Where is the EspañaSec Summit held?

The EspañaSec Summit is held in the city of Madrid, ESP.

What is the primary focus of the EspañaSec Summit?

The primary focus of the EspañaSec Summit is to advance cybersecurity through discussions on emerging threats, best practices, and innovative solutions.

EspañaSec Summit 2027

Name: EspañaSec Summit 2027
Start: 2027-02-09T00:00:00Z
End: 2027-02-10T00:00:00Z
Location: Madrid

Feb 9–10, 2027Madrid, SpainIn-person

Registration open

The EspañaSec Summit is a focused gathering in Madrid, ESP, dedicated to advancing cybersecurity. This event serves as a platform for professionals to discuss emerging threats, share best practices, and explore innovative solutions in the field of digital security. It emphasizes the collaborative effort required to build resilient cyber defenses against a constantly evolving threat landscape.

Committees & topics

Topics
IT Security in an Era of Converged Digital Infrastructure · Cyber Security and State Behavior in Cyberspace · Geopolitical Risks to the Global Security Environment · Regulatory Challenges in Digital and Cyber Governance · Business Continuity and Operational Resilience · Artificial Intelligence in Cyber Security · Supply Chain Security in Critical Goods and Software · Third-Party and Vendor Risk Management

Why it matters

In an increasingly interconnected world, cybersecurity is not merely a technical challenge but a critical component of national security and economic stability. Events like EspañaSec Summit are vital for fostering international cooperation and knowledge exchange, which are essential for developing robust defenses against cyber threats that transcend national borders. The discussions and collaborations at this summit directly contribute to strengthening the collective ability to protect critical infrastructure, sensitive data, and digital economies.

The summit's location in Madrid, ESP, highlights the growing importance of cybersecurity within Europe and its role in shaping regional and global digital policies. By bringing together experts and decision-makers, the event helps to bridge gaps between policy, technology, and implementation, ensuring that cybersecurity strategies are both effective and adaptable. This focus on practical application and strategic foresight is crucial for addressing the complex challenges posed by state-sponsored attacks, cybercrime, and other malicious activities.

How to prepare

Delegates preparing for the EspañaSec Summit should focus on understanding the current geopolitical landscape of cybersecurity, particularly as it pertains to ESP and the broader European context. Reviewing recent cyber incidents and policy responses will provide valuable background for engaging in discussions. Participants should also consider the various stakeholders involved in cybersecurity, from government agencies to private sector entities, as outlined in the "what-is-stakeholder-mapping" and "hidden-stakeholders" lessons.

Effective participation will require an understanding of both technical and policy aspects of cybersecurity. Familiarity with concepts such as "adaptive-cyber-defense" and "cyber-espionage" from the glossary will be beneficial. Delegates should also prepare to engage in discussions on "engagement-strategies" to foster cross-sector collaboration, as the summit aims to create a unified front against cyber threats. Considering the "dynamic-analysis" of threat vectors will also be crucial for contributing meaningfully to the dialogue.

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Spain

Committed to enhancing national cybersecurity infrastructure and fostering international cooperation.

Role in topic

As the host nation, ESP plays a central role in organizing and facilitating discussions on cybersecurity, showcasing its commitment to digital security within Europe and globally. The event in Madrid underscores ESP's efforts to position itself as a key player in cybersecurity initiatives.

Topics & background

The background behind each topic and the actors that shape it.

IT Security in an Era of Converged Digital Infrastructure

IT security as a discipline emerged in the late 20th century as enterprises and governments moved record-keeping, communications, and operations onto networked computing. Early frameworks such as the US Orange Book (1985), ISO/IEC 17799 (later 27001), and NIST's Special Publication series codified the confidentiality-integrity-availability triad and laid the groundwork for today's controls-based approach. The 2000s saw the rise of perimeter defenses, while the 2010s shifted attention toward identity, endpoint detection, and cloud-native architectures following landmark breaches at Target (2013), OPM (2015), and Equifax (2017). The contemporary IT security challenge is one of scale and convergence. Enterprises now operate hybrid environments spanning on-premises systems, multiple public clouds, SaaS platforms, and an expanding fleet of mobile and IoT endpoints. Ransomware-as-a-service, credential theft, and identity-based attacks have displaced traditional malware as the dominant threat vectors, with Verizon's DBIR consistently identifying the human element and stolen credentials as leading causes of breach. Governments have responded with stricter baseline requirements, including the US Executive Order 14028 on zero-trust architecture and the EU's NIS2 Directive. Today the debate centers on how to harmonize security baselines across jurisdictions, how to secure legacy systems that cannot be easily replaced, and how to allocate responsibility between vendors, operators, and end users. Spain, as host, has driven this conversation through INCIBE and the National Cryptologic Centre's ENS framework, which underpins public-sector IT security across the country.

Key players

Cyber Security and State Behavior in Cyberspace

Cybersecurity moved from a technical specialty to a matter of high politics in the mid-2000s, marked by the 2007 distributed denial-of-service campaign against Estonia and the 2010 discovery of Stuxnet, the first widely documented state-sponsored cyber-physical attack. Since then, incidents such as NotPetya (2017), SolarWinds (2020), Colonial Pipeline (2021), and the Viasat KA-SAT attack on the eve of Russia's invasion of Ukraine in 2022 have demonstrated that cyber operations are now an integral component of strategic competition and armed conflict. At the multilateral level, the UN Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG) have produced a normative framework affirming that international law applies in cyberspace, alongside eleven voluntary norms of responsible state behavior. Yet attribution remains politically charged, and enforcement is essentially absent. Parallel tracks at the Budapest Convention on Cybercrime, the new UN Cybercrime Convention adopted in 2024, and regional arrangements such as the EU Cyber Solidarity Act attempt to fill the gap. The core dispute today is whether existing international law and voluntary norms are sufficient, or whether a binding cyber treaty is needed; how to handle ransomware groups operating from permissive jurisdictions; and how to protect critical infrastructure, undersea cables, and election systems from sub-threshold operations that fall short of armed attack.

Key players

Geopolitical Risks to the Global Security Environment

The post-Cold War assumption of an expanding liberal order has given way to a period of overt great-power competition. Russia's full-scale invasion of Ukraine in February 2022 ended three decades of relative peace in Europe, while the October 2023 Hamas attack and subsequent war in Gaza reignited regional escalation across the Middle East, drawing in Hezbollah, the Houthis, and Iran. In the Indo-Pacific, tensions across the Taiwan Strait, the South China Sea, and the Korean Peninsula have raised the prospect of simultaneous theater crises. These conflicts have produced second-order shocks for the global economy and security ecosystem: weaponized energy supplies, disruption of shipping through the Red Sea and the Black Sea, export controls on advanced semiconductors, and the fragmentation of technology stacks along geopolitical lines. Sanctions regimes have expanded dramatically, and so has the use of secondary sanctions and outbound investment screening. Multilateral institutions, including the UN Security Council, have struggled to respond coherently as P5 vetoes proliferate. For the private sector and for European states such as Spain, the practical question is how to assess and mitigate exposure to geopolitical shocks—from energy and commodity volatility to data-localization mandates, sanctions compliance, and the security of personnel and assets in contested regions.

Key players

Regulatory Challenges in Digital and Cyber Governance

The past decade has produced an unprecedented wave of digital regulation. The EU's General Data Protection Regulation (2018) set a global template for data protection, followed by the NIS Directive (2016) and its successor NIS2 (2022), the Digital Operational Resilience Act (DORA) for financial services, the Cyber Resilience Act for connected products, and the AI Act adopted in 2024. The United States has moved through sectoral rules and SEC cyber-disclosure requirements (2023), while jurisdictions from China to Brazil to India have enacted their own data-protection and critical-information-infrastructure regimes. The resulting landscape is both demanding and fragmented. Multinational organizations must reconcile overlapping incident-reporting timelines (72 hours under GDPR, 24/72 hours under NIS2, four business days under SEC rules), conflicting data-localization mandates, and divergent definitions of critical or essential entities. Cross-border data transfers remain unstable, as illustrated by the successive invalidation of Safe Harbor and Privacy Shield and the ongoing scrutiny of the EU-US Data Privacy Framework. The debate now focuses on regulatory interoperability: how to align reporting and certification regimes without diluting protection, how to manage liability for software vendors under emerging product-security laws, and how to ensure that small and medium-sized enterprises can comply without disproportionate cost.

Key players

Business Continuity and Operational Resilience

Business continuity planning grew out of mainframe-era disaster recovery in the 1970s and was reshaped by 9/11, which exposed the fragility of concentrated financial infrastructure in Lower Manhattan. Standards such as ISO 22301 and the US FFIEC handbook formalized the discipline, but the field has been transformed by a sequence of systemic shocks: the 2011 Tōhoku earthquake and Thai floods that disrupted electronics supply chains, the COVID-19 pandemic, the 2021 Suez Canal blockage, NotPetya's collateral damage to Maersk and Merck, and recurring ransomware attacks on hospitals, ports, and pipelines. Regulators have responded by elevating continuity from an internal best practice to a supervised obligation. The UK's operational resilience regime, the EU's DORA for financial entities, and the Basel Committee's principles for operational resilience now require firms to identify important business services, set impact tolerances, and demonstrate the ability to remain within them through severe but plausible scenarios—including extended cyber outages and third-party failures. The contemporary debate is about scope: how to plan for compounding events (cyber plus geopolitical plus climate), how to handle concentration risk in cloud and SaaS providers, and how to test resilience meaningfully without disrupting live operations. Spain's experience with the 2024 DANA floods and the April 2025 Iberian power outage has made these questions immediate.

Key players

Artificial Intelligence in Cyber Security

Machine learning has been used in security tooling for over a decade—initially for spam filtering, malware classification, and user-behavior analytics. The arrival of capable generative models from 2022 onward expanded both the offensive and defensive frontiers. Defenders now deploy large language models for triage, threat-intelligence summarization, code review, and autonomous response, while attackers use the same technologies to scale phishing in dozens of languages, generate polymorphic malware, and accelerate vulnerability discovery. Independent studies and CERT bulletins have already documented AI-assisted social engineering campaigns and deepfake-enabled business email compromise. Policy responses have moved quickly. The EU AI Act classifies certain security-relevant systems as high-risk and imposes obligations on general-purpose model providers; the US has issued Executive Order 14110 and the AI Safety Institute framework; and the Bletchley, Seoul, and Paris AI Safety Summits have built an international dialogue on frontier risks. NIST's AI Risk Management Framework and MITRE's ATLAS catalog are emerging as practical references for AI-system security. Key unresolved questions include how to secure AI supply chains (model weights, training data, plug-ins), how to defend against prompt injection and model evasion in production, how to manage data leakage when sensitive corporate information is fed into third-party models, and how to govern the use of AI in offensive security and law enforcement.

Key players

Supply Chain Security in Critical Goods and Software

Supply chain security has moved from a logistics concern to a national-security priority over the past decade. Physical supply chains were stressed by the COVID-19 pandemic, the Suez blockage, and the semiconductor shortage of 2020–2023, which exposed dependencies on a handful of fabricators in Taiwan and South Korea. Software supply chains were transformed by the SolarWinds Orion compromise in 2020, the Log4j vulnerability in 2021, the 3CX and MOVEit incidents in 2023, and the XZ Utils backdoor uncovered in 2024—each demonstrating how a single upstream component can compromise thousands of downstream organizations. Governments have responded with both defensive and offensive instruments. On the defensive side, the US Executive Order 14028 mandates Software Bills of Materials (SBOMs) for federal suppliers, the EU Cyber Resilience Act introduces security obligations across product lifecycles, and CISA's Secure by Design pledge has attracted major vendor commitments. On the offensive side, expanding US, EU, Dutch, and Japanese export controls on advanced semiconductors and lithography equipment, alongside the US CHIPS Act and the EU Chips Act, signal a shift toward strategic reshoring and friend-shoring. The central debate is how to reconcile efficiency with resilience: whether SBOMs and attestation regimes can scale, how to manage open-source software's structural dependence on volunteer maintainers, and how to avoid fragmentation that would raise costs without delivering meaningful security gains.

Key players

Third-Party and Vendor Risk Management

Modern enterprises typically rely on hundreds to thousands of third parties, ranging from cloud and SaaS providers to managed service providers, payroll processors, and physical maintenance contractors. A succession of high-profile incidents has made third-party risk one of the most consequential categories of operational and cyber exposure: the 2013 Target breach (initiated through an HVAC vendor), the 2020 SolarWinds compromise, the 2023 MOVEit campaign that affected thousands of organizations through a single managed file-transfer product, and the 2024 Change Healthcare ransomware incident that disrupted a large share of US healthcare payments. Regulators have moved decisively into this space. The EU's DORA introduces direct oversight of critical ICT third-party providers to financial entities, NIS2 extends responsibility along the supply chain, and the US OCC, FRB, and FDIC issued joint interagency guidance on third-party risk in 2023. International standards such as ISO/IEC 27036 and assessments such as SOC 2 and TPRM questionnaires have proliferated but remain inconsistently applied. The core challenges are concentration risk—particularly in cloud hyperscalers and identity providers—visibility into fourth- and nth-party dependencies, contractual leverage with vendors larger than their customers, and the practical limits of due diligence based on point-in-time questionnaires rather than continuous monitoring.

Key players