CyberForward 2026: Advancing Europe’s Cyber Autonomy

Digital autonomy is becoming increasingly important — and with it, the need for stronger cyber resilience. But what does this mean in practice for organisations in Europe and the Netherlands? On 17 June, CyberForward 2026 brings together professionals from cybersecurity, technology, industry, government, research and academia to explore how organisations can turn digital dependencies and cyber risks into concrete action. The event is organised by NCC-NL (Dutch Cybersecurity Coordination Centre), in cooperation with Cyberveilig Nederland, FME and INTERSECT. The programme features keynote speakers including Sebastiano Toffaletti (European Digital SME Alliance), Rogier Fischer (CEO, Hadrian) and Dr. Haroon Sheikh (VU Amsterdam).

Key topics during the event include:

• Vulnerabilities in European and Dutch technology value chains
• Critical technologies for cyber resilience and competitiveness
• Cybersecurity regulation into practice (incl. Cyber Resilience Act and secure-by-design)
• Cyber risk management in IT/OT, supply chains and internal threats
• Scaling Dutch cybersecurity innovation to global markets
• EU funding opportunities

Join us at the CyberForward 2026 event, where INTERSECT coordinates the following presentations:

• Ben Kokx (Philips) and Wendy Tonks (Omron Europe) “Translating the CRA into practice: strategic preparation for the 2027 Standards”
  The Cyber Resilience Act (CRA) sets requirements for digital products in Europe. In this session, you’ll gain a behind-the-scenes perspective on how abstract legislation is translated into concrete technical standards. Experts from Philips, Ben Kokx and OMRON, Wendy Tonks share insights from the standardisation process and the ongoing discussions within the European Commission. You’ll learn how to prepare your organisation’s product development and procurement strategies for the 2027 deadline, when these standards become mandatory for digital products on the European market. What you’ll gain – Understanding of how CRA standards are applied in practice – Practical guidance on aligning product development and procurement with CRA requirements – Insight into the standardisation process and decision-making at the European Commission – Awareness of considerations for compliance and preparing for the 2027 deadline.
• Erik Poll (Radboud University) on “Secure-by-Design: Ensuring software security from day one”
  The goal of this session is to help developers and procurement teams move from the secure-by-design principle to practical implementation in software development. Dr. Erik Poll (Associate Professor, Digital Security, Radboud University) will discuss how privacy and security can be applied from the very first stage of design. He will also provide an overview of techniques developed over the past 20 years to achieve security by design. Participants will gain methods to identify and reduce vulnerabilities in source code and dependencies before software reaches production.

  What you’ll gain
  •    Practical strategies for integrating security and privacy from the start
  •    Ways to detect and reduce vulnerabilities before production
  •    Understanding of continuous security testing in the software lifecycle

• Jeroen van der Ham-de Vos (University of Twente) on “Managing vulnerabilities: best practices for reaching stakeholders at scale“

  Almost every product will encounter security vulnerabilities during its lifetime, yet few organisations know how to reach the right stakeholders across complex supply chains. This session provides organisations with tools to manage security issues at scale. Jeroen van der Ham-de Vos, Senior Lecturer in Cyber Security Vulnerability Management at the University of Twente, will share best practices for managing incidents, reaching stakeholders effectively and understanding the difference between vulnerability disclosure and notifications.

  What you’ll gain
  •    Practical strategies for engaging the right stakeholders across complex supply chains
  •    Insights into managing incidents at scale efficiently
  •    Clarity on the differences between vulnerability disclosure and notifications