Cyber Resilience Awareness Day Virtual Summit 2026

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Cyber resilience has moved from aspiration to mandate, tested on two fronts at once: it must hold up against AI-enabled adversaries that never sleep, and be measured with a rigor regulators and boards increasingly demand. Cyber Resilience Awareness Day 2026 convenes practitioners, researchers, and standards bodies to answer one question: how ready are we, really, across readiness assessment, recovery strategies, and roadmap design.

The day opens with the state of the art in measurement: an AI extension to the CR-CMM maturity model that turns AI resilience claims into evidence, presented alongside independent research showing that most organizations confuse designed maturity with the continuously degrading readiness they actually possess. A fireside conversation on resilience engineering with NIST previews proposed control updates for data vaulting and isolated recovery, reframing practice around minimum viable operations and impact tolerance.

For recovery, sessions introduce an ISSA-produced framework for safely restarting critical services after an incident (sequencing identity, security, and infrastructure layers rather than restoring by urgency) alongside secure-by-design threat modeling, AI-integrated vulnerability governance, and quantifiable remediation metrics that turn architecture decisions into resilience indicators.

Resilience is no longer a checkbox, but a number tracked continuously—from assessment to recovery to the next AI-era exam.

Featuring:
Francesco Chiarini, Chairman ISSA Cyber Resilience SIG and VP CISO in Residence, Rubrik (https://issa.org/speaker/francesco-chiarini/) (https://www.linkedin.com/in/chiarini/)
Calin Gheorghiu, Co-Chairman Cyber Resilience SIG (https://issa.org/speaker/calin-gheorghiu/) (https://www.linkedin.com/in/calin-gheorghiu-81657313a/)

Session topic and description to be announced.

Session topic and description to be announced.

Session topic and description to be announced.

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Cyber resilience is certainly supported by IT resilience. But it is not a pure IT issue. NIS2 recognizes this dependency in their requirements and thus establishes that all companies subject to NIS2 must conduct an All-Hazards Risk Analysis to identify all possible risks, including both IT and non-IT risks. While this Risk Analysis strategy looks fine at first glance to effectively measure the existing risks and face them effectively, it faces several challenges when deployed. This keynote will show the results of ECSO’s initiative in Risk Analysis to conduct an All-hazards, pan European Risk Analysis exercise, that showed the limitations of this strategy for an applicable, effective cyber resilience strategy for a multinational company.

Featuring:
Mariano Benito Gomez, Cybersecurity and Privacy Ambassador, GMV (https://www.linkedin.com/in/marianojbenito/)

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Enterprise organizations face a widening gap between security policy and measurable resilience outcomes. This session presents a practitioner framework for operationalizing secure-by-design principles at scale — covering AI-integrated vulnerability triage, pre-build threat modeling enforcement, and AI agent risk governance. Drawing on real-world deployment across commercial systems supporting 42 million U.S. workers, the session demonstrates how quantifiable metrics (remediation backlog reduction, time-to-remediate improvement) translate security architecture decisions into resilience readiness indicators. Attendees will see how NIST, CSA, and AIUC-1 frameworks anchor the measurement approach and how the same methodology applies across organizations of varying maturity.

Featuring:
Sanat Pattanaik, Principal Security Architect, ADP (https://www.linkedin.com/in/sanatpt/)

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Most organizations assess cyber resilience by confirming and documenting what controls exist and how mature the processes around them are. Maturity frameworks, compliance audits, and risk registers all answer the same question: what did we design? None answer the question that matters when a threat arrives: is it working right now?

Controls degrade between assessments. Patches slip. People make rational trade-offs under pressure. The result is control drift, a growing gap between the resilience posture an organization believes it has and the one that actually exists, oftentimes a gap that is invisible to point-in-time assessments and maturity scores.

This talk examines why the gap exists, why conventional measurement misses it, and what to do instead: decomposing controls into measurable mechanisms — detection reliability, response timeliness, resistance strength — and replacing assumptions with rolling measurement from telemetry you already have. It shows how the same control configuration produces dramatically different risk outcomes in different operational contexts, how continuous control measurement can feed quantified risk analysis when decisions demand it, and why resilience is something you measure continuously and not something you declare by checkbox.

Featuring:
Laura Voicu, Co-Founder & CDSO, Enterprise Risk Quantification Institute (ERQI)

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Understanding the current state of cyber resilience is essential for guiding decision-makers and helping organisations improve their resilience. Cyber-attacks are growing more sophisticated, driven by advanced technologies such as artificial intelligence, rising cyber warfare activity, and increasing global connectivity. In 2024, legislation such as the Digital Operational Resilience Act (DORA) and the European Cyber Resilience Act was enacted to embed cyber resilience into organisational operations.

It is essential to understand cyber resilience, how organisations can measure it, and how to address the most common pitfalls. This research answers two questions: What is the current state of cyber resilience across a sample of organisations? And can a codified method be established to address the most common challenges affecting effective cyber resilience?

The study surveyed 46 global partners and organisational leaders, ranging from management to C-suite, to explore their organisations' cyber resilience postures—assessing readiness across three phases: resistance, response, and recovery—while recognising that attempted breaches are nearly inevitable and represent a constant risk.

Four key impediments were identified:
*Limited reporting practices
*Difficulty building a resilient organisational culture
*Insufficient collaboration
*Lack of planning for compromise

These barriers—spanning internal and external challenges—hinder organisations' ability to anticipate, withstand, and recover from cyber threats, underscoring the complexity of building cohesive defences across diverse environments.

Featuring:
Adam D'Arcy, Lead, Infrastructure Security, Klaviyo (https://www.linkedin.com/in/adamedarcy/)

Session topic and description to be announced.

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Enterprise AI is under pressure to prove its value. Inference costs are real, they arrive before ROI does, and buyers are demanding to see what they are getting. Security has largely escaped that standard. That is changing. Answering that demand means doing something most security leaders have never been asked to do: connect exposure and control directly to financial outcome. Grounded in loss data, exposure telemetry, and adversary behavior, this session demonstrates how that connection is made — using methods that meet the same standard of proof now being demanded of AI investment, with an approach more straightforward than most expect.

Featuring:
Richard Seiersen, Chief Risk Officer, Qualys (https://www.linkedin.com/in/richardseiersen/)

Session topic and description to be announced.

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

A three-layer model for measuring readiness by comparing what leaders believe, what systems actually do, and what the organisation can govern. Derived from field assessments across MSPs, VARs and mid-market environments, surfacing architectural dependencies, recovery gaps and governance blind spots, with CR-CMM alignment for consistent benchmarking.

Featuring:
Jeff McCue, Resilience Architect, ProofPackets® (https://www.linkedin.com/in/jeff-mccue/)
Travis Chambers, Information Technology Consultant, NA (https://www.linkedin.com/in/tschambers/)

Session topic and description to be announced.

Session topic and description to be announced.