Where is the Shaping Cybersecurity Conference 2026 being held?

The conference is being held in Berlin, DEU.

What is the format of the Shaping Cybersecurity Conference 2026?

The conference is an in-person event.

What are the key themes of the Shaping Cybersecurity Conference 2026?

The conference focuses on cyber foreign policy, cybersecurity, and resilience.

Shaping Cybersecurity Conference 2026

Name: Shaping Cybersecurity Conference 2026
Start: 2026-07-09T00:00:00Z
End: 2026-07-10T00:00:00Z
Location: Berlin

Jul 9–10, 2026Berlin, GermanyIn-person

ConcludedRegistration closed

The Shaping Cybersecurity Conference 2026, held in Berlin, DEU, is an in-person event dedicated to the critical areas of cyber foreign policy, cybersecurity, and resilience. This gathering provides a platform for in-depth discussions and collaborative efforts to address the complex challenges within the digital sphere. The conference is scheduled to take place over two days in July, bringing together experts and stakeholders to explore current trends and future strategies.

Committees & topics

Topics
European and International Cybersecurity Cooperation · Strategic Responses to Cyber Threats · Cyber in Geopolitical Conflict · Protection of Critical Infrastructure and Building Digital Resilience

Why it matters

The conference addresses the escalating sophistication of cyber threats, which continue to pose significant risks to national security, economic stability, and critical infrastructure worldwide. In an increasingly interconnected world, the discussions around cyber foreign policy are paramount, as nations grapple with establishing norms of behavior in cyberspace and responding to state-sponsored cyber activities. The focus on cybersecurity and resilience underscores the necessity for robust defense mechanisms and the ability to recover swiftly from cyber incidents.

This event is particularly relevant as it convenes in Berlin, DEU, a hub for technological innovation and policy discourse within Europe. The outcomes of such discussions can influence international cooperation frameworks, contribute to the development of <glossary-link slug="cyber-confidence-building-measures">cyber confidence-building measures</glossary-link>, and foster a more secure global digital environment. By bringing together diverse perspectives, the conference aims to bridge gaps between policy, technology, and international relations, fostering a comprehensive approach to cybersecurity challenges.

How to prepare

To effectively engage with the themes of the Shaping Cybersecurity Conference 2026, participants should consider undertaking a thorough <lesson-link slug="what-is-stakeholder-mapping">stakeholder mapping</lesson-link> exercise. Understanding the various actors involved in cyber foreign policy, cybersecurity, and resilience—including governmental bodies, private sector entities, and international organizations—is crucial. This preparation allows for a more nuanced understanding of the different interests and leverage points at play.

Furthermore, familiarizing oneself with <lesson-link slug="engagement-strategies">engagement strategies</lesson-link> will be beneficial for contributing meaningfully to discussions and fostering collaborative outcomes. Given the multi-faceted nature of cybersecurity, preparing to analyze issues from various national and organizational perspectives, as outlined in lessons like <lesson-link slug="dynamic-analysis">Dynamic Analysis</lesson-link>, will enhance one's ability to participate in shaping effective policy and technical solutions. The conference's location in Berlin, DEU, also suggests an emphasis on European perspectives, making an understanding of regional cyber policies and initiatives particularly relevant.

Country perspectives

Where the most-relevant 4 countries stand on the core issues in play. Click through for the full country profile.

Germany

A key proponent of international cybersecurity cooperation and regulation within Europe.

Role in topic

As the host nation, DEU plays a central role in facilitating discussions on cyber foreign policy, cybersecurity, and resilience. Its national cybersecurity strategy often emphasizes international collaboration, the protection of <glossary-link slug="critical-information-infrastructure">critical information infrastructure</glossary-link>, and the development of robust digital defenses. DEU's perspective is crucial for understanding European approaches to cyber governance and security.

United States

A global leader in cybersecurity technology and policy, advocating for a free and open internet while actively countering cyber threats.

Role in topic

The USA is a significant player in shaping global cybersecurity norms and practices. Its approach often involves a combination of offensive and defensive cyber capabilities, strong alliances, and efforts to deter malicious cyber activities. The USA's perspective on cyber foreign policy will likely focus on attribution, deterrence, and international legal frameworks.

China

A major cyber power with a strong emphasis on cyber sovereignty and state control over digital information.

Role in topic

CHN's involvement in cybersecurity discussions often centers on its concept of cyber sovereignty, which prioritizes national control over internet governance and data flows. Its perspective on cyber foreign policy and resilience will likely highlight the importance of national security in the digital domain and may differ significantly from Western approaches regarding data privacy and internet freedom.

Russia

A prominent actor in cyberspace, often associated with advanced cyber operations and advocating for international treaties on information security.

Topics & background

The background behind each topic and the actors that shape it.

European and International Cybersecurity Cooperation

International cooperation on cybersecurity has evolved through a patchwork of overlapping frameworks. At the UN level, the Group of Governmental Experts (GGE) processes from 2004 onward established that international law applies in cyberspace and produced eleven voluntary norms of responsible state behavior, endorsed by the General Assembly in 2015. Since 2019, the Open-Ended Working Group (OEWG) on ICTs has broadened participation but exposed deep divisions between Western states, which favor building on existing norms, and Russia and China, which push for a new binding treaty and greater state control over the internet. Outside the UN, the 2001 Budapest Convention on Cybercrime remains the principal multilateral instrument on cybercrime, while a parallel UN Convention against Cybercrime was adopted in 2024 after years of contested negotiations. Within Europe, cooperation has accelerated sharply. The EU's 2016 NIS Directive and its 2023 successor NIS2 harmonized baseline security obligations across member states, while the Cyber Resilience Act, the Cyber Solidarity Act, and the establishment of ENISA as a permanent agency have built a denser regulatory architecture. NATO recognized cyberspace as an operational domain in 2016 and has integrated cyber defense into collective planning, including through the Cooperative Cyber Defence Centre of Excellence in Tallinn. Bilateral and minilateral arrangements — the Quad, the Counter Ransomware Initiative, and the US-EU Cyber Dialogue — fill gaps the multilateral system cannot. Today the central tension is between competing visions of cyberspace governance: a multistakeholder, rights-based model promoted by the EU and like-minded states, and a state-sovereigntist model advanced by Russia and China. Capacity-building for the Global South, attribution standards, and the future of the OEWG's successor mechanism after 2025 are the immediate flashpoints.

Key players

Strategic Responses to Cyber Threats

State and state-aligned cyber operations have become a routine instrument of statecraft. Landmark incidents — Stuxnet (2010), the Sony Pictures intrusion (2014), NotPetya (2017), SolarWinds (2020), the Colonial Pipeline ransomware attack (2021), and the Viasat KA-SAT disruption on the eve of Russia's 2022 invasion of Ukraine — have demonstrated that cyber tools can produce strategic effects without crossing conventional thresholds of armed conflict. In response, states have moved beyond purely defensive postures toward more assertive doctrines, including the US 'defend forward' and 'persistent engagement' concepts, the UK's National Cyber Force, and explicit attribution backed by indictments, sanctions, and expulsions. Strategic responses now combine deterrence by denial (hardening networks), deterrence by punishment (sanctions, indictments, offensive cyber operations), and coalition-building. The EU's Cyber Diplomacy Toolbox enables coordinated restrictive measures, while joint attribution statements among Five Eyes and EU partners have become standard practice for major incidents. Ransomware, treated initially as criminal activity, is increasingly framed as a national security threat given its impact on hospitals, pipelines, and local governments, and the safe harbor several actors enjoy in jurisdictions hostile to Western law enforcement. The unresolved questions are doctrinal and legal: what constitutes a 'use of force' or 'armed attack' in cyberspace, how proportionality applies to countermeasures, whether private 'hack-back' should be permitted, and how to manage escalation when offensive cyber capability is concentrated in a small number of states. The Tallinn Manual process and ongoing OEWG discussions provide frameworks, but state practice is outrunning consensus.

Key players

Cyber in Geopolitical Conflict

Cyber operations have become embedded in contemporary geopolitical conflict, both as preludes to and components of kinetic war. Russia's 2007 operations against Estonia and 2008 operations in Georgia were early demonstrations; the 2015 and 2016 attacks on Ukraine's electricity grid showed strategic effects on civilian infrastructure. Since Russia's full-scale invasion of Ukraine in February 2022, cyber and kinetic operations have run in parallel, with wiper malware, attacks on satellite communications, and information operations integrated into military campaigns. Ukraine's resilience — supported by Western governments, Microsoft, Google, Starlink, and the volunteer 'IT Army' — has become a case study in distributed cyber defense. Elsewhere, the Israel-Hamas war ignited a surge in hacktivism and Iranian-linked operations against Israeli and Western targets, while tensions across the Taiwan Strait have driven scrutiny of Chinese pre-positioning in critical infrastructure, exemplified by the Volt Typhoon campaign disclosed in 2023-2024. Cyber operations are also used below the threshold of armed conflict for coercion: election interference, intellectual property theft, disinformation, and pressure on diaspora communities. The central debate is how international humanitarian law applies to cyber operations during armed conflict — particularly the principles of distinction and proportionality when civilian infrastructure is targeted — and whether new norms are needed to constrain pre-positioning, attacks on humanitarian organizations, and civilian participation in hostilities. The ICRC has called for clearer rules; major powers remain reluctant to constrain their own capabilities.

Key players

Protection of Critical Infrastructure and Building Digital Resilience

Critical infrastructure — energy, water, transport, finance, healthcare, and digital services — has emerged as the most consequential target of cyber operations. The 2015 and 2016 attacks on Ukraine's grid, the 2017 Triton/Trisis malware targeting Saudi petrochemical safety systems, the 2021 Colonial Pipeline ransomware shutdown, and the 2024 attacks on water utilities in the US and Europe demonstrated that mid-tier actors can produce systemic disruption. Supply-chain compromises such as SolarWinds (2020) and the 2024 XZ Utils backdoor showed that resilience depends on dependencies far beyond any single operator's perimeter. Regulators have responded by raising baseline obligations. The EU's NIS2 Directive, the Critical Entities Resilience Directive, and DORA for the financial sector impose binding security and incident-reporting requirements across essential services. In the United States, CISA's voluntary Cybersecurity Performance Goals are being supplemented by sector-specific mandates from the TSA, EPA, and SEC. Japan, Australia, and Singapore have adopted comparable frameworks. Internationally, the UN OEWG's 'norm F' urges states not to damage critical infrastructure, and the ICRC has called for protection of essential civilian services as a humanitarian priority. Key unresolved issues include defining critical infrastructure consistently across jurisdictions, securing operational technology and industrial control systems whose lifecycles span decades, managing concentration risk in cloud and software supply chains, and extending resilience support to developing states whose digitalization is outpacing their defensive capacity. The question is no longer whether attacks will occur, but whether societies can absorb and recover from them.

Key players