CyberSEG 360° : Cybersecurity put to the real-world test.
AI, SOC, identities, automation and post-quantum: at CyberSEG360° 2026, technologies were above all confronted with the realities of the field.
Artificial intelligence is making its way into tools, development and security operations. Infrastructures are becoming automated. New identities are emerging with AI agents. And, in the longer term, cryptography is already preparing for the post-quantum era.
All of these topics could easily have led to a string of predictions. At CyberSEG360° 2026, held on 24 September in Geneva by Swiss Expert Group, the approach was different: start from real-world use cases, show what already works, test, plan ahead, and also look at the limits.
Over the course of one day, engineers, architects and cybersecurity specialists shared their experience and insights on concrete challenges, whether already encountered in the field or still emerging. A common thread emerged across the sessions: technologies are evolving fast, but many of the answers still rely on well-known fundamentals.
AI finds its place in cybersecurity.
Unsurprisingly, AI was very much in the spotlight. On the offensive side, it can speed up certain reconnaissance and vulnerability research tasks. On the defensive side, it can also help map an attack surface, extract threat intelligence, generate detection rules or speed up certain analyses.
Rather than a shift in which machines would gradually replace analysts, the use cases presented pointed to a more nuanced division of roles.
In a SOC, for example, AI already offers valuable ways to enrich and analyse information, automate certain tasks or handle greater volumes. But the specific context of each environment, the analysis of complex cases and critical containment decisions still require human expertise.
The same holds true for development. Coding assistants make it possible to produce more code, faster. As a result, the challenge is partly shifting from production to verification. The response presented at CyberSEG360° combines isolated environments, dependency control, SAST and SCA, hardened pipelines, SBOMs, artefact signing and human review. AI itself can contribute to pre-review and triage, while leaving the final decision to humans.
What is changing, then, is not necessarily the nature of every security problem. It is also their scale and the speed at which they arise.
When agents enter the information system.
This shift becomes particularly visible with AI agents. As soon as an agent can use tools, query data or call APIs, security questions become very concrete: which identity does it use? Which resources can it access? With what privileges? And how are those rights revoked once they are no longer needed?
Non-human identities existed long before the arrival of AI: service accounts, workloads, tokens and certificates are already part of IAM teams’ day-to-day work. Agents add a new dimension to their governance. The risks discussed at CyberSEG360° are, in fact, familiar ones: persistent secrets, excessive privileges, reused identities and inadequate offboarding.
The offensive demonstrations shed further light on the matter. In an LLM-based application, instructions and data are processed in the same context. A document retrieved through a RAG system may therefore contain unwanted instructions. Among the responses presented: segregating use cases, applying least privilege, controlling access, filtering inputs and outputs, and keeping human validation for high-impact actions.
In other words: new systems, but security principles that remain surprisingly familiar.
Automating without losing visibility.
The same pragmatism carried over to the infrastructure topics.
One demonstration on automation, for instance, started from a very operational use case: managing WAF policies. As environments and changes multiply, manual operations reach their limits, especially when consistency and traceability must be guaranteed.
Software Configuration Management and Configuration as Code then make it possible to version configurations, govern changes, keep a history of them and roll back to a previous state.
Yet the goal presented was not to automate every decision. Repetitive operations can be handled by tools, while operators focus on tasks where their expertise adds the most value: anticipating false positives, adjusting a policy or handling an incident.
The same thinking extended to the Cloud. Reversibility was presented not as the decision to leave a provider, but as the ability to keep one’s options open. And this goes far beyond exporting data: identities, integrations, permissions and, above all, business usage must also be preserved. An approach that encourages thinking first in terms of capabilities – communicating, collaborating, sharing, deciding – before thinking in terms of products.
Preparing for what comes next.
Not all of the transformations discussed at CyberSEG360° are moving at the same pace. Post-quantum cryptography sits on a much longer horizon.
Rather than speculating on when a quantum computer capable of challenging certain current mechanisms might arrive, the approach presented focused on what organisations can already do today: identify their certificates, keys, protocols and cryptographic dependencies, then determine what will need to change.
The proposed roadmap therefore covers governance, inventory, risk prioritisation, certificate and key management, followed by a gradual rollout of new cryptographic mechanisms.
A very concrete way of tackling a long-term challenge: without waiting for “Q-Day”, CIOs and security leaders can start preparing for the transition today.
New technologies, very concrete questions.
By the end of the day, CyberSEG360° had not revealed any single technology set to redefine cybersecurity on its own. The takeaway is more interesting than that.
AI, agents, Cloud, Kubernetes, automation, development or post-quantum: behind the diversity of topics, the same challenges keep coming back. Maintaining visibility over one’s environments, controlling access, knowing what is being automated and why, and keeping human expertise where it remains essential.
This is also what the day’s demos and experience-sharing sessions made clear: beyond trends and technological promises, putting them into practice quickly comes down to very concrete security choices.
To close the day, CyberSEG360° changed register with Raphaël Domjan. The Swiss explorer and pioneer of solar adventure shared his vision of technology and innovation in the face of energy and environmental challenges, offering a different perspective after a day devoted to cybersecurity.
If there were one common thread to take away from this edition, it might be this: the more technologies evolve, the more essential it becomes to understand what they do, to stay in control of one’s environments and to make the right choices.
