Richard Blackham

🎤 Swiss Cyber Security Days 2026 | Speaking Sessions Quantum Fort will be represented at Swiss Cyber Security Days 2026 in Bern with two expert contributions focused on the strategic positioning of cybersecurity within modern enterprises. 17 February | 2:00 PM Filip Talac, Chief Executive Officer Why Cyber Security is Not an IT Problem (And Never Was) This session explores why cybersecurity must be addressed as an enterprise-wide responsibility and how risk exposure extends beyond technical boundaries into core business operations. 18 February | 11:00 AM Christian Koxholt, Chief Commercial Officer Cyber Security is a Boardroom Responsibility, Not an IT Task An executive perspective on integrating cybersecurity into board-level governance and aligning cyber risk management with enterprise strategy and value protection. We look forward to contributing to the dialogue on strategic cyber risk management and engaging with peers and leaders in Bern. Learn more: https://scsd.ch/de #SwissCyberSecurityDays #CyberRisk #CorporateGovernance #ExecutiveLeadership #EnterpriseResilience #QuantumFort

18

The Swiss Cyber Security Days (SCSD) in Bern just closed — and what a nice vibe. The collaboration with our Red Hat colleagues truly embodied the motto: “Open, Sovereign, Quantum-Safe.” Those three words perfectly capture where Europe — and Switzerland in particular — are heading: open ecosystems, digital sovereignty, and proactive preparation for the quantum era. The Tech Stage featured several excellent presentations, but a particular highlight was Thomas Maes and Cristof Kaufmann from PostFinance. They demonstrated how Swiss financial institutions can lead the way in building quantum resilience — not just through awareness, but through structured migration planning, ecosystem collaboration, and long-term cryptographic strategy. It’s encouraging to see concrete action emerging from the financial sector. Quantum safety is no longer theoretical — it’s becoming an operational priority. A big thank you to everyone who contributed to the discussions and to the strong Swiss cybersecurity community driving this forward. #SwissCyberSecurityDays #SCSD #QuantumSafe #PostQuantumCryptography #QuantumResilience #CyberSecurity #DigitalSovereignty #OpenSource #RedHat #PostFinance #PQC #CryptoAgility

56

2 Kommentare

Six security teams shipped six OpenClaw defence tools in 14 days Three attack surfaces survived: runtime semantic exfiltration, cross-agent context leakage and agent-to-agent trust chains with zero mutual authentication Cyber Security Ireland (CSI) - for OT/ICS Not by breaking controls, but by moving through chains of trusted agents Palo Alto Networks Unit 42 mapped OpenClaw to every category in the OWASP Top 10 for Agentic Applications And as Simon Willison describes it, this creates a “lethal trifecta” That should tell us something: This isn’t a point failure, it’s structural? The interesting part isn’t what failed, it’s what survived: • cross-agent context leakage • agent-to-agent trust with zero mutual authentication • runtime behaviour that never triggers a boundary As Jamieson O'Reilly notes, cross-agent context leakage is especially difficult to address because it is tightly bound to prompt injection, a systemic issue across LLM-powered systems That’s an important constraint It means: You can’t rely on perfectly filtering inputs You can’t assume agents won’t be influenced You can’t fully prevent propagation across a chain So, maybe the question shifts: Even if an agent is influenced, should it be able to act on that influence? Today, the answer is often yes, because trust is allowed to propagate: One agent reads Another interprets Another executes And the chain remains valid Even if the original instruction wasn’t Trust is propagating Authorisation is not being re-checked So, does this then create a new failure mode: A legitimate agent Executing an unauthorised outcome Via a valid chain Most control models still assume: Authenticate → Authorise → Execute But agent systems don’t behave like that anymore They are multi-step systems where authority moves At TrustdLogo, we’re exploring whether authorisation needs to travel with the instruction itself and be re-verified at each execution step Not trying to solve prompt injection, but constraining what it can do Because in agent systems: Prompt injection may be unavoidable But we suggest: Unauthorised execution doesn’t have to be Thoughts and pushback very welcome #AIsecurity #AgenticAI #CyberSecurity #LLMSecurity #OpenClaw #OWASP #SecurityArchitecture   https://lnkd.in/gUv6-3ND

Companies pursuing ISO 27001 certification often fail due to a lack of executive commitment, hindering successful implementation of Information Security Management Systems (ISMS). This exposes organizations to increased risk of security gaps and non-compliance. Organizations must ensure strong executive support and active participation in the ISO 27001 certification process to avoid critical ISMS implementation failures. 🛡️ #ai #cybersecurity https://lnkd.in/eS4R2Pbe

1

Swiss data privacy officers just made international SaaS solutions largely unusable for the public sector. Privatim—the umbrella organization of all cantonal data protection officers in Switzerland—has issued a decree that international SaaS solutions are inadmissible for sensitive or confidential data unless public bodies encrypt the data themselves and the cloud provider has zero access to the keys. This has obvious consequences: How do you use an ERP system if your data is encrypted and the provider can’t see it? How do you collaborate in Microsoft 365 if everything is encrypted client-side? You can’t. These systems become functionally useless. Client-side encryption works for pure storage—Dropbox-style file parking where you encrypt before upload. But Privatim’s requirement makes operational systems, where you need to work with data inside the application, essentially unusable. Privatim identified five core problems motivating their resolution: 🔓 There is no true end-to-end encryption in most SaaS 🔍 Swiss authorities can’t verify provider compliance 🚪The US CLOUD Act enables data access even in Swiss data centers ⚠️ Significant loss of control over data 📝 Providers can change terms unilaterally This affects every public tender for cloud services in Switzerland. And while the resolution only binds public bodies, it sets the new standard for what Swiss data protection authorities consider adequate. The question for any organization processing sensitive data is: Whose cloud, under what terms, and with what guarantees of sovereignty? #DataSovereignty #CloudComputing #SwissDataProtection #CFO Sources https://lnkd.in/e-SNwTye https://lnkd.in/eivcsvp9 https://lnkd.in/eufG82AM

7

1 Kommentar

In this episode of the Security Repo Podcast, we dive into zero-day exploits, vulnerability markets, and why attackers don’t care about compliance paperwork. We also explore the real-world impact of hardware vulnerabilities, why a plug won’t save your hotel lock, and whether trying to “out-tech” cybercriminals is a losing strategy. 🎧 Watch the full episode: https://lnkd.in/e7P7uXGh #CyberSecurity #ZeroDay #VulnerabilityResearch #BoardroomSecurity #InfoSec

5

Most Cloud and Cyber Security investments don’t fail because of technology. They fail because of poor planning, late security decisions, and unclear ownership. Over-engineering without clarity, scaling without a roadmap, and treating security as an afterthought creates systems that look good on paper - but break under real-world pressure. When Cloud, Data, and AI solutions are designed with strategy, scalability, and security built in from day one, technology stops being a cost center and starts becoming a competitive advantage. The real shift happens when systems are built as solutions, not setups. 👉 If you’re planning or rethinking a Cloud Computing, Data Analytics, or Cyber Security initiative, start with the right foundation. Let’s talk. https://bminfotrade.com ANSHUL GOYAL Gaurav Solanki Lokesh Sharma Rahul Sharma Pankaj Gupta #CloudComputing #CyberSecurity #CloudSecurity #DataEngineering #AIInfrastructure CXO ( CEO / CIO / CFO / CMO / CTO) #DigitalTransformation Microsoft #EnterpriseIT #ITStrategy #ScalableSystems Amazon Web Services (AWS) #SecureByDesign

16

Currently a lot of standardization projects regarding the CRA are on-going. These standardization projects aim to develop harmonized European standards for the fundamental cybersecurity requirements of the CRA and the requirements regarding vulnerability management (horizontal standards) as well as different product categories (vertical standards). You can find an overview over the currently active standardization projects here: https://www.stan4cra.eu/ DKE, the German competence center for electrotechnical standardization representing Germany in international standardization organizations, has published a good overview regarding all standardization efforts ongoing including overviews regarding the current status of each standard (see pdf-documents at the end of the page): https://lnkd.in/d9nzEETs

8

Science Talk "Phishing, Deep Fakes, Internetbetrug: Cybersicherheit geht uns alle an. Was sagt die Wissenschaft, was tun die Hochschulen?" Moderated by Astrid Kuffner, the expert panel - Helmut Leopold, Head of Center for Digital Safety & Security, AIT Austrian Institute of Technology - Gerald Steiner, Chief Information Officer, Universität Salzburg, Chair ARGE ZID - Anna Vymazal, Department Sichere Informationssysteme, FH Oberösterreich Campus Hagenberg discussed the state of cybersecurity and data sovereignty, and what's being done to better secure organizations and individuals, at a well-attended event at the Aula der Wissenschaften. The dependency of our society on power, communication networks and IT infrastructure in most areas of our daily life is driving signifcant efforts and regulatory measures to secure critical infrastructure. Investments also need to include continuous education and training for staff, as humans often remain the weakest link. In additional to technical solution, everyone needs to follow basic "cyber hygiene" and excerise caution to protect against cybersecurity attacks. https://lnkd.in/dqeHRxp7 #cybersecurity

17

Was NIS2 für die OT-Sicherheit bedeutet: This is a really interesting interview between Max Gutberlet, CISO of Rotkäppchen-Mumm, and Max Rahner, Senior Manager Business Development at Tenable, written up in Prozesstechnik online (the web platform of dei) discussing how the drinks manufacturer is using Tenable OT to manage risks within its business #ExposureManagement http://ow.ly/q0sB106v6f1

22

4 Kommentare

When we discuss EU NIS 2, we often focus on its effects on the 150,000 or so CNI companies that it will likely affect. However, the EU is not just a cybersecurity risk management program for CNI. It sets out regulatory requirements for EU Member states to deliver National cybersecurity strategy, implement a National cyber regulation focused on Corporate governance, Cyber risk management, assurance, and Reporting and regulatory oversight, and assurance of covered entities that include CNI, Banking, Financial Market Infrastructure, Digital Infrastructure, ICT Service management, and, importantly, Public Administration. When you consider the size and scale of the public administration entities, such as central and regional government and administration, it is very easy to double the number of entities affected by EU NIS2 across all 27 EU member states. Hence, organisations such as the Federal Office for Information Security (BSI) are taking the lead. Building out their programs for the cybersecurity of the Federal Government, a significant plank in NIS 2 cybersecurity risk management. Liz Sandwith CFIIA, we must not forget that oversight and assurance of regulatory compliance with EU NIS 2 is a significant undertaking. That requires coordination across the first, second, and third lines. Faisal Khan Ryan Buckner Michael G. Jacobides Georgios A. Parava Security Solutions #eunis2 #cyberriskmanagement #cyberoversight #cyberassurace #cyberaudit

1

After months of planning, Stef Rieders inhouse project at the ForTech Consulting GmbH - the Root Access Podcast - is finally coming to life. To kick things off, we’re teasing you this sunny weekend with a first glimpse of Episode #1 featuring Tobias Deml, Director of Cloud at Oracle The full episode drops on Monday — follow to get notified. #TechLeadership #DigitalTransformation #CloudComputing #TechPodcast #LeadershipMindset #EnterpriseTechnology #InnovationLeadership #Oracle #TechStrategy #BusinessTransformation #RootAccessPodcast

1

Ransomware is no longer just a buzzword in the cybersecurity community — it has become one of the most disruptive and costly threats to businesses worldwide. What once started as opportunistic attacks against individuals has now evolved into highly professionalized, organized crime operations, capable of crippling entire corporations or even endangering lives in critical infrastructure. Germany, as one of Europe’s strongest economies, has become a prime target for such attacks. From global industrial players to local service providers and hospitals, no sector is safe. In recent years, German companies like Pilz GmbH have seen their operations grind to a halt, while hospitals in Düsseldorf experienced tragic consequences from IT systems being taken offline. Even medium-sized businesses — the backbone of the German economy — are increasingly targeted, as ransomware groups know many of them lack the same defenses as global corporations. The growing trend of double extortion (encrypting files and threatening to leak stolen data) has raised the stakes further. Paying a ransom is not just about restoring operations; it’s also about protecting sensitive customer data, intellectual property, and reputation. Yet, as multiple German cases have shown, even companies with advanced technical expertise can fall victim. Ransomware is not an abstract threat — it is a daily reality for companies in Germany. From industrial leaders like Pilz to critical sectors such as hospitals, the message is clear: no one is safe without preparation. Looking at real examples of ransomware attacks on companies such as Pilz, the “Malibu” scenario, and Düsseldorf University Hospital, one thing becomes crystal clear: ransomware is not an abstract IT problem — it is a business-critical threat that can disrupt operations, damage reputations, and even put lives at risk. From industrial automation to healthcare, attackers exploit the same weaknesses: outdated systems, insufficient monitoring, human error, and the absence of structured incident response. The Pilz case showed the importance of backups and business continuity planning. The Malibu scenario highlighted how quickly a single phishing email can escalate into a full-blown crisis. And the Düsseldorf hospital incident proved that ransomware can go beyond financial damage and directly affect human safety. The lesson for businesses is simple yet urgent: preparation is the only effective defense. This means investing in monitoring, employee training, backup strategies, and tested response plans. It also means treating cybersecurity not as a cost center but as a strategic priority that protects long-term business continuity. #cybersecurity #ransomeware https://lnkd.in/gjWvvguW

1

These cybersecurity certifications are highly valued by employers and can help to optimise salaries. Credits: CSO Online, Eric Frank #CyberSecurity #CyberResilience #DataProtection #SwissStartUp #InfoSec #CyberCrime #DigitalTransformation #CyberResilienz #Datenschutz #Cybersécurité #RésilienceCyber #Innovation #Switzerland #CyberSicurezza https://lnkd.in/epVBYKWA

5

New Initiative for ICS and OT Security in Switzerland! Experts from various organizations have launched icssec.ch, a platform dedicated to the practical advancement of ICS and OT Security. The focus lies on topics such as incident handling in OT environments, secure network and segmentation architectures, patch and lifecycle management, system hardening, vulnerability handling, and the development of effective risk and governance structures. Instead of theoretical presentations, the initiative emphasizes hands-on events, real-world case studies, and open knowledge exchange among professionals from operations, engineering, and security. As an external observer, I see this initiative as an important contribution to bringing together expertise from different domains and strengthening the resilience of industrial systems through collaboration. #OTSecurity #ICS #CyberResilience #CriticalInfrastructure #IndustrialSecurity #RiskManagement #OTGovernance #CyberSecurity #OperationalTechnology #Resilience

93

🚨 𝗣𝗹𝗼𝘁 𝗧𝘄𝗶𝘀𝘁: 𝗧𝗵𝗲 𝗚𝘂𝘆 𝗪𝗵𝗼 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝘀 𝗬𝗼𝘂𝗿 𝗗𝗮𝘁𝗮 𝗔𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗦𝗵𝗼𝘄𝗲𝗱 𝗨𝗽 𝘁𝗼 𝗪𝗼𝗿𝗸 🚨 June 25th at the IKT Sicherheitskonferenz in Dornbirn, Dominic Lachat proved that cybersecurity experts don't just live in dark basements eating pizza and typing furiously. This man - who somehow juggles being CEO of GDCIM, President of things with very long German names, and probably knows your WiFi password better than you do - delivered "Digitalisierung & Cybersicherheit - Innovationen für KMU im D-A-CH Raum." The highlights? ✅ Theft detection (because apparently criminals aren't as sneaky as they think) ✅ Sabotage prevention (spoiler: it's not just unplugging the router) ✅ Physical fraud detection (yes, even in our digital world, people still try the old-fashioned stuff) ✅ Coming up next: 3D recognition technology. It seems 2D did not challenge hackers enough. Most people are still learning how to update their passwords, for example, from "password123." Dominic, however, builds a digital fortress that lets SMEs in the #DACH region sleep soundly. We thank those who ensure our digital lives do not become digital nightmares. Johannes GÖLLNER, Chairman of the Board of CRC | Center for Risk- & Crisis Management | Heinz K. S T I A S T N Y | Martin Stieger | Robert-P. Pelikan | Ralf Kimpel     P.S. - If you're reading this and your password is still "password123," Dominic is probably crying somewhere in Switzerland. 😅

3

📘 DORA is more than a regulation - it is a catalyst for change. In our latest article, we explore the key lessons learned from the Digital Operational Resilience journey so far and outline the next steps organizations should take to stay ahead. From governance to third-party risk - DORA is reshaping the financial sector's approach to ICT risk. 👉 Read the article: https://ow.ly/Mmje50WnyMi 🙏 A big thank you to my colleagues for the amazing collaboration Marc Minar Sebastian Pfaffen Nikita A. #DORA #cyber #resilience

11

1 Kommentar