The classic approach of prevention and compliance alone is no longer enough: Cybersec 2026 is therefore not just about technology, but primarily about resilience.
Companies, experts, and even the Belgian government agree: cyber resilience is more important than ever, especially as attacks evolve continuously and at a rapid pace. Whether it’s about identity, AI agents, ransomware, endpoint security, or European regulations such as NIS2 and DORA; the same warning is heard everywhere: cybersecurity is no longer an IT problem, but a business risk.
Cyberattacks affect national security
The opening sessions immediately place cybersecurity in a broader geopolitical context. Major General Pierre Cipolat, commander of the Belgian Cyber Force which was officially established a year ago, is clear: today, cyberattacks directly affect economic stability and national security.
“Cybersecurity is no longer just about code, but about trust networks, shared responsibility, and national resilience.”
Belgium is therefore investing more and more in joint cyber capabilities, because it is impossible for organizations to fight modern threats alone. This feeling is also growing because cybercriminals are increasingly operating professionally. Today, they work like real companies, complete with HR structures and even customer support.
“If you are attacked and have an incident, you can call them and you can be sure they will help you. That is probably better than most support contacts you have at hand right now,” says Heidi McElveen of AXE Group during her session on identity security. Ransomware-as-a-service is available for just 100 dollars. Although ‘helping’ is relative in this context: the helpdesk will primarily be ready to facilitate ransomware payments.
Cybersecurity is a team sport
Endpoint security still receives a lot of attention today. Pelle Aardewerk from HP explains how endpoints are the starting point for modern attacks. “More than two-thirds of all cybersecurity incidents today start on endpoints,” he states. He makes a comparison with sports: “Cybersecurity is a team sport. Defenders are constantly playing catch-up today if they only focus on detection.”
More attention must be paid to prevention. The dwell time, the time between the moment an attacker gains access to a network and the moment the damage becomes visible, has decreased significantly. “In 2022, the dwell time was still 80 days,” says McElveen. “In 2026, it is less than four hours. That means we can utilize human employees more to keep up with that.”
That is why companies must start thinking differently. McElveen proposes the assume compromise approach: in her view, relying solely on prevention is not enough. Organizations must assume they have already been compromised and focus on detection and rapid response.
HP also addresses supply chain security: hardware can be tampered with on its way to customers. The manufacturer therefore offers a new solution that provides each device with a private key upon leaving the factory, so that organizations can verify that nothing was modified before the device is put into use.
European regulation as a catalyst for maturity
Regulations such as NIS2, DORA, and the Cyber Resilience Act come up in almost every session. Europe wants to increase overall cyber resilience. The Cyber Resilience Act, which comes into force later this year, obliges hardware and software suppliers to demonstrate that their products are designed securely and remain secure throughout their entire lifecycle.
“Use this as an opportunity to differentiate yourself. If you are ISO 27001 or NIS2 certified, you are at a higher level of quality.”
Belgian cybersecurity players now see regulation as an opportunity. “With GDPR, the reaction of many companies was: this is mandatory, we have to do something, but we don’t like it,” says David Van der Hosten, CEO of Approach Cyber. “With NIS2, they understand the risk better and see the value in it. They are more willing to do something with it.”
Identity: the weakest link
McElveen explains on the event stage how attackers can bypass MFA via stolen session cookies. The attacker sets up a proxy server between the user and the real login page, in this case from Microsoft. This then intercepts the cookie after a successful authentication, and subsequently has access to the entire Microsoft environment for up to 24 hours.
“We had MFA activated” is still one of the most common reactions after incidents. “Identity is the new perimeter,” states McElveen. She doesn’t shy away from the cliché: “Attackers don’t break in anymore, they just log in.”
David Ovich, solutions engineer at Okta, sees another major challenge: the rise of AI agents. Gartner predicts that by 2028, 25 percent of all enterprise breaches will be traceable to AI agents. These perform actions in systems independently and often have extensive access via shared service accounts and tokens. “You would never hire a human employee without a badge, a clear job description, and limited access to what is strictly necessary. It is time to treat AI agents the same way.”
Cybersec 2026 shows a sector in full transition
Cybersec 2026 shows how quickly the cybersecurity sector is changing. Today, cybersecurity is no longer about firewalls or antivirus software, but about ecosystems, collaboration, and resilience. “Attackers don’t care if your company is small,” is heard repeatedly.
The rise of AI, stricter regulations, and more professional attackers are forcing organizations to redefine their strategy. Van der Hosten, CEO of Approach Cyber: “Invest in the human factor. Technology cannot solve it all. We should not see our employees as the weakest link, but as the first line of defense.”