According to the Microsoft Digital Defence Report 2025 (released in October 2025), Germany ranked 4th among the world’s most targeted nations for cyberattacks, with vulnerability discovery and active exploitation increasing at an unprecedented pace. For CIOs and CISOs, cyber risk is no longer an episodic challenge, it is a constant operational reality that shapes IT strategy, architecture, and investment decisions. This opening panel will examine the evolving threat landscape from a technology leadership perspective, moving beyond awareness and compliance to focus on how CIOs and CISOs can design resilient systems, drive proactive response, and ensure business continuity when breaches are inevitable. Panelists will share insights on operational accountability, decision-making under pressure, and aligning security, IT, and business to strengthen the organization’s ability to withstand cyber incidents

Key Takeaways:
• Understand what Germany’s attack statistics mean for business continuity, economic stability
• Explore how leaders can strengthen the relationship between business, IT and security.
• Insights into actionable strategies to minimize disruption and maintain innovation during inevitable attacks.
• Gain practical approaches to executive accountability, decision-making, and board-level engagement.

As Germany accelerates investment in advanced technologies, leadership resilience has become a strategic imperative. This panel will explore how organisations can safeguard critical technology investments while maintaining digital sovereignty in an increasingly complex geopolitical and regulatory landscape. Bringing together senior leaders, the discussion will examine how culture, skills, and leadership behaviours directly influence risk posture, innovation outcomes, and long-term competitiveness. The session will also unpack what “secure-by-design” truly means at scale, embedding security across technology architecture, operational processes, and workforce capability to protect Germany’s high-tech future without slowing progress.

Key Takeaways:
• Understand the role of safeguarding strategic technology investments while maintaining digital sovereignty.
• Explore how people, culture, skills, and leadership influence risk, and innovation outcomes.
• Identify what “secure-by-design” means at scale, across technology, processes, and people.

Over the past decade, GRC has moved from written policies into the daily reality of technology operations and resilience testing. As threat landscapes evolved, expectations around security, availability, and recovery changed. The EU, the UK, Switzerland, and the United States have developed different regulatory approaches shaped by culture, legal systems, and economic priorities. This presentation examines how similar control objectives can lead to different outcomes in operational reality. It explores the intersection between the three lines of defense (3. LoD), regulatory authorities, and what global ICT service providers can deliver in practice, often driven by distinct expectations and intentions. Examples from automotive audits in Germany and cross-border ICT risk implementations in the financial services industry are used to illustrate differences in practice rather than being described abstractly. It also shows how organizations can move beyond a compliance mindset by separating real risks from control gaps and fostering resilience that works beyond slide decks.

In this interactive session, our event partners will take the lead in initiating and facilitating conversations centered on challenges and solutions within the industry. Attendees can expect dynamic discussions where diverse perspectives are shared, fostering collaborative problem-solving and the exploration of innovative solutions to common industry hurdles.

In an environment shaped by complex data strategies, rapid AI adoption, and large scale legacy modernization, speed has become a competitive necessity. Under these conditions, avoiding mistakes is unrealistic, and trying to do so often slows organizations down even further. The real challenge is not failure itself, but how leaders and teams respond when it occurs.

Guided by the leadership principle “Think big, start small, learn fast,” this session explores how we deliberately re framed mistakes as a source of learning rather than blame. Drawing on research by Amy Edmondson, Google’s Project Aristotle, and recent McKinsey and EY studies, the session outlines practical strategies and explicit leadership behaviors – such as role modeling openness, reframing errors, and enabling structured reflection – that enable teams to speak up early and learn fast. As a result, we observed that teams began escalating risks earlier, reflecting more openly on setbacks, and experimenting more confidently in complex transformation initiatives. This shift strengthened decision quality, reduced repeated errors, and increased organizational resilience in high uncertainty environments. The session highlights the decisive role of leadership teams in shaping failure culture, and demonstrates how treating mistakes as learning signals can accelerate innovation rather than hinder it.

The idea of an “autonomous SOC” is gaining traction as security teams look for ways to streamline operations, reduce analyst alert fatigue, and strengthen overall defence. But what does this actually look like inside a real security operations centre?
This session explores the reality behind the concept, examining how AI can support analysts, where automation delivers real value, and the challenges organisations face when moving toward a more autonomous SOC.
Key Takeaways
• What “autonomous SOC” really means in practice
• How AI can reduce alert fatigue and improve operational efficiency
• The practical steps organisations can take to move toward greater SOC autonomy

An overview of the EU’s rapidly expanding regulatory landscape—including NIS2, the Cyber Resilience Act, and DORA, which introduces stricter cybersecurity, resilience, and product security obligations across sectors. It highlights the increasing demands placed on organizations, such as tighter incident reporting requirements, secure by design expectations, and growing pressure to harmonize compliance across jurisdictions and complex supply chains.

• How the EU’s new cyber regulations (NIS2, CRA, DORA) reshape security, resilience, and product security expectations across all sectors;
• What tighter incident reporting rules and secure by design obligations mean for your security, engineering, and compliance teams;
• How organizations can harmonize compliance across jurisdictions and manage supply chain pressures in a rapidly evolving regulatory landscape.

Enterprise AI evolves through four distinct stages: Reactive Intelligence, Recommendation Executive, Agentic Execution, and Autonomous Execution. As organizations move from systems that react and recommend to systems that act and execute, execution shifts from human led operations to digital observability with human governance. Decision latency is reduced, operational consistency improves, and accountability moves from individual judgment to clearly defined AI enabled control models.

Just as industrial automation moved humans from operating machines to supervising and optimizing processes, AI is now shifting enterprises from manual monitoring to continuous, system level governance. In practice, this transition has enabled measurable improvements such as faster cycle times, reduced operational friction, clearer ownership across IT and business functions, and more predictable execution at scale. Drawing on real enterprise transformation experience, this session connects AI maturity to tangible business outcomes, showing how CIOs can move beyond pilots and experimentation to operational impact. This session explains what that evolution means for European CIOs: how operating models, leadership roles, and accountability frameworks must change as AI becomes an executive actor in the enterprise, and how to link AI maturity directly to business value, not just technology advancement.

IAM was designed for employees, not partner ecosystems. As organisations scale B2B2x models, identities across partners, subsidiaries and suppliers are increasingly fragmented—creating risk, friction and scalability limits.

In Eclipsed Identities, this session explores why Partner IAM (PIAM) is fundamentally different from workforce IAM, and why B2B2x identity is closer to CIAM in scale and design. Using real-world examples, we’ll show how a partner identity fabric enables delegated onboarding, flexible authentication and secure access for millions of identities—without the complexity of traditional IGA.

Take a break, engage in meetings and join a discussion roundtable! During this PM Power Break, fellow enterprise leaders will guide discussions on their favorite topic, fostering an environment of open exchange, exploration of diverse perspectives and experiences. Attendees can grab a coffee and anticipate engaging conversations through 1-2-1 meetings and roundtables. Conversations will be driven by shared challenges and interests, offering valuable insights and opportunities for collaborative learning and networking.

As AI rapidly reshapes how work gets done, enterprise leaders are moving beyond experimentation and into execution. This panel will explore how organisations are making concrete workforce decisions today, determining which roles to reskill, which capabilities to redeploy, and where entirely new skills are required. This final discussion will centre on real-world trade-offs, lessons learned, and what has worked at scale.

• Gain insights as to which roles organisations are reskilling, redesigning, or removing, as AI reshapes enterprise work.
• Real-world examples of how organisations are redeploying talent into AI-enabled roles and overcoming internal resistance.
• Clear guidance on building AI capability at speed while maintaining productivity, governance, and employee trust.