digital resilience. Its focus encompasses a broad spectrum of cyber threats and the innovative defensive measures required to safeguard digital infrastructure and data. This gathering is particularly significant given Thailand's strategic position in Southeast Asia, a region undergoing rapid digital transformation. The summit aims to foster collaboration and knowledge exchange, contributing to the development of robust cybersecurity frameworks and practices across the region. Participants will engage in discussions designed to shape future policies and technological advancements in cybersecurity.

Committees & topics

Topics
The Global Cybersecurity Landscape · Digital Transformation and Inclusive Governance · Artificial Intelligence in Cybersecurity · Cloud Security and Shared Responsibility · Operational Technology (OT) and Industrial Control System Security · Web Application Security · Building a Cybersecurity Culture · Securing Critical Infrastructure

Why it matters

The increasing sophistication of cyber threats necessitates continuous dialogue and collaboration among nations and organizations. Events like the CyberSecThailand Summit 2026 are crucial for staying ahead of these threats, which can have far-reaching implications for national security, economic stability, and individual privacy. The discussions held here directly influence the preparedness of governments and industries to counter cyber warfare, espionage, and criminal activities.

Furthermore, the summit's location in Bangkok, Thailand, highlights the critical role of Southeast Asia in the global digital economy. As countries in this region continue to digitalize, they become more susceptible to cyberattacks, making robust cybersecurity measures indispensable. The insights and partnerships forged at this event are vital for protecting critical infrastructure and ensuring the secure flow of information, which underpins modern societies.

For Model Diplomat, understanding the outcomes and policy recommendations from such summits is essential for analyzing global digital governance and security trends. The event provides a lens through which to examine the interplay between technological advancements, national interests, and international cooperation in the digital domain. It also offers valuable insights into the regional dynamics of cybersecurity, which can inform broader geopolitical analyses.

How to prepare

To effectively engage with the CyberSecThailand Summit 2026, it is imperative to conduct thorough research into the current cybersecurity postures and challenges faced by countries in Southeast Asia, particularly THA. Understanding their national cybersecurity strategies, key vulnerabilities, and international collaborations will provide a strong foundation for analysis. Consider exploring the concept of "dynamic analysis" to better grasp the evolving nature of cyber threats and defensive tactics.

Delegates should also prepare by identifying key stakeholders likely to be present, including government officials, private sector representatives, and academic experts. Utilizing a "stakeholder mapping workshop" can help in understanding their respective interests and potential influence on policy outcomes. Pay close attention to any "hidden stakeholders" whose perspectives might not be immediately obvious but are crucial for a comprehensive understanding of the regional cybersecurity landscape.

Finally, developing a strong grasp of international cybersecurity norms and agreements, such as the "Digital Geneva Convention proposal", will be beneficial. This context will allow for a more nuanced understanding of the policy discussions and potential areas of consensus or divergence among participants. Consider how different "engagement strategies" might be employed to foster cooperation on complex cybersecurity issues.

Country perspectives

Where the most-relevant 4 countries stand on the core issues in play. Click through for the full country profile.

Thailand

Thailand is actively working to enhance its national cybersecurity capabilities and frameworks to protect its rapidly expanding digital economy and critical infrastructure.

Role in topic

As the host nation, THA plays a central role in facilitating regional dialogue and cooperation on cybersecurity. It is a key player in developing and implementing national cybersecurity policies, and its experience with digital transformation makes it a relevant case study for other developing economies. The summit provides an opportunity for THA to showcase its progress and seek international partnerships.

Singapore

Singapore is a leader in cybersecurity innovation and policy within Southeast Asia, advocating for international cooperation and robust digital defense mechanisms.

Role in topic

SGP often serves as a benchmark for cybersecurity best practices in the region. Its advanced digital infrastructure and proactive approach to cyber defense mean its representatives will likely share insights on cutting-edge technologies and policy frameworks, influencing regional standards and collaborative initiatives.

United States

The United States prioritizes global cybersecurity stability and works with allies to counter state-sponsored and criminal cyber threats, often providing technical assistance and intelligence sharing.

Role in topic

The USA is a major global actor in cybersecurity, with significant technological capabilities and a vested interest in securing international digital commons. Its participation would likely involve discussions on threat intelligence sharing, capacity building, and promoting international norms of responsible state behavior in cyberspace.

China

China is a significant cyber power with a focus on national digital sovereignty and developing its own robust cybersecurity industry and regulatory framework.

Role in topic

CHN's perspective on cybersecurity is shaped by its emphasis on national security and control over its digital space. Its involvement would be crucial for discussions on global cybersecurity governance, particularly concerning data localization, supply chain security, and the role of state actors in cyberspace.

Topics & background

The background behind each topic and the actors that shape it.

The Global Cybersecurity Landscape

Cybersecurity emerged as a distinct policy domain in the late 1990s as the commercial internet expanded and incidents such as the Morris Worm (1988) and the Melissa virus (1999) demonstrated systemic vulnerabilities. Through the 2000s and 2010s, state-linked operations — Stuxnet against Iranian centrifuges (2010), the Sony Pictures hack (2014), NotPetya (2017), and the SolarWinds supply-chain compromise (2020) — transformed cybersecurity from a technical IT concern into a matter of national security and international law. The UN Group of Governmental Experts (GGE) and the successor Open-Ended Working Group (OEWG) on ICTs have since attempted, with mixed success, to codify norms of responsible state behavior in cyberspace. The current dispute centers on whether existing international law — particularly the UN Charter, international humanitarian law, and sovereignty principles — adequately governs cyber operations, or whether a binding treaty is needed. Western states generally favor extending existing law and voluntary norms, while Russia, China, and several non-aligned states have pushed for a new convention, including the recently adopted UN Convention against Cybercrime (2024). Ransomware, state-sponsored intrusions, and the targeting of hospitals and electoral systems remain top concerns. Today the field is shaped by rapid AI integration, growing supply-chain risk, and fragmentation along geopolitical lines, with the EU's NIS2 Directive, the US National Cybersecurity Strategy, and ASEAN's cyber cooperation frameworks setting divergent regulatory baselines.

Key players

Digital Transformation and Inclusive Governance

Digital transformation — the integration of digital technologies across government, industry, and society — accelerated dramatically after 2010 with cloud computing, mobile penetration, and platform economics, and again after 2020 as the COVID-19 pandemic forced rapid digitization of public services. Estonia's e-government model, India's India Stack (Aadhaar, UPI), and Singapore's Smart Nation initiative became reference architectures for Digital Public Infrastructure (DPI), now central to the UN's 2024 Global Digital Compact. The core dispute is over governance and equity: who sets standards, how data flows across borders, and how developing states can adopt DPI without entrenching dependencies on foreign vendors or surveillance regimes. The OECD, ITU, and World Bank promote interoperable open standards, while diverging data-localization rules (in China, the EU under GDPR, India, and Vietnam) complicate cross-border digital trade. Concerns about digital divides, accessibility, and the labor-market effects of automation persist. For Southeast Asia, ASEAN's Digital Economy Framework Agreement (under negotiation since 2023) and Thailand's Thailand 4.0 strategy illustrate the regional push to harmonize digital transformation with cybersecurity, data protection, and AI governance.

Key players

Artificial Intelligence in Cybersecurity

AI has been used in cybersecurity since the early 2000s for spam filtering and anomaly detection, but the field was transformed after 2017 with deep learning and again after 2022 with the rise of large language models. Defenders increasingly rely on AI for threat detection, SOC automation, and malware classification, while attackers use generative AI for phishing, deepfake-enabled social engineering, and autonomous vulnerability discovery — a dynamic highlighted by the UK's AI Safety Institute and the US Executive Order 14110 (2023). The central dispute concerns dual-use risk and regulation. The EU AI Act (2024) imposes risk-tiered obligations including on cybersecurity-relevant systems; the US has pursued voluntary commitments and NIST's AI Risk Management Framework; China has issued binding rules on generative AI and algorithmic recommendation. International coordination is fragmented across the Bletchley Process, the Seoul and Paris AI Summits, and the OECD AI Principles. Questions about model security, prompt injection, data poisoning, and the use of AI in offensive cyber operations remain unresolved. For the cybersecurity community, the immediate operational issues are AI-augmented attack tooling, the security of AI supply chains (including model weights and training data), and the governance of agentic systems that take autonomous action on networks.

Key players

Cloud Security and Shared Responsibility

Cloud computing emerged commercially in the mid-2000s with AWS (2006), followed by Microsoft Azure and Google Cloud, and has since become the default infrastructure for enterprise and government workloads. Major incidents — the 2019 Capital One breach exploiting a misconfigured AWS WAF, the 2023 Storm-0558 intrusion into Microsoft cloud email used by US government agencies, and recurring Snowflake-related credential breaches in 2024 — have made clear that cloud security is a shared responsibility between providers and customers, but that the boundary is often poorly understood. The core policy dispute involves concentration risk, sovereignty, and jurisdiction. The US CLOUD Act (2018) and the EU's response through GAIA-X, the EUCS certification scheme, and data-localization rules reflect a transatlantic struggle over law-enforcement access and provider control. China's Cybersecurity Law, Data Security Law, and PIPL impose strict localization, while ASEAN states including Thailand and Indonesia have introduced their own data-protection regimes. CISA's 2024 review of the Microsoft Exchange Online intrusion sharply criticized cloud-provider security culture. Current debates focus on confidential computing, identity and access management at scale, supply-chain attestation, and how sovereign-cloud arrangements can coexist with global interoperability.

Key players

Operational Technology (OT) and Industrial Control System Security

Operational technology — the industrial control systems (ICS), SCADA, and PLCs running power grids, water utilities, factories, and transport — was historically air-gapped and security-by-obscurity. The 2010 Stuxnet operation against Iran's Natanz facility demonstrated that OT was a viable target for state actors. Subsequent incidents — BlackEnergy and Industroyer against Ukraine's grid (2015, 2016), Triton/Trisis targeting safety instrumented systems in Saudi Arabia (2017), Colonial Pipeline (2021), and continuing GRU-linked attacks on Ukrainian and allied utilities — have made OT a central concern of national cyber strategies. The core dispute is how to secure long-lived industrial assets that were never designed for internet connectivity, in a context of IT/OT convergence, ransomware exposure, and geopolitical targeting. Standards such as IEC 62443, NIST SP 800-82, and the EU's NIS2 and CER directives are converging on baseline requirements, while CISA, ENISA, and Japan's METI publish sector-specific guidance. Vendor concentration (Siemens, Rockwell, Schneider Electric, ABB) creates systemic supply-chain risk. Today the priority issues are network segmentation, secure remote access, vulnerability disclosure for ICS, and protecting safety systems from both criminal and state-aligned actors.

Key players

Web Application Security

Web application security became a discrete discipline in the early 2000s with the founding of OWASP (2001) and the publication of its Top 10 list, which codified risks such as injection, broken authentication, and cross-site scripting. As web applications became the primary interface for banking, government services, and e-commerce, breaches such as Heartbleed (2014), Equifax via Apache Struts (2017), Magecart skimming campaigns, and the Log4Shell vulnerability (2021) demonstrated how a single web-stack flaw can cascade across the global economy. The contemporary landscape is shaped by the shift to API-first architectures, single-page applications, and serverless backends, which have expanded the attack surface beyond classic web flaws to include broken object-level authorization, SSRF, and supply-chain risks in JavaScript dependencies. Regulators are catching up: PCI DSS 4.0 imposes new client-side security requirements, the EU Cyber Resilience Act (2024) extends obligations to software products, and OWASP has published dedicated API Security and LLM Top 10 lists. Key debates concern secure-by-design mandates, software bills of materials (SBOMs), liability for insecure software, and how bug-bounty and coordinated vulnerability disclosure regimes should be harmonized internationally.

Key players

Building a Cybersecurity Culture

The recognition that 'people' are as critical as 'process' and 'technology' dates to early information-security models, but the modern emphasis on cybersecurity culture grew out of the realization in the 2010s that the overwhelming majority of breaches — Verizon's annual DBIR consistently reports above 70% — involve a human element such as phishing, misdelivery, or credential reuse. ENISA, NIST (notably SP 800-50 and the NICE Workforce Framework), and the UK NCSC have published successive guidance reframing security awareness as ongoing behavioral and organizational change rather than one-off training. The central challenge is workforce: ISC2 estimates a global cybersecurity workforce gap of roughly four million people, with acute shortages in the Asia-Pacific. States and firms differ on whether to prioritize formal credentialing (CISSP, CompTIA, regional schemes), university pipelines, or apprenticeship and reskilling. Cultural questions — psychological safety for reporting incidents, just-culture approaches to human error, and inclusion of women and underrepresented groups — are increasingly seen as security-relevant. Today the discussion centers on measurable security behaviors, executive accountability (reinforced by SEC cyber-disclosure rules and NIS2 management liability), and integrating cybersecurity into broader digital literacy programs in schools and SMEs.

Key players

Securing Critical Infrastructure

Critical infrastructure protection became a formal policy domain after the US Marsh Commission report (1997) and PDD-63 (1998), which identified sectors — energy, water, finance, telecoms, healthcare, transport — whose disruption would cause cascading societal harm. Subsequent incidents reshaped the field: the Ukraine grid attacks (2015, 2016), WannaCry's impact on the UK NHS (2017), NotPetya's global spillover (2017), Colonial Pipeline (2021), the Viasat KA-SAT hack at the start of Russia's invasion of Ukraine (2022), and ongoing 'Volt Typhoon' intrusions into US infrastructure attributed to China (disclosed 2023–2024). The core dispute is normative and operational. Diplomatically, states agreed at the UN GGE and OEWG that critical infrastructure should be off-limits in peacetime, yet pre-positioning and disruptive operations continue. Domestically, governments are tightening regulation: the EU's NIS2 and CER Directives, the US National Cybersecurity Strategy and TSA pipeline directives, Japan's Economic Security Promotion Act, and Thailand's designation of Critical Information Infrastructure under the 2019 Cybersecurity Act all impose stronger obligations. Public-private information sharing, supply-chain risk (including vendors such as Huawei and Kaspersky), and resilience of space and undersea-cable assets are recurring themes. The debate today is how to translate norms into deterrence and accountability, how to defend converged IT/OT environments, and how to ensure that smaller states and operators can meet rising baseline expectations.

Key players

Resources

News, lessons, and country profiles to prep for CyberSecThailand Summit 2026.

Recent reporting to ground your prep

Arming an archipelago: Is time running out for Europe's oldest DMZ? | Euronews

Comprehensive approach to security: Federal Council launches consultation on Switzerland's security policy strategy

Europe's June Heatwave: Infrastructure Crisis

Ukraine Drone Strikes Crimea Power Grid

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Cross-Cultural Communication

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

The states in play, with the data that shapes their stance

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Thailand October 2026

By committee

Frequently asked questions

CyberSecThailand Summit 2026

Oct 8, 2026Bangkok, ThailandIn-person

Registration open

Committees & topics

Topics
The Global Cybersecurity Landscape · Digital Transformation and Inclusive Governance · Artificial Intelligence in Cybersecurity · Cloud Security and Shared Responsibility · Operational Technology (OT) and Industrial Control System Security · Web Application Security · Building a Cybersecurity Culture · Securing Critical Infrastructure

Why it matters

How to prepare

Country perspectives

Where the most-relevant 4 countries stand on the core issues in play. Click through for the full country profile.

Thailand

Thailand is actively working to enhance its national cybersecurity capabilities and frameworks to protect its rapidly expanding digital economy and critical infrastructure.

Role in topic

Singapore

Singapore is a leader in cybersecurity innovation and policy within Southeast Asia, advocating for international cooperation and robust digital defense mechanisms.

Role in topic

United States

Role in topic

China

China is a significant cyber power with a focus on national digital sovereignty and developing its own robust cybersecurity industry and regulatory framework.

Role in topic