Where is EspañaSec taking place?

EspañaSec is scheduled to take place in Madrid, ESP.

What is the primary focus of EspañaSec?

The primary focus of EspañaSec is to address the evolving landscape of cybersecurity, including national security, digital infrastructure protection, and the strategic implications of cyber threats in Madrid.

How long does the conference last?

The conference is a multi-day event held in Madrid.

EspañaSec 3rd Edition

Name: EspañaSec 3rd Edition
Start: 2027-02-09T00:00:00Z
End: 2027-02-10T00:00:00Z
Location: Madrid

Feb 9–10, 2027Madrid, SpainIn-person

Registration open

EspañaSec, now in its third iteration, convenes in Madrid, ESP, to address the evolving landscape of cybersecurity. This event serves as a critical forum for discussions on national security, digital infrastructure protection, and the strategic implications of cyber threats. Participants engage in dialogues aimed at strengthening cyber defenses and fostering collaboration among key stakeholders.

Committees & topics

Topics
Cyber Security and the Protection of Critical Infrastructure · Digital Resilience of States and Critical Services · Digital Capability and the Global Technology Divide · The Emergence of National Cyber Hubs · Regulatory Shifts in Cyberspace and Emerging Technologies · The Geopolitical Landscape of Cyber and Digital Power · The Evolving Threat Landscape in Cyberspace · Third-Party and Supply Chain Risk Management

Why it matters

The increasing sophistication of cyber threats necessitates continuous adaptation and collaboration among nations. Events like EspañaSec are vital for sharing intelligence, developing robust defense strategies, and understanding the geopolitical dimensions of cyber warfare. The discussions held in Madrid contribute to a broader international effort to secure digital assets and critical infrastructure against malicious actors.

Cybersecurity is no longer a niche technical concern but a fundamental aspect of national security and economic stability. The insights generated at this conference can inform policy-making, influence investment in cyber defense technologies, and shape international cooperation frameworks. As digital interconnectedness grows, the resilience of individual nations and the global community against cyberattacks becomes paramount.

How to prepare

Delegates preparing for EspañaSec should focus on understanding the current cyber threat landscape, particularly as it pertains to national infrastructure and strategic industries. Familiarity with emerging technologies and their security implications, such as artificial intelligence in cyber defense and offensive operations, will be beneficial. Reviewing recent cyber incidents and their geopolitical repercussions can provide valuable context for discussions.

Consider how different national approaches to cybersecurity intersect and diverge. For instance, some nations prioritize offensive capabilities, while others emphasize defensive resilience and international norms. Understanding these varied perspectives, as outlined in lessons such as "Engagement Strategies" and "What Is Stakeholder Mapping?", will enable more nuanced contributions. Delegates should also be prepared to discuss the challenges of information sharing and collective defense mechanisms in a fragmented international environment.

Country perspectives

Where the most-relevant 5 countries stand on the core issues in play. Click through for the full country profile.

Spain

Committed to strengthening national cyber defenses and fostering international cooperation.

Role in topic

As the host nation, ESP plays a central role in facilitating discussions on cybersecurity, showcasing its own efforts in digital security, and promoting collaborative initiatives within Europe and beyond. Its strategic location makes it a significant player in regional cyber defense strategies.

United States

Advocates for robust international norms and collective defense against cyber threats.

Role in topic

The USA is a leading global actor in cybersecurity, often setting standards and contributing significantly to research and development. Its perspective will likely emphasize the importance of intelligence sharing, deterrence, and the development of advanced cyber capabilities.

China

Focuses on cyber sovereignty and developing indigenous cyber capabilities.

Role in topic

CHN's approach to cybersecurity is often characterized by a strong emphasis on state control over its digital infrastructure and a focus on developing its own technological solutions. Its participation would highlight the complexities of international cooperation given differing national priorities regarding data governance and internet control.

Russia

Emphasizes information security and challenges Western-led cyber governance frameworks.

Role in topic

RUS is a significant actor in the cyber domain, often associated with sophisticated cyber operations. Its perspective would likely center on national information security, potentially questioning existing international norms and advocating for alternative governance models.

Estonia

Pioneers in digital governance and cyber defense, advocating for resilience and international law.

Role in topic

EST is recognized globally for its advanced digital society and robust cyber defense capabilities. Its experience offers valuable insights into building resilient digital infrastructure and responding to large-scale cyberattacks, emphasizing the importance of international legal frameworks.

Topics & background

The background behind each topic and the actors that shape it.

Cyber Security and the Protection of Critical Infrastructure

Cybersecurity has moved from a technical concern to a core element of national security since the late 1990s, when the first state-linked intrusions and worms demonstrated that digital networks could be weaponized. Landmark incidents — Estonia (2007), Stuxnet (2010), NotPetya (2017), SolarWinds (2020), and the Colonial Pipeline ransomware attack (2021) — illustrated how cyber operations can disrupt energy, finance, healthcare, and government services without crossing traditional thresholds of armed conflict. The Russia–Ukraine war has further normalized cyber operations as an instrument of statecraft, with wiper malware and attacks on satellite communications accompanying kinetic operations. Multilateral efforts have struggled to keep pace. The UN Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG) on ICTs have produced non-binding norms affirming that international law applies in cyberspace, but states disagree sharply on attribution, sovereignty, and permissible responses. The EU's NIS2 Directive, the U.S. National Cybersecurity Strategy (2023), and China's cybersecurity and data security laws reflect divergent regulatory philosophies that complicate cross-border cooperation. Today the debate centers on how to protect critical infrastructure against state and criminal actors, how to operationalize cyber norms, and how to manage the militarization of cyberspace. Spain and other middle powers increasingly emphasize cyber diplomacy, capacity-building, and the role of regional bodies such as the EU and NATO in collective cyber defense.

Key players

Digital Resilience of States and Critical Services

Digital resilience — the capacity of states, firms, and societies to anticipate, withstand, recover from, and adapt to digital disruptions — has emerged as a central policy concept after a decade of cascading failures. The 2017 NotPetya outbreak, the 2021 Kaseya supply-chain attack, and the 2024 CrowdStrike global IT outage demonstrated that single points of failure in software supply chains can paralyze hospitals, ports, airlines, and payment systems worldwide. The COVID-19 pandemic accelerated dependence on cloud services, remote access tools, and digital identity, raising the stakes of any disruption. Regulatory responses have proliferated. The EU's Digital Operational Resilience Act (DORA), in force since January 2025, imposes resilience testing and ICT risk management on financial entities. NIS2 broadens cybersecurity obligations across essential and important sectors. The U.S. has pushed Secure by Design principles via CISA, while the UK, Japan, and Singapore have built sectoral resilience frameworks. Developing countries, however, often lack the institutional and technical capacity to match these standards. The contemporary debate focuses on how to harmonize resilience requirements across jurisdictions, how to manage concentration risk in cloud and software markets, and how to ensure that resilience obligations do not exclude smaller economies and SMEs. Resilience is increasingly framed not only as cybersecurity but as a question of economic sovereignty and continuity of essential public services.

Key players

Digital Capability and the Global Technology Divide

Digital capability — the combination of infrastructure, skills, industrial base, and institutional capacity to develop and deploy digital technologies — has become a defining axis of geopolitical competition. The U.S.–China rivalry over semiconductors, AI, and 5G has reshaped industrial policy worldwide, prompting the U.S. CHIPS and Science Act (2022), the EU Chips Act (2023), and parallel initiatives in Japan, South Korea, and India. Export controls on advanced chips and lithography equipment have created a tiered global technology order. At the same time, the digital divide between and within countries remains stark. According to the ITU, roughly one-third of humanity remains offline, and the gap in AI compute, skilled talent, and R&D spending is widening. The UN Global Digital Compact, adopted in 2024 as part of the Pact for the Future, sought to align international cooperation on digital capacity-building, AI governance, and data flows, but implementation depends on voluntary national commitments. The present debate concerns how states can build sovereign digital capability without fragmenting the global internet, how to ensure equitable access to AI and compute, and how export controls and industrial subsidies interact with WTO rules. For Spain and the EU, strategic autonomy in cloud, chips, and AI is a defining policy goal of the decade.

Key players

The Emergence of National Cyber Hubs

Cyber hubs — concentrated ecosystems combining national cybersecurity agencies, intelligence services, industry, academia, and start-ups — have become a sought-after model for projecting cyber power and attracting investment. Israel's Beer Sheva cluster, the UK's National Cyber Force headquarters in Samlesbury, Estonia's Tallinn ecosystem hosting NATO CCDCOE, and Singapore's Cyber Security Agency campus exemplify this trend. Spain has invested in León as the headquarters of INCIBE and the country's flagship national cybersecurity hub, supported by EU recovery funds. These hubs typically pursue several objectives at once: developing sovereign cyber capabilities, fostering domestic industry, training a national workforce, and serving as a platform for international cooperation. The European Cybersecurity Competence Centre in Bucharest, established in 2021, coordinates a network of national coordination centres, channelling Horizon Europe and Digital Europe funding. NATO and the EU have both endorsed hub-style models to overcome fragmentation of cyber capacity across member states. Debate now turns on how to ensure hubs complement rather than duplicate one another, how to integrate smaller states and the Global South into hub networks, and how to balance commercial ambitions with national security controls on dual-use research. The model also raises questions about brain drain, public–private boundaries, and the export of cyber tools.

Key players

Regulatory Shifts in Cyberspace and Emerging Technologies

The last five years have seen the most intensive wave of digital regulation in history. The EU has adopted the GDPR (2018), the Digital Services Act and Digital Markets Act (2022), the Data Act, NIS2, DORA, the Cyber Resilience Act, and the AI Act (2024) — the world's first horizontal AI regulation. The United States has shifted from a largely sectoral approach toward broader executive action, including the 2023 AI Executive Order (since revised), SEC cyber disclosure rules, and state-level privacy laws. China has built a dense framework around the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, with significant extraterritorial reach. These regimes increasingly collide. Cross-border data transfers, AI model evaluations, and obligations on cloud providers create compliance burdens and potential trade frictions. The OECD, G7 Hiroshima AI Process, Council of Europe AI Framework Convention (2024), and ongoing UN AI Advisory Body work attempt to align approaches, but divergences over risk classification, liability, and state access to data persist. The current debate centers on interoperability between regulatory regimes, the role of standards bodies and certification schemes, and whether emerging powers will adopt EU-style or alternative models. For firms and states alike, regulatory shifts are now a primary driver of cybersecurity strategy and digital investment decisions.

Key players

The Geopolitical Landscape of Cyber and Digital Power

Digital and cyber issues are now embedded in the broader geopolitical confrontation among major powers. The Russia–Ukraine war has made cyber operations, disinformation, and satellite communications central to modern conflict. U.S.–China competition over semiconductors, AI, undersea cables, and standards-setting at the ITU and ISO has produced a quasi-bipolar technology order, with middle powers and the Global South navigating between them. The Gaza conflict and Red Sea disruptions have further highlighted the vulnerability of digital and physical infrastructure to regional crises. Alliances and groupings increasingly organize around technology. The G7, Quad, AUKUS, and EU–U.S. Trade and Technology Council coordinate on export controls, AI safety, and supply-chain security. BRICS+ has expanded discussions on alternative payment systems and digital sovereignty. Within Europe, debates over Huawei in 5G, U.S. cloud dependence, and intra-EU cyber cooperation have reshaped strategic thinking. Spain plays an active role through the EU, NATO, and Ibero-American cyber cooperation networks. The core question is whether the global digital order will fragment into competing blocs or retain a degree of interoperability. Multilateral processes — the OEWG on ICTs, UN AI initiatives, and the Global Digital Compact — provide forums, but outcomes depend heavily on great-power dynamics.

Key players

The Evolving Threat Landscape in Cyberspace

The cyber threat landscape has expanded dramatically in scope and severity. State-sponsored actors — most prominently associated with Russia, China, North Korea, and Iran — conduct espionage, sabotage, and influence operations against governments, critical infrastructure, and defense industries. Ransomware-as-a-service ecosystems, dominated by Russian-speaking groups such as LockBit, Conti's successors, and ALPHV, have inflicted record losses on hospitals, municipalities, and supply chains. Reports from ENISA, Microsoft, Mandiant, and CrowdStrike consistently identify supply-chain compromises, identity-based attacks, and exploitation of edge devices as dominant trends. Emerging technologies are reshaping the threat. Generative AI lowers the cost of phishing, deepfakes, and malware development, while quantum computing threatens current cryptographic standards, prompting NIST's post-quantum cryptography standards (2024). Hybrid threats — combining cyber intrusions with disinformation, sabotage, and economic coercion — are increasingly visible around elections and critical infrastructure such as undersea cables in the Baltic and Mediterranean. The contemporary debate focuses on how to improve attribution, intelligence-sharing, and coordinated responses; how to regulate the commercial spyware market following the Pall Mall Process launched by France and the UK in 2024; and how to defend democratic processes against AI-enabled influence operations. The threat landscape will continue to be defined by the interaction of geopolitics, technology, and crime.

Key players

Third-Party and Supply Chain Risk Management

Third-party risk has become one of the most acute vulnerabilities in modern digital ecosystems. Organizations increasingly depend on a long tail of software vendors, cloud providers, managed service providers, and open-source components, each representing a potential attack vector. SolarWinds (2020), Kaseya (2021), MOVEit (2023), and the XZ Utils backdoor discovery (2024) demonstrated that a single compromised supplier can affect thousands of downstream entities, including governments and critical infrastructure operators. Regulators have responded with sweeping new obligations. The EU's DORA introduces a binding regime for ICT third-party risk in the financial sector, including direct oversight of critical providers. NIS2 extends supply-chain security requirements across essential and important entities. The U.S. Executive Order 14028 and CISA's Secure Software Development Framework, together with the EU Cyber Resilience Act, push toward Software Bills of Materials (SBOMs) and security-by-design across the product lifecycle. China's CAC reviews of cross-border data and cloud services impose parallel obligations. Key debates concern concentration risk in hyperscale cloud and identity providers, the liability of software vendors, the sustainability of open-source maintenance, and the burden of compliance on SMEs and developing-country firms. Effective third-party risk management is increasingly seen as a public good requiring international coordination, not merely a private contractual matter.

Key players