Tomorrow, October 13, the global industrial cybersecurity community once again comes together for Industrial Cyber Days: Critical Infrastructure 2026. Over two days, practitioners, engineers, security leaders, researchers, and technology providers from across APAC, EMEA, and the Americas will work through the decisions that matter most to essential services.
Hosted by Industrial Cyber in collaboration with Takepoint Research, the fully virtual event runs across three regional blocks: APAC from 13:00 SGT and EMEA from 11:00 CEST on October 13, and the Americas from 9:00 EDT on October 14. It brings together people who operate, engineer, secure, and support critical infrastructure, wherever they work.
The sector is not short of frameworks, standards, regulation, or technology. What remains difficult is turning all of it into clear decisions about what matters most, made by the right people, before an incident forces the question. That is the work this program is built around.
It is also work that cybersecurity teams cannot do alone, which is why the speakers include utility CISOs, a plant manager, a sector CERT specialist, a chief product security officer, a government practitioner, and independent consultants.
What follows is not the full agenda. It is a look at the questions the community will be working through over the next two days, and why your experience belongs in the conversation.
Start with what you are protecting
The program opens in APAC with a fireside chat between Justin Nga, Cybersecurity Manager at Powercor, and Jonathon Gordon, Directing Analyst at Takepoint Research. Cyber Isn’t Always the Biggest Risk on the Table makes the case that cyber risk is often a symptom of wider business and technology decisions rather than the root cause. The conversation covers where compliance helps and where it stretches resources, why organizations at different levels of maturity cannot all be held to the same pace, and how controls that multiply faster than they can be managed become a risk in their own right.
The industry panel From FUD to Value picks up the theme. Moderated by Peter Jackson of Dragos and SANS, it brings together Andrew West of Integral SCADA, Koyel Ghosh, who leads cyber, OT, and GRC in the maritime sector, and Omer Naveed, plant manager at Oursun Pakistan Ltd.
Their starting point is that a narrow focus on assets misses what those assets exist to do. When an OT system stops, the effect reaches partners, customers, contractors, and downstream operations. The panel will discuss how to identify what cannot fail, how to explain risk in terms management acts on, and why much published guidance assumes a factory where everything sits inside the fence, which is not how widely distributed utility systems work.
OT cybersecurity consultant Pedro Wirya follows with Threat Pathways, Not CVE Lists, on which attacks can actually reach a crown jewel and cause a high-consequence event.
Pippa Flanagan, founder of OT Cyber Speakeasy, offers a practical method in The Control Comes Last. Her sequence is consequence, then protection, then control, with a simple test before implementing anything: which failure of the process does this actually prevent?
The EMEA block opens on the same ground. Michael Weng, Senior OT Security Specialist and Digital Incident Response Manager at Denmark’s SektorCERT, joins Gordon for a fireside chat on Start Where Value Lives.
Drawing on day-to-day detection and response for energy, district heating, and water utilities, he will explain what happens when a utility has not decided what it is protecting: every alarm looks the same, and the systems that matter most wait in the same queue as everything else. The conversation also looks at SektorCERT’s sector-owned model, which pools sensors, analysts, and response so that small municipal providers gain capability they could not build alone.
Decide who makes the call
Critical infrastructure is rarely run by a single organization. Owners rely on operating companies, OEMs, integrators, and service providers, each controlling part of the environment without necessarily holding the authority to make consequential decisions.
Who Actually Owns the Decision?, moderated by Gordon, puts that problem to Agustín Valencia of Fortinet, Federica Maria Rita Livelli of START 4.0, OT security executive Akash Saksena, and Arun Rajagopal of Cyberforte.
The panel works through a scenario many readers will recognize. It is 2 a.m., a contracted operator sees evidence of compromise, cybersecurity recommends isolation, and operations says isolation could disrupt an essential service. Who decides, and when does it become the asset owner’s incident?
The discussion extends to contracts that run for a decade while systems and regulation change around them, to reporting deadlines that turn a slow handoff into a governance problem, and to why tabletop exercises should test authority as well as technical response.
With NIS2, the EU’s Critical Entities Resilience Directive, and the U.K.’s NIS regulations in place, these questions are difficult to defer.
Stephan Dudler, co-founder of Vayron, takes the regulatory discussion further in What the CRA Owes Operators and What NIS2 Asks in Return. Using an anonymized operator case, the session examines what happens when an actively exploited vulnerability starts two regulatory clocks: one for the manufacturer under the Cyber Resilience Act and another for the operator under NIS2. The discussion looks at what asset owners should expect from suppliers, how to prioritize vulnerabilities by operational consequence rather than CVSS alone, and what needs to change in procurement, reporting, and maintenance planning.
Govern AI before it governs the process
AI runs through the program because it is already finding its way into industrial operations, sometimes faster than the governance needed to manage it. Vendors embed it in products, staff build their own tools, and some deployments remain invisible to the people accountable for the process.
On Wednesday, Oct. 14, Andrew Bochman, Strategic Resilience Lead at West Yost, opens the Americas block with the keynote Defensible AI Risk, looking at what boards, regulators, and insurers should be asking for as agentic AI becomes an operational dependency.
The panel When AI Enters the Control Loop follows, moderated by Mike Holcomb of UtilSec with Elizabeth McAndrew-Benavides of InfraShield, Andrew Krapf of Loudoun Water, Dennis Hackney of CyberSecureOT, and Dan Ricci of Industrial Data Works.
Expect a practical discussion: where AI is actually running in OT today, how to find the tools nobody approved, what least privilege means for an agent, and what a small utility can do next week and next month.
In APAC, Tahseen Saber of DTS Solution looks at AI in OT cybersecurity from both the offensive and the defensive perspective, and Shiv Kataria, CISO at Rieter, shares a manufacturing CISO’s playbook for AI, quantum, and Europe’s new cyber rules.
In EMEA, Michelle Govender, founder and CEO of Octarity, asks what changes for cybersecurity when AI becomes a medical device. Anton Shipulin of Nozomi Networks then joins Gordon for Are We Securing OT for Yesterday’s Threats?, asking whether OT security strategies are still built on assumptions from an earlier era, including what autonomy and post-quantum planning mean for assets that will be in service for decades.
Plan for the day protection fails
Several sessions deal with what happens after controls have been bypassed.
Matthew Rogers, OT Cybersecurity Lead at U.S. Cybersecurity and Infrastructure Security Agency, presents CI Fortify, exploring how critical infrastructure operators can prepare to sustain essential functions during a cyberattack. His session covers functional tests operators can run today, how to recover when you cannot ask for help, and how isolation differs from an air gap.
Imran Eskic, CTO of HyperBUNKER, shares what happens when damaged drives and compromised industrial controllers reach a data recovery lab, including the cases that failed.
In Beyond Backup, Hannah Bergin and Jack Mansfield of Macrium, with Purna Kiran Mopidevi of Sentinel ICCS, discuss the difference between having backups and being ready to recover systems that cannot stop.
Player Pate of Dragos takes on a problem that comes before any of this in Threat Hunting on an Inventory Nobody Trusts.
Access is part of the same picture. In Same Risk, Different Rulebooks, moderated by Gordon, Roger Caslow of Hampton Roads Sanitation District, Mike Tetto, former CISO of Eversource Energy, Mike Hoffman of Dragos and SANS, and Ethan Schmertzler of Dispel compare how electric and water utilities control who can reach their OT.
One test from the panel is worth trying in your own environment: if every external connection had to be cut in the next ten minutes, could it be done, and would the process keep running?
A program for every size of operator
Not every operator has a security team. Jason Rivera of Cabreza focuses on the highest-value steps for small utilities and seasonal operations.
Kristin King of AnzenSage joins Mike Holcomb to discuss food and agriculture, a sector that keeps every other one fed and rarely gets a seat at the cybersecurity table.
The event closes with Dee Kimata, chief product security officer at Hitachi Energy, in a fireside chat with Gordon on secure-by-design: what asset owners should expect from suppliers, what manufacturers need from customers, and why product security is a relationship that lasts the life of the asset.
Why we are asking you to join
One of the reasons we bring this community together across three regions is that the challenges are rarely unique to one country or sector. A municipal water operator in Europe may have more in common with a regional utility in North America or an industrial facility in APAC than they might initially realize. The regulatory obligations may differ, but the operational questions often do not.
The questions on this agenda need more than one perspective. They need the engineer who knows what the process can tolerate, the operator who takes the call at 2 a.m., the manager who has to fund the work, and the supplier who has to support the product for decades.
The conversations begin tomorrow.
Whether you operate a small municipal utility, manage cybersecurity across multiple industrial sites, engineer the systems that keep essential services running, or support the organizations that do, there is a place for your perspective.
Join us across APAC, EMEA, and the Americas on October 13 and 14. Participation is free, the event is fully virtual, and registration is still open.
Join the conversation. Register for Industrial Cyber Days: Critical Infrastructure 2026 →
