When Wednesday 25 November 2026 Registration from 09:00 · Close 16:00
Festive networking drinks to follow
Where The Round Room, The Mansion House Dawson Street, Dublin 2 · Get directions →
Tickets €695 Limited to 350 places

Europe's defining gathering on digital governance

Digital governance has moved to the boardroom. So have we.

One room. One day. 350 of Europe's most senior leaders. The European Digital Governance Summit is where chairs, boards and executive leadership confront the ten digital risks they now personally own — guided by more than ten of Europe's foremost experts and practitioners, and hosted end to end by Paul C. Dwyer.

Tickets on sale now · €695
Buy tickets — €695 See the agenda Download the Executive Guide Limited to 350 places in one room. Once they're gone, they're gone.
Printed edition of The Top 10 Digital Risks Every European Board Must Own

For every delegate

The book behind the summit.

Every delegate on 25 November receives a printed copy of The Top 10 Digital Risks Every European Board Must Own: the ten briefings behind the day's agenda, with the evidence, the legal mandates and the ten questions every director should be asking.

Listen: the Deep Dive podcast

An episode discussing the book. Press play to start before you read a page.

1Day
10Risks
350Leaders
0Sales Pitches

Who's in the room

Leaders from Ireland's biggest institutions, already confirmed.

A cross-section of the boards, banks and organisations already sending leaders to EDGS.

Logos of organisations confirmed to attend the European Digital Governance Summit

Plus delegates already confirmed from

AccentureAEGEAN AirlinesAssetMetrixAviva Insurance IrelandBank of Montreal EuropeBroadcomCCBillCentral Remedial ClinicCoinbaseCoinJarCommission for Regulation of UtilitiesCommissioners of Irish LightsConveraDanske BankDectaDell TechnologiesDiacomDublin BuseirEnvironmental Protection Agency (Ireland)FINEOSFortegraGreenval InsuranceHealth Service Executive (HSE)Hewlett Packard International BankHSBCInnocapInsurance IrelandKerry County CouncilKrakenKyndrylMackenzie InvestmentsMater Misericordiae University HospitalMercedes-BenzMIBIMonzoNasdaqNational Maternity HospitalNational Orthopaedic Hospital CappaghNational Rehabilitation HospitalNAV Fund ServicesNNNordeaNorthern TrustNova Investment ManagementOUTsurancePayac Services CLGPayoneerPhonovationProgressive Credit UnionPTSBQuipu GmbHSEI InvestmentsSemperisSIPTUSodexoSparkasse Bank MaltaSt James's HospitalStryveSumitomo Mitsui Trust BankThe Bar of Ireland / Law LibraryThe Coombe HospitalTitanbayTymans GroupUniquelyWilmington plcWilmington Trust

The seat you'll be sat beside

ChairNon-Executive DirectorChief Executive OfficerChief Risk OfficerChief Information Security OfficerChief Compliance OfficerChief Technology OfficerChief AI OfficerHead of AI GovernanceHead of Digital ResilienceHead of Internal AuditHead of Operational ResilienceData Protection OfficerGeneral CounselBoard Secretary

Industry Partners

Standing alongside EDGS

The concept

Ten risks. Four parts. One host.

This is not an expo. One day, one room, one agenda — no parallel tracks to choose between. The ten defining digital risks are explored in four parts: each opens with a scene-setting keynote from the summit's host expert, Paul C. Dwyer, followed by more than ten leading experts in focused sessions and boardroom panels, chosen for authority, not affiliation. These are board-level briefings, not technical deep-dives: what each risk really is, what regulators now expect, and what a defensible answer looks like. Selected partners are present around the room to engage during the breaks — on your terms — but the stage belongs to education. Nothing is ever pitched from it.

10+ Experts

Chief executives, board members, risk and security leaders and specialist practitioners — in focused expert sessions and two boardroom panels. No panels of pitches.

1 Expert Host

Paul C. Dwyer curates and hosts the day end to end — welcome, four scene-setting keynotes, closing address. One thread, from first word to last.

1 Room

350 leaders, together for the whole day. No breakouts to choose between, no sessions missed. Everyone leaves with the same complete picture.

Paul C. Dwyer, host of the European Digital Governance Summit

Your host

Paul C. Dwyer

Founder & President, ICTTF International Cyber Threat Task Force

For more than 30 years, Paul has advised boards and governments on cyber risk and digital governance. He is the author of Cyber Risk Leadership and The Art of Cyber Risk Oversight, a TEDx speaker, and has been named among Ireland's Top 100 CEOs. Paul opens the summit, delivers the scene-setting keynote for each of the four parts, and closes the day.

Speakers & Panellists

Voices from the boardroom.

The chief executives, board members and risk and security leaders taking the stage on 25 November. More speakers will be announced as the programme is confirmed.

  • Paul C. Dwyer
    Summit Host & Speaker

    Paul C. Dwyer

    President

    ICTTF International Cyber Threat Task Force

    LinkedIn
  • Rob Phillipson
    Risk 03 · 10:30

    Rob Phillipson

    Managing Director

    ICA & CLYI

    LinkedIn
  • Robert O’Brien
    Risk 10 · 10:45

    Robert O’Brien

    Technology Founder

    The Cybersecurity CEO

    LinkedIn
  • Audrey Barrett
    Moderator · 11:50

    Audrey Barrett

    Data Protection Officer

    SIPTU

    Read bio +Close ×
    Audrey Barrett

    Audrey is the Data Protection Officer for SIPTU, Ireland's largest trade union. She serves as Vice Chair of the Association of Data Protection Officers (ADPO) within the Irish Computer Society, Chair of the ICS Fellows Guild, and a member of the Strategic AI Network Executive Committee.

    Audrey is a recognised voice in GDPR, AI governance and digital ethics, with a particular focus on translating regulatory requirements into practical governance frameworks that support both organisational accountability and innovation.

    LinkedIn
  • Kieran Harte
    Panel · 11:50

    Kieran Harte

    Data Protection Officer

    Central Statistics Office (CSO)

    Read bio +Close ×
    Kieran Harte

    Kieran Harte is a career civil servant working in the Data Office of the Central Statistics Office (CSO) on Skehard Road, Cork. He is part of a team that advises and supports the CSO on matters relating to statistical confidentiality and data protection.

    Kieran is a qualified data practitioner with additional qualifications in IT and human resources, and is a member of the Association of Data Protection Officers (ADPO) executive committee, supporting training and certification.

    The CSO collects, compiles, analyses and disseminates statistical information relating to the economic and social life of the country, and co-ordinates official statistics produced by other public authorities.

    LinkedIn
  • Lisa Power
    Panel · 11:50

    Lisa Power

    Global Data Protection Officer

    Carne Group

    Read bio +Close ×
    Lisa Power

    Lisa Power LIB, CDPO, CIPP/E, CIPM, AIGP has been an in-house DPO within the financial services sector for almost 10 years. Her accreditations include Certified Data Protection Officer (CDPO) via UCD and the Institute of Bankers, and both CIPP/E and CIPM via the International Association of Privacy Professionals (IAPP). She has also held the IAPP Artificial Intelligence Governance Professional (AIGP) accreditation since 2025.

    Lisa is an active member of the IAPP, the Compliance Institute and the Institute of Bankers, sits on the Executive Committee of the Association of Data Protection Officers (ADPO) within the Irish Computer Society, and is Vice-Chair of the Strategic AI Network (SAIN).

    LinkedIn
  • Maeve Dunne
    Panel · 11:50

    Maeve Dunne

    Founder & Fractional DPO

    Privacy Path · ComplyVox

    Read bio +Close ×
    Maeve Dunne

    Maeve Dunne is the founder of Privacy Path, a data protection consultancy, and co-founder of ComplyVox, which makes in-house compliance simple. She works as a fractional DPO for public and private sector organisations.

    With a background in sales and marketing in the data space, she brings a business-first lens to GDPR. She is the outgoing Chair of the Association of Data Protection Officers (ADPO).

    LinkedIn
  • Jennifer Walsh
    Panel · 11:50

    Jennifer Walsh

    Information Governance Manager

    HSE National Screening Service

    Read bio +Close ×
    Jennifer Walsh

    Jennifer Walsh is Information Governance Manager with the HSE’s National Screening Service. Her experience spans data protection, governance, risk and compliance, including previous roles with Skillnet Ireland and the Design & Crafts Council Ireland.

    She has advised senior leadership and Audit & Risk Committees, led data governance initiatives and developed practical approaches to privacy and AI governance. Jennifer brings a clear, pragmatic perspective on embedding data protection into everyday decisions, strengthening accountability and supporting responsible innovation.

    LinkedIn
  • Eoin Lacey
    Energiser · 12:55

    Eoin Lacey

    Performance Consultant & Functional Medicine Practitioner

    Eoin Lacey Consultancy

    LinkedIn
  • Ellen Gunning
    Risk 08 · 13:40

    Ellen Gunning

    Corporate Advisor

    Mettacomms

    LinkedIn
  • Neal Mullen
    Risk 04 · 13:55

    Neal Mullen

    Chief Information Security Officer

    HSE Health Service Executive

    LinkedIn
  • Chris Hammans
    Risk 07 · 14:55

    Chris Hammans

    Regional Manager (Northern Europe)

    FireMon

    LinkedIn
  • Gavin Carpenter
    Risk 05 · 15:10

    Gavin Carpenter

    Chief Executive Officer

    Phonovation

    LinkedIn
  • Paul Hearns
    Moderator · 15:25

    Paul Hearns

    Executive Director

    Blockchain Ireland

    Read bio +Close ×
    Paul Hearns

    Paul Hearns provides content strategy and services to the technology sector. Working with multinationals, indigenous companies, and start-ups, he draws on more than 25 years experience as a journalist, author, editor, and presenter.

    LinkedIn
  • David Malone
    Panel · 15:25

    David Malone

    Chief Executive Officer

    Irish League of Credit Unions (ILCU)

    Read bio +Close ×
    David Malone

    David Malone is the Chief Executive Officer of the ILCU. He holds a Master’s degree in Accounting and his primary degree is in Accounting and Finance, both from Dublin City University. He is a fellow of the Institute of Chartered Accountants Ireland.

    Prior to joining the ILCU, David held senior management audit assurance roles in PwC. David was previously ILCU Financial Controller and was appointed CEO in July 2022. Working closely with the Board, David has overseen the implementation of the ILCU’s transformation programme. He passionately believes that the transformed ILCU can support credit unions unlock their full potential to become the primary financial institution of choice.

    LinkedIn
  • Padraic Hamrock
    Panel · 15:25

    Padraic Hamrock

    Non-Executive Director

    Financial Sector

    LinkedIn
  • Jackie Campbell
    Panel · 15:25

    Jackie Campbell

    Chief Risk Officer

    Financial Sector

    Read bio +Close ×
    Jackie Campbell

    Director and governance, risk and compliance professional providing compliance and risk management services to regulated firms. My expertise spans regulatory compliance, data protection, risk management, cyber security and digital operational resilience (DORA and NIS2), backed by Level 9 qualifications from UCD and professional certifications from the Compliance Institute, PRMIA, ICTTF and ICA.

    LinkedIn
  • Pádraigh Griffin
    Panel · 15:25

    Pádraigh Griffin

    Chief Information Security Officer

    eir Business

    LinkedIn
  • Carol Boon
    Panel · 15:25

    Carol Boon

    Digital Transformation & Resilience Manager

    Progressive Credit Union

    Read bio +Close ×
    Carol Boon

    With a 30-year career across the credit union sector, Carol has vast experience at both Board and Senior Management. Carol comes with a wide breadth of knowledge of the credit union, having worked in a number of Credit Unions, most recently Progressive Credit Union. Her role as Digital Transformation and Resilience Manager at Progressive Credit Union has seen her drive and transform their IT agenda over the past number of years.

    In her current role she has responsibility for leading and developing the IT and Digital Transformation function. In tandem with Digital Transformation, Carol is responsible for the implementation and management of DORA Compliance. To support this, she has recently attained the DORA Certified Compliance Specialist qualification. She continues to collaborate with the team in ICTTF and with IT providers in implementing DORA compliance.

    LinkedIn
  • Michael Conway
    Panel · 15:25

    Michael Conway

    Managing Director

    Renaissance

    LinkedIn
  • More speakers to be announced

    Further speakers and panellists will be confirmed over the coming weeks.

The running order

Four parts. One narrative arc.

The day is structured in four themed parts — the new battleground, the extended enterprise, crisis & continuity, and the accountable board. Each opens with a scene-setting keynote from summit host Paul C. Dwyer, followed by expert sessions and panel discussion. All ten risks are covered across the day.

09:00 Registration  ·  09:50 Welcome  ·  15:50 Closing  ·  16:00 Festive networking & drinks

View the full agenda & session details
09:00 – 09:50 Registration, Coffee & NetworkingArrive at the historic Mansion House and settle in over coffee — your first chance to meet fellow board members, executives and risk leaders from across Europe. Please check in at the door on arrival.
09:50 – 10:00 Welcome: 1 Day · 10 Risks · 350 Leaders · 0 Sales Pitches

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Summit host Paul C. Dwyer opens the day and explains how it is built: ten digital governance risks, explored across four parts, each opening with a scene-setting keynote followed by expert speakers and panel discussion. Paul sets out what delegates can expect to leave with, and why the questions raised today are no longer just for the CISO but for every member of the board.

Part 1 — The New Battleground
10:00 – 10:30 AI and Geopolitics: Who Controls the Rules?

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Sets the scene for: AI Adoption & Autonomous Decisions · Geopolitics, the Threat Landscape & the Board Horizon

The battleground has moved from territory to data, and from bombs to algorithms. In this opening session, Paul C. Dwyer explores how AI is accelerating the convergence of geopolitics, cybercrime and regulation, and what that means for every board in the room.

Drawing on real-world cases, Paul examines:

  • AI in the hands of states and criminals. Nation-state capabilities are now available to cybercriminals, driving deepfake fraud, synthetic identities and adaptive malware.
  • The psychological dimension. AI is not only attacking our systems. It is reshaping how we think, decide and trust, with autonomy eroded not by force but by habit.
  • Who controls the rules. The lobbying battle over the EU AI Act, the Digital Omnibus delay, and how the AI Act, DORA and NIS2 now stack together.
  • Agentic AI. The shift from “human in the loop” to “human on the loop”, and why existing guardrails don’t automatically carry over.
  • The next disruption: quantum. Nation states are racing for quantum advantage, and some are believed to be harvesting encrypted data today to decrypt tomorrow. What boards need to know now about the coming shift to post-quantum cryptography.
  • Ireland’s position. Home to Europe’s largest tech and financial operations and holding the EU Presidency, Ireland is both uniquely exposed and uniquely accountable.

The session closes with a clear message for leaders: it is not the most advanced organisations that will win the AI race, but the most trusted.

10:30 – 10:45 AI Adoption & Autonomous Decisions

AI no longer just processes work. It makes and shapes decisions: who gets a loan, which invoice is flagged, which candidate is shortlisted, what a customer is told. When those decisions are wrong, biased or impossible to explain, the liability doesn’t attach to the model. It attaches to the organisation, and to the leadership that let it govern blind.

In this session, Rob Phillipson explores:

  • The governance gap. AI use is now close to universal across European organisations, but inventories of use cases, risk tiers, named accountability and human-oversight rules lag far behind.
  • Shadow AI. Staff adopt tools without approval and feed corporate data into systems the organisation has never assessed.
  • From AI company to AI deployer. Most organisations don’t build AI, but almost all deploy it, and under the EU AI Act deployers carry their own duties, alongside GDPR’s rules on automated decision-making.
  • Keeping humans where it matters. How to decide deliberately where human judgement must stay in the loop, and how to evidence that decision to a regulator.

The boardroom questionCan anyone in this room list where AI is already making or shaping decisions in our name — and show me who is accountable for each one?

Rob Phillipson
Speaker Rob Phillipson Managing Director · ICA & CLYI LinkedIn →
About Rob Phillipson

Rob Phillipson is Managing Director of the International Compliance Association (ICA) and CLYI. Having previously served as ICA's Commercial Development Director, he leads the organisation's work in supporting compliance professionals — and the regulated firms that employ them — as regulation, technology and financial crime risk continue to evolve.

About ICA

The International Compliance Association is the leading professional body for the global regulatory and financial crime compliance community. With 30,000 members in 155 countries and more than 190,000 professionals trained, ICA works to see compliance recognised as a modern profession, benchmarked against international standards of competence.

Its professional qualifications and courses span anti-money laundering, governance, risk and compliance, financial crime prevention, customer due diligence and sanctions. ICA is part of Wilmington plc.

10:45 – 11:00 Geopolitics, the Threat Landscape & the Board Horizon

Geopolitics no longer stops at the firewall. The systems Europe depends on are caught up in strategic competition between powers. Energy, telecoms, transport, health and finance are under persistent state-linked targeting, and organisations with no stake in a conflict can still find themselves in its path.

In this session, Robert O’Brien explores:

  • The threat landscape. How state and state-aligned actors, hacktivists and criminal groups now overlap, and why geopolitical tension has become a primary force shaping cyber strategy.
  • The concentration problem. In a geopolitical crisis, digital monoculture is not just an operational weakness but a strategic one, because everyone’s single point of failure is the same single point of failure.
  • Governing what you can’t control. Boards can’t control geopolitics, but they can govern their exposure to it: knowing which operations, suppliers, data flows and people depend on contested regions, commissioning scenario analysis for plausible escalations, and giving someone explicit responsibility for watching the horizon.

The boardroom questionWhat would a serious geopolitical escalation mean for our operations, our suppliers and our people — and who on this board’s behalf is watching that horizon?

Robert O’Brien
Speaker Robert O’Brien Technology Founder · The Cybersecurity CEO LinkedIn →
About Robert O’Brien

Robert O’Brien, The Cybersecurity CEO, is a technology founder with 30 years’ experience building, scaling and protecting digital businesses. His work focuses on helping CEOs and boards take ownership of cybersecurity with the same discipline they apply to financial governance.

He has founded six companies, including MetaCompliance, which he grew from a personalised security awareness platform into a leading European cybersecurity software company employing more than 300 people before its sale to French private equity in 2025. Working with senior leadership teams across multiple countries has given him direct experience of the gap between those responsible for running a business and those charged with protecting it.

He is co-founder of Safe Harbour Security, which helps mid-market organisations strengthen their cyber resilience through practical advice and access to senior security expertise. He also hosts The Cybersecurity CEO podcast, exploring the leadership decisions and human behaviours that shape organisational security.

Robert is currently writing Better Safe: A CEO’s Guide to Cybersecurity in the Age of AI, drawing on research with CEOs and CISOs to examine how cybersecurity needs to become a boardroom priority. His central argument is that progress requires CEOs to own cyber risk, implement security as a matter of corporate life or death, and make accountability part of everyday business.

About The Cybersecurity CEO

The Cybersecurity CEO is a podcast hosted by Robert O’Brien, exploring the leadership decisions and human behaviours that shape organisational security — and what it takes for CEOs and boards to own cyber risk.

11:00 – 11:20 Coffee & Networking
Part 2 — The Extended Enterprise
11:20 – 11:50 When Ransomware Isn’t Ransomware: Could It Happen Again?

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Covers: Ransomware & Cyber Extortion · Third-Party & Concentration Risk · Cyber Insurance, Risk Transfer & Personal Liability · Data Protection, Privacy & Digital Sovereignty

Almost a decade ago, organisations around the world saw what looked like a ransom note. There was no way to pay to get their data back, because the attack was never designed to give anything back. It was a cyber weapon dressed up as crime, delivered through a routine software update, and it went on to cause billions of dollars in damage. Global shipping, manufacturing and logistics companies with no connection to the intended target were among the victims.

Paul C. Dwyer traces how ransomware evolved from a 1989 floppy-disk scam into a global criminal market of ransomware-as-a-service and double and triple extortion, and how it became a cover for state-sponsored destruction. He then asks the questions that matter most: what have we learnt in the last decade, and could it happen again today? Three issues every board now owns sit at the heart of the answer:

  • Third-party and concentration risk. You can outsource the function, but you cannot outsource the risk. When thousands of organisations rely on the same software, cloud platforms and suppliers, one compromised update can become a global outage. Who is drawing your dependency map?
  • Cyber insurance, risk transfer and personal liability. Insurance transfers some of the cost but none of the accountability. When an attack looks like an act of war, will your policy pay out? And as regulators begin naming individuals, where does the board’s own exposure sit?
  • Data and digital sovereignty. When states are the threat actors, where your data lives, under whose laws, and who can reach it becomes a strategic decision, not a procurement detail.
11:50 – 12:15 Panel: AI Governance and the DPO: Whose Desk Is It On?

AI governance has arrived on the Data Protection Officer’s desk, often without anyone deciding that it should. As organisations adopt AI tools and systems, the DPO is frequently the person expected to assess them, approve them and answer for them. In this panel, five data protection leaders discuss what that means for the role, and for the boards that rely on it:

  • Why AI governance has landed on the DPO’s desk. How responsibility for AI came to rest with the DPO, and whether that happened by design or by default.
  • Where the DPO should be involved, and where they should not. Drawing the line between data protection oversight and AI decisions that belong elsewhere in the organisation.
  • Is AI creating conflicts of interest for DPOs? Whether asking the DPO to lead or approve AI initiatives sits comfortably with the independence GDPR expects of the role.
  • What boards and executives should be doing right now. Giving AI governance a clear owner and the right resources, and making sure the DPO’s voice reaches the right level.

The boardroom questionWho in this organisation owns AI governance, and does our DPO have the independence to challenge it?

Moderator: Audrey Barrett, Data Protection Officer, SIPTU

Panellists: Kieran Harte, Data Protection Officer, Central Statistics Office · Lisa Power, Global Data Protection Officer, Carne Group · Maeve Dunne, Founder, Privacy Path · Jennifer Walsh, Information Governance Manager, HSE National Screening Service

Meet the panellists ↑
12:15 – 12:55 Networking LunchA quick business lunch served at networking pods, designed to keep the conversations of the morning going and help delegates meet as many peers as possible.
12:55 – 13:10 Energiser: Resilience for Leaders

All day we’ve talked about the resilience of systems, suppliers and organisations. But when the crisis comes, resilience depends on the people making the decisions. Leaders who are exhausted, stressed and running on empty make poorer calls at exactly the moment the stakes are highest.

In this high-energy session, performance consultant Eoin Lacey turns the spotlight from the organisation to the individual. He explores how mental health, physical health and a sense of purpose combine to make leaders effective under pressure, and why looking after mind, body and spirit is not a personal luxury but a leadership responsibility.

A short, practical and lively session to recharge the room before the afternoon’s crisis scenario.

Eoin Lacey
Speaker Eoin Lacey Performance Consultant & Functional Medicine Practitioner · Eoin Lacey Consultancy LinkedIn →
Part 3 — Crisis & Continuity
13:10 – 13:40 Boom! You’re Under Attack — Now What?

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Sets the scene for: Incident Response, Crisis Leadership & Disclosure · Operational Resilience & the Continuity Test

In one of the largest cyber heists ever recorded, the criminals didn’t break down the door. They came in through a phishing email, then watched and learned for months, recording staff screens until they understood the banks’ processes better than some of the people running them. Then they struck. They inflated account balances, made ATMs dispense cash on command to waiting money mules, and moved hundreds of millions out of financial institutions around the world.

Paul C. Dwyer uses this real-world case to explore:

  • Crime as an industry. How today’s organised crime groups operate with the structure, patience and return-on-investment thinking of a business.
  • Why the target’s value drives the sophistication. The bigger the prize, the more patient and tailored the attack, and the less your perimeter defences will see it coming.
  • The investigation. How international law-enforcement cooperation eventually brought down the group’s alleged leader, and what that says about the limits of what any one organisation can do alone.
  • Boom, now what? A live boardroom scenario that puts delegates in the decision seat: who leads, what you tell regulators, customers and the market, and how quickly critical services must be back.
13:40 – 13:55 Incident Response, Crisis Leadership & Disclosure

Every organisation will have incidents. What sets them apart afterwards is not whether they were attacked, but how they responded in the first hours: who decided, who spoke, what was disclosed, to whom, and when. Regulators, customers and courts increasingly judge the response as harshly as the breach.

In this session, Ellen Gunning explores leadership and communication when the clock is running:

  • The first hours. The failures that recur at leadership level: unclear decision authority, communications that outrun the facts, and legal and technical teams working from different assumptions.
  • Disclosure under deadline. Reporting under DORA and NIS2 runs in stages measured in hours, so the reporting decision tree has to exist, and be rehearsed, before the incident.
  • Saying the right thing when you don’t yet know. How to communicate with regulators, customers, staff and the media while the facts are still emerging, and who is empowered to speak.
  • The board’s role. Crisis leadership is a board capability, not an IT runbook. A board meeting an incident for the first time in the incident becomes part of the incident.

The boardroom questionWho speaks for us in the first four hours of a serious incident — and when did that person last practise doing it?

Ellen Gunning
Speaker Ellen Gunning Corporate Advisor · Mettacomms LinkedIn →
About Ellen Gunning

Ellen Gunning has spent more than 30 years in public relations and journalism, and crisis communications is her specialty. Her approach to a crisis is direct: respond quickly, tell the truth, accept responsibility where it is yours, and have trained spokespeople ready before you need them.

In 1992 she founded the Irish Academy of Public Relations, which now has graduates in 55 countries, and she is the author of Public Relations – A Practical Approach, a core text for third-level PR students worldwide. A regular media commentator, her awards include European Parliament Journalist of the Year, a Chambers Ireland CSR Award and Tech Entrepreneur of the Year.

About Mettacomms

Founded in 2019, Mettacomms is a communications intelligence platform for communications professionals. It combines human curation with artificial intelligence, machine learning and natural language processing to search worldwide media coverage, parliamentary proceedings, public opinion, economic analysis and university research, giving teams a verified, global view of any topic in minutes and early warning of the trends worth watching.

Mettacomms won the PR Technology award at the Stevie International Awards and has offices in Dublin and Boston.

13:55 – 14:10 Operational Resilience & the Continuity Test

For twenty years, the guiding question was “how do we keep attackers out?” European regulation has changed it to something more honest: when disruption comes, whether attack, outage, failure or error, can you keep operating? That is resilience, and it is a different discipline from security.

In this session, Neal Mullen explores what real resilience looks like when critical services are on the line:

  • Continuity days. How many days of severe disruption can the organisation absorb before the damage becomes strategic? Most boards have never been given that number.
  • Where organisations really fail. Rarely at the point of intrusion, and usually at recovery: backups never restored in anger, failover never exercised at scale, critical processes with no manual workaround.
  • Testing, not planning. Why DORA and NIS2 now require resilience to be tested, not merely documented, and why a test that changes nothing was a performance, not a test.
  • The board in the room. Why the organisations that recover fastest are the ones whose leaders rehearsed their own roles.

The boardroom questionWhen did we last rehearse a severe-but-plausible outage end to end — with this board in the room — and what did we change afterwards?

Neal Mullen
Speaker Neal Mullen Chief Information Security Officer · HSE LinkedIn →
About Neal Mullen

Neal Mullen is Chief Information Security Officer and National Director of Operational Resilience at the Health Service Executive, where he leads the national cyber defence and resilience of Ireland's public health service. He brings more than 25 years' experience in cyber security and resilience across the healthcare, construction, technology and retail sectors.

Before joining the HSE, he spent seven years as Group Deputy Director of ICT Operations at St Vincent's University Hospital, and worked with KPMG as a security and resilience specialist, with earlier roles at Bertelsmann, Dunnes Stores and CRH.

About the HSE

The Health Service Executive (HSE) provides Ireland's public health and social care services, in hospitals and in communities across the country. Established in 2005, it is one of the largest organisations in the State — and one of the clearest examples of why operational resilience is a matter of essential services, not just IT.

14:10 – 14:25 Coffee & Networking
Part 4 — The Accountable Board
14:25 – 14:55 The Rules of the Game Have Changed: From Compliance to Accountability

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Sets the scene for: Regulatory Convergence: DORA, NIS2 & the AI Act · Identity, Access & the Human Perimeter

In less than a decade, digital regulation has moved from guidance to obligation and from the IT department to the boardroom. The regulators have stopped writing to the IT department. They now write to the board.

Paul C. Dwyer traces how compliance has evolved and why the shift now under way is a paradigm change, not just more regulation:

  • From box-ticking to evidence. How compliance moved from policies on a shelf and annual audits to continuous, evidence-based assurance of digital resilience.
  • The convergence. How DORA, NIS2 and the UK’s operational resilience regime now sit alongside GDPR, the EU AI Act and the Cyber Resilience Act, each demanding on its own and together forming a regulatory pincer.
  • Beyond Europe. What the Monetary Authority of Singapore (MAS), Japan’s Financial Services Agency (JFSA) and US regulators are demanding, and why international organisations can no longer comply one jurisdiction at a time.
  • The paradigm shift. From “do you have a policy?” to “prove it works”, and from collective responsibility to named, personal accountability at board level.
14:55 – 15:10 Regulatory Convergence: DORA, NIS2 & the AI Act

Europe hasn’t passed one digital law. It has passed a lattice of them. For many organisations the practical challenge is no longer any single regulation but the overlap: working out which regimes apply, where the duties intersect, and where one piece of evidence can serve several masters.

In this session, Chris Hammans explores how to turn regulatory overlap into a single, coherent response:

  • Mapping the lattice. Which regimes apply to which entities, and why uneven NIS2 transposition across Member States is a compliance risk in itself for multi-country groups.
  • One framework, many regimes. Why one governance framework, evidenced once and reported coherently, beats parallel compliance projects that discover each other too late.
  • Evidence that holds up. What supervisors expect to see, and how continuous visibility of controls replaces point-in-time assurance.
  • Where the board sits. Convergence is a board issue because only the board sits above all the silos the regulations cut across: IT, risk, legal, compliance, operations and HR.

The boardroom questionWhich of these regimes apply to us — mapped, in writing — and where exactly does my personal accountability begin under each?

Chris Hammans
Speaker Chris Hammans Regional Manager, Northern Europe · FireMon LinkedIn →
About Chris Hammans

Chris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments.

His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI).

About FireMon

FireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it.

FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up.

15:10 – 15:25 Identity, Access & the Human Perimeter

The firewall around the building is gone. Work happens across cloud services, personal devices, home networks and third-party platforms. What remains as the perimeter is identity: the credentials, tokens and privileges that decide who can touch what. Most attackers no longer break in. They sign in.

In this session, Gavin Carpenter explores why identity is now where cyber regulation becomes real:

  • The legitimate login. Why most serious breaches now begin with credentials that were phished, bought, stolen or socially engineered, not with sophisticated hacking.
  • AI-powered impersonation. How AI-assisted phishing and voice cloning have removed the tell-tale signs staff were trained to spot, and why awareness alone is no longer enough.
  • What DORA and NIS2 require. NIS2 explicitly mandates access control policies and multi-factor authentication, and DORA puts access-rights management under the management body’s responsibility.
  • Basic hygiene, board ownership. Multi-factor authentication everywhere, privileged access management and joiner-mover-leaver discipline are high-leverage investments regulators now treat as the baseline.

The boardroom questionWho — including our suppliers — holds the keys to everything we depend on, and how quickly would we know if those keys were stolen?

Gavin Carpenter
Speaker Gavin Carpenter Chief Executive Officer · Phonovation LinkedIn →
About Gavin Carpenter

Gavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself.

Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials.

About Phonovation

Founded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant.

Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company.

15:25 – 15:50 Panel: From Obligation to Evidence — What Regulators Now Expect of the Board

The day’s final discussion brings the boardroom view to everything that has gone before. Moderated by Paul Hearns, our panel brings together board members, risk leaders, a CISO and practitioners from financial services and credit unions to discuss what it really means to sit at the table when accountability is personal and the evidence must hold up:

  • What supervisors are now asking boards, and what a credible answer looks like.
  • Turning obligation into evidence: how boards satisfy themselves that controls actually work, not just that policies exist.
  • Training, knowledge and challenge: what “sufficient knowledge to understand ICT risk” means for a non-executive director in practice.
  • Proportionality: how smaller and mid-sized regulated entities, including credit unions, can meet the same expectations with fewer resources.

Moderator: Paul Hearns, Executive Director, Blockchain Ireland

Panellists: David Malone, CEO, Irish League of Credit Unions · Padraic Hamrock, Non-Executive Director, Financial Sector · Jackie Campbell, Chief Risk Officer, Financial Sector · Pádraigh Griffin, Chief Information Security Officer, eir Business · Carol Boon, Digital Transformation & Resilience Manager, Progressive Credit Union · Michael Conway, Managing Director, Renaissance

Meet the panellists ↑
15:50 – 16:00 Closing: From Ten Risks to Ten Capabilities

Keynote · Paul C. Dwyer, Founder & President, ICTTF

Taken together, the ten risks are not a threat catalogue. They are a mirror. Each one reflects a governance capability a board either has or doesn’t: visibility of dependencies and AI, tested rather than assumed resilience, identity discipline, data accountability, a single coherent answer to converging regulation, rehearsed crisis leadership, honest risk transfer and a watched horizon. Paul C. Dwyer closes the summit with the ten boardroom questions every delegate should take to their next board meeting. Risks are managed, capabilities are built, and building them is board work.

16:00 Festive Networking & DrinksContinue the conversation over festive drinks in the Mansion House, decorated for Christmas.

Agenda correct as of publication and subject to change. Session order, timings and speakers may be adjusted as the programme is finalised — the definitive agenda will be issued to registered delegates ahead of the summit.

Buy tickets — €695 350 places in one room. Secure yours today.

Who it's for

The people the regulation now names.

  • Chairs, non-executive directors and board members
  • CEOs and executive leadership of regulated organisations
  • Chief Risk Officers and Chief Information Security Officers
  • Heads of compliance, audit and operational resilience
  • Leaders preparing their organisations for DORA, NIS2 and the EU AI Act

Who’s going to Dublin

Every board has one. The one who’s already booked.

Six short films, six boardrooms in varying states of denial, and in every one somebody gets up and leaves for Dublin. They’re the people you’ll be sitting beside on 25 November: the director who reads the risk report properly, the officer who asks about the lifeboats, the one who says the dashboard is measuring the wrong things. The people who stay behind are the reason the summit exists.

Film 1 · During a 6.3 billion cyber heist

Bynance Board Meeting

Going to DublinMargaret. She read the book, flagged the watermelon metrics 18 months ago, and has the ticket to prove it.

Staying homeThe board whose dashboard stays green while 6.3 billion walks out the door.

Film 2 · The iceberg is on the risk register

Digital Resilience Lessons on the Titanic

Going to DublinThe officer who knows the difference between a risk register and a lifeboat.

Staying homeThe chairman confirming the iceberg is on page 247 and still within risk appetite.

Film 3 · Green on the outside, red on the inside

Watermelon Metrics

Going to DublinThe director who said it out loud: we’re measuring the wrong things.

Staying homeThe chairman whose fix for a red watermelon is to change it to green.

Film 4 · DORA for 40 quid, cash

The Cybersecurity Market

Going to DublinThe buyers who asked about testing, then walked away from the stall.

Staying homeDave. Deluxe bubble wrap for ransomware, incident response by rebranding (extra).

Film 5 · 160 million years of green indicators

Jurassic Lessons in Digital Risk Management

Going to DublinThe one who knows what an existential risk actually looks like.

Staying homeThe chairman who has put the asteroid on next quarter’s agenda.

Film 6 · Tell them Barry sent you

The Digital Resilience Office Leader

Going to DublinThe colleague who wanted a second opinion on offering the ransomware gang a grand, cash.

Staying homeBarry. Hacked three times, outsourced the lot to Dave, and got a kettle thrown in.

Recognise someone who’s staying home? You know who needs a ticket.

Why now

Accountability has been reassigned — upwards.

A new generation of European regulation places responsibility for digital risk squarely with leadership.

The question in the boardroom is no longer “are we secure?” It is “can I evidence that we are resilient?”

DORA

Operational resilience is now a regulatory obligation for financial entities — with the management body expected to direct, approve and oversee it.

NIS2

Cybersecurity duties now extend across essential and important sectors, with accountability attaching to management — not just to the IT function.

EU AI Act

As organisations adopt AI, boards are expected to govern its use with the same rigour they apply to any other material risk.

The ten risks

Ten risks. One day. No noise.

The summit is built around The Top 10 Digital Risks Every European Board Must Own — the ten risks that now define board accountability across Europe. They are not ten separate talks: the risks are woven through the day's four parts and covered in three ways — practical, evidence-based and free of vendor pitches.

Keynotes 4 × 30 minutes

Paul C. Dwyer opens each part with a scene-setting keynote that frames two to four of the risks and sets up the experts who follow.

Expert briefings 15 minutes each

A leading practitioner takes one risk and gives the boardroom view: what it is, what regulators expect, and what a defensible answer looks like.

Boardroom panels 2 × 25 minutes

Board members, risk leaders and practitioners debate where the risks meet in practice, and what supervisors now expect of the board.

Below, each risk shows where it is covered on the day. Open a risk for the briefing, the boardroom question and the session details.

01Ransomware & Cyber ExtortionKeynote · Part 2Paul C. Dwyer

Ransomware is no longer a virus problem. It is an extortion business — organised, industrialised and profitable — whose product is your worst trading day. Modern operators rarely stop at encrypting systems: they steal data first, threaten publication, and price their demand against what they estimate an outage costs you per day.

They don't price the ransom against your data. They price it against your downtime.

The boardroom questionIf ransomware took our core systems down this morning, how many days could we trade — and who has independently verified that answer?

On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

02Third-Party & Concentration RiskKeynote · Part 2Paul C. Dwyer

Every organisation has outsourced pieces of itself — cloud, payments, payroll, security, software. Each contract made sense on its own. Taken together, they have quietly relocated your operational risk into companies you do not control, cannot inspect at will, and often share with every competitor you have.

You can outsource the function. You cannot outsource the risk.

The boardroom questionWhere are we exposed to the same critical providers as everyone else in our sector — and what, precisely, happens to us on the day one of them fails?

On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

03AI Adoption & Autonomous DecisionsExpert briefing · Part 1Rob Phillipson · ICA

AI is entering your organisation faster than your governance of it. Decisions once made by accountable people are increasingly made, shaped or accelerated by systems — often adopted team by team, without anyone approving the sum of it at the top.

You can delegate the decision to a machine. You cannot delegate the accountability.

The boardroom questionCan anyone in this room list where AI is already making or shaping decisions in our name — and show me who is accountable for each one?

On 25 November · 10:30 – 10:45 · Leading this session

Rob Phillipson
Speaker Rob Phillipson Managing Director · ICA & CLYI LinkedIn →
About Rob Phillipson

Rob Phillipson is Managing Director of the International Compliance Association (ICA) and CLYI. Having previously served as ICA's Commercial Development Director, he leads the organisation's work in supporting compliance professionals — and the regulated firms that employ them — as regulation, technology and financial crime risk continue to evolve.

About ICA

The International Compliance Association is the leading professional body for the global regulatory and financial crime compliance community. With 30,000 members in 155 countries and more than 190,000 professionals trained, ICA works to see compliance recognised as a modern profession, benchmarked against international standards of competence.

Its professional qualifications and courses span anti-money laundering, governance, risk and compliance, financial crime prevention, customer due diligence and sanctions. ICA is part of Wilmington plc.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

04Operational Resilience & the Continuity TestExpert briefing · Part 3Neal Mullen · HSE

Every organisation has a continuity plan. Far fewer have evidence that it works. Resilience is not the existence of a document — it is the demonstrated ability to keep your most important services running through disruption, within tolerances the board has set.

Continuity you haven't tested is continuity you don't have.

The boardroom questionWhen did we last rehearse a severe-but-plausible outage end to end — with this board in the room — and what did we change afterwards?

On 25 November · 13:55 – 14:10 · Leading this session

Neal Mullen
Speaker Neal Mullen Chief Information Security Officer · HSE LinkedIn →
About Neal Mullen

Neal Mullen is Chief Information Security Officer and National Director of Operational Resilience at the Health Service Executive, where he leads the national cyber defence and resilience of Ireland's public health service. He brings more than 25 years' experience in cyber security and resilience across the healthcare, construction, technology and retail sectors.

Before joining the HSE, he spent seven years as Group Deputy Director of ICT Operations at St Vincent's University Hospital, and worked with KPMG as a security and resilience specialist, with earlier roles at Bertelsmann, Dunnes Stores and CRH.

About the HSE

The Health Service Executive (HSE) provides Ireland's public health and social care services, in hospitals and in communities across the country. Established in 2005, it is one of the largest organisations in the State — and one of the clearest examples of why operational resilience is a matter of essential services, not just IT.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

05Identity, Access & the Human PerimeterExpert briefing · Part 4Gavin Carpenter · Phonovation

Digital identity no longer stops at usernames, passwords and access controls. Organisations must also be able to trust the communications through which identities are verified, transactions are confirmed, customers are contacted and critical instructions are delivered.

The human perimeter is increasingly targeted through impersonation, phishing, smishing, spoofed messages, compromised credentials and AI-enabled social engineering — any voice, video call, email or text that can convincingly pass for someone you trust. Secure communications, trusted messaging channels, strong authentication and resilient identity processes are therefore becoming central to digital governance.

Boards must understand how their organisations protect not only access to systems, but also the integrity of the communications used to establish trust with employees, customers, suppliers and other stakeholders.

Attackers don't break in anymore. They log in.

The boardroom questionWho — including our suppliers — holds the keys to everything we depend on, and how quickly would we know if those keys were stolen?

On 25 November · 15:10 – 15:25 · Leading this session

Gavin Carpenter
Speaker Gavin Carpenter Chief Executive Officer · Phonovation LinkedIn →
About Gavin Carpenter

Gavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself.

Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials.

About Phonovation

Founded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant.

Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

06Data Protection, Privacy & Digital SovereigntyKeynote + panel · Part 2Paul C. Dwyer · AI Governance & the DPO panel

Data is the one asset you can lose while still possessing it. Where your data lives, under whose laws, who can access it and who can compel access to it — these are now questions of sovereignty and strategy, not storage.

Data is the only asset you can lose and still hold.

The boardroom questionIf our largest data store were exposed tomorrow, could we state precisely what was in it, who it belonged to, and which laws attach to it?

On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, then the panel “AI Governance and the DPO: Whose Desk Is It On?” (11:50 – 12:15)

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

07Regulatory Convergence: DORA, NIS2 & the AI ActExpert briefing + panel · Part 4Chris Hammans · FireMon

Europe's digital regulations were written separately, but they converge on a single expectation: that the management body directs, oversees and evidences the organisation's digital risk. Treating them as three compliance projects misses the point — together they define one governance discipline.

That evidence increasingly lives in the controls themselves, not in policy documents. The firewall rules, network segmentation and cloud security policies that decide who and what can reach critical systems now number in the thousands in most large organisations, and they change every day across on-premises, cloud and third-party networks. Rules accumulate, exceptions outlive their purpose, and the gap widens between the risk appetite the board approved and the controls actually being enforced.

A point-in-time audit shows what was true on the day of the audit. Converged regulation expects more: continuous visibility of the whole network estate, controlled and recorded change, and audit-ready evidence on demand. Boards that can show their security policy matches their stated obligations, every day rather than once a year, are the ones answering regulators with evidence instead of assurances.

Regulators no longer ask what your IT department did. They ask what your board decided.

The boardroom questionWhich of these regimes apply to us — mapped, in writing — and where exactly does my personal accountability begin under each?

On 25 November · 14:55 – 15:10 · Leading this session

Chris Hammans
Speaker Chris Hammans Regional Manager, Northern Europe · FireMon LinkedIn →
About Chris Hammans

Chris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments.

His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI).

About FireMon

FireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it.

FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

08Incident Response, Crisis Leadership & DisclosureExpert briefing · Part 3Ellen Gunning · Mettacomms

The incident tests your systems. The hours that follow test your board. European notification regimes start the clock almost immediately — which means who leads, who speaks, who notifies and in what order must be decided, and rehearsed, long before the worst day arrives.

A crisis reveals the decisions you didn't make in peacetime.

The boardroom questionWho speaks for us in the first four hours of a serious incident — and when did that person last practise doing it?

On 25 November · 13:40 – 13:55 · Leading this session

Ellen Gunning
Speaker Ellen Gunning Corporate Advisor · Mettacomms LinkedIn →
About Ellen Gunning

Ellen Gunning has spent more than 30 years in public relations and journalism, and crisis communications is her specialty. Her approach to a crisis is direct: respond quickly, tell the truth, accept responsibility where it is yours, and have trained spokespeople ready before you need them.

In 1992 she founded the Irish Academy of Public Relations, which now has graduates in 55 countries, and she is the author of Public Relations – A Practical Approach, a core text for third-level PR students worldwide. A regular media commentator, her awards include European Parliament Journalist of the Year, a Chambers Ireland CSR Award and Tech Entrepreneur of the Year.

About Mettacomms

Founded in 2019, Mettacomms is a communications intelligence platform for communications professionals. It combines human curation with artificial intelligence, machine learning and natural language processing to search worldwide media coverage, parliamentary proceedings, public opinion, economic analysis and university research, giving teams a verified, global view of any topic in minutes and early warning of the trends worth watching.

Mettacomms won the PR Technology award at the Stevie International Awards and has offices in Dublin and Boston.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

09Cyber Insurance, Risk Transfer & Personal LiabilityKeynote · Part 2Paul C. Dwyer

Insurance has a role in digital risk — but a narrower one than many boards assume. Policies pay some costs, under conditions, with exclusions. What they do not transfer is accountability: regulatory duties, disclosure obligations and, increasingly, personal exposure for those who govern.

Insurance transfers cost. It does not transfer accountability.

The boardroom questionHave we read our cyber policy’s exclusions as carefully as the underwriter will after a claim — and do we know which of our risks no policy covers?

On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

10Geopolitics, the Threat Landscape & the Board HorizonExpert briefing · Part 1Robert O’Brien · The Cybersecurity CEO

Your threat landscape is now shaped in capitals as much as in code. Conflict, sanctions, supply-chain realignment and state-aligned cyber activity reach directly into European organisations — which makes horizon scanning a governance duty, not a luxury.

Geopolitics no longer stops at the firewall.

The boardroom questionWhat would a serious geopolitical escalation mean for our operations, our suppliers and our people — and who on this board’s behalf is watching that horizon?

On 25 November · 10:45 – 11:00 · Leading this session

Robert O’Brien
Speaker Robert O’Brien Technology Founder · The Cybersecurity CEO LinkedIn →
About Robert O’Brien

Robert O’Brien, The Cybersecurity CEO, is a technology founder with 30 years’ experience building, scaling and protecting digital businesses. His work focuses on helping CEOs and boards take ownership of cybersecurity with the same discipline they apply to financial governance.

He has founded six companies, including MetaCompliance, which he grew from a personalised security awareness platform into a leading European cybersecurity software company employing more than 300 people before its sale to French private equity in 2025. Working with senior leadership teams across multiple countries has given him direct experience of the gap between those responsible for running a business and those charged with protecting it.

He is co-founder of Safe Harbour Security, which helps mid-market organisations strengthen their cyber resilience through practical advice and access to senior security expertise. He also hosts The Cybersecurity CEO podcast, exploring the leadership decisions and human behaviours that shape organisational security.

Robert is currently writing Better Safe: A CEO’s Guide to Cybersecurity in the Age of AI, drawing on research with CEOs and CISOs to examine how cybersecurity needs to become a boardroom priority. His central argument is that progress requires CEOs to own cyber risk, implement security as a matter of corporate life or death, and make accountability part of everyday business.

About The Cybersecurity CEO

The Cybersecurity CEO is a podcast hosted by Robert O’Brien, exploring the leadership decisions and human behaviours that shape organisational security — and what it takes for CEOs and boards to own cyber risk.

The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →

The Executive Guide — The Top 10 Digital Risks Every European Board Must Own

The complete briefing

Every risk. One document.

Download the Executive Guide — The Top 10 Digital Risks Every European Board Must Own — all ten briefings in a single board-ready document: the evidence, the legal mandates, and the ten questions every director should be asking.

Download the Executive Guide

Enter your details and your copy will be emailed to you.

Watch before you come

Six short films. One full briefing.

The Executive Awareness Series — six short films made for the people the regulation now names — plus the full one-hour webinar in which Paul C. Dwyer walks through all ten risks. Pick any one to start, then bring the questions it raises to the Round Room on 25 November.

Video 1 of 6 Digital Governance — Elephant in the Room

Every video raises a question. On 25 November, the room answers it.

Buy tickets — €695

We've been here before

Ten years ago, we filled this room.

In 2016, ICTTF brought the Cyber Threat Summit to the Round Room at the Mansion House. This short film shows what that day looked like.

Ten years on, we're returning to the same room. The threats have grown, and accountability for them has moved to the boardroom — so this time, so has the agenda.

ICTTF has brought Europe's security, risk and governance leaders together for more than a decade. EDGS is that community at its most senior — and the people in the photographs below are the people you'll be sat beside.

A full room of senior leaders at a previous ICTTF event
The Room
Keynote speaker on stage at a previous ICTTF event
The Stage
Leaders networking between sessions at a previous ICTTF event
The Network
Delegates in conversation during a break at an ICTTF event
The Break
A delegate putting a question to the stage at an ICTTF event
The Question
Paul C. Dwyer in conversation with a delegate at an ICTTF event
The Conversation

A decade of ICTTF events — browse the full gallery on Flickr →

The venue

The Round Room, The Mansion House, Dublin.

Inside the Round Room at the Mansion House, Dublin — venue of the European Digital Governance Summit

The Round Room · The Mansion House · Dawson Street, Dublin 2 · Directions

Festive networking for teams

Close the year as a team — in the room that sets next year's agenda.

The Mansion House will be dressed for Christmas on 25 November. Bring your security, risk or compliance team for the day's briefing, sit together at a reserved team table, and stay on as the day closes for festive networking drinks in one of Dublin's most historic rooms.

  • Reserved tables for teams of eight to ten
  • Four keynotes, 10+ experts and two panels — one shared picture for the whole team
  • Festive drinks and networking as the summit closes
  • A year-end team day that stands up as development, not just a night out
Buy team tickets — €695 each Want a named table reserved for your team? Tell us your team size and we'll take care of it.
CDGP — Certified Digital Governance Professional seal, EU Cyber Academy

For VIP delegates: every VIP place includes the pathway to the Certified Digital Governance Professional (CDGP) credential, delivered through the EU Cyber Academy — so the day doesn't end when the room empties. The CDGP course commences on 4 January 2027.

Good to know

Frequently asked questions

What’s the difference between a standard ticket and a VIP pass?

Both give you the full summit day: every keynote, expert briefing and panel, the networking lunch, and the festive networking drinks.

The main difference is that a VIP pass also includes complimentary access to the Certified Digital Governance Professional (CDGP) certification course, delivered through the EU Cyber Academy. The course commences on 4 January 2027, and VIP delegates then have 90 days to work through the material and complete the certification exam.

VIP passes are allocated by invitation only. If you're attending on a standard ticket and would like to take the CDGP, the course will also open for wider enrolment in December 2026.

Will there be name badges?

No, and that's by design. EDGS is a gathering of peers, not a trade show, so we've chosen not to print badges, lanyards or plastic holders that end up in the bin by the end of the day.

Every delegate is on our registered guest list. Simply give your name to our team at the door and you'll be welcomed straight in. Introductions happen the way they should at a boardroom-level event: in person.

When does the CDGP course start?

The Certified Digital Governance Professional (CDGP) course, delivered through the EU Cyber Academy, commences on 4 January 2027. It is included with every VIP place.

From the start date, VIP delegates have 90 days to work through the course material and complete the certification exam.

Will the event be photographed or filmed?

Yes. EDGS will be photographed, filmed and audio-recorded, and this material may be used for event coverage, promotion and education. By attending, you acknowledge that you may appear in photographs, video or audio recordings.

If you have any concerns, please contact events@icttf.org before the event or speak to a member of our team on the day.

Is the agenda final?

The agenda is correct at the time of publication, but session times, order and speakers may change as the programme is finalised. The definitive running order will be issued to registered delegates ahead of the summit. See the current agenda ↑

Another question? Email events@icttf.org and we'll come back to you.

Tickets on sale now · €695

Be in the room.

350 places. Ten risks. One day that sets the agenda for the year ahead. Secure your seat beside the chairs, CEOs and CISOs the regulation now names — before the room fills.

Buy tickets — €695

Looking to partner rather than attend? Partner with EDGS ↓

For partners

350 leaders. One room. Nowhere to hide in a crowd.

EDGS was built to be different from every governance event you've been asked to sponsor. There is no expo hall, no shared logo wall, and no stage time sold to the highest bidder. Instead, a select group of partners stands alongside our expert faculty, in front of 350 of Europe's most senior digital governance leaders.

350Leaders
1Room
10Risks
0Logo Walls
The Right Audience

Chairs, CEOs, CROs and CISOs — the people DORA, NIS2 and the EU AI Act now name, who hold the budget and the mandate — together in one room for the whole day.

Reach Beyond the Day

Recognition across the ICTTF community — 50,000+ members strong — and introductions to delegates for follow-up after the event, in line with GDPR.

A Room Built to Talk

Partners have a branded presence on the delegate floor and a dedicated stand at the room's perimeter — built for the real conversations that happen in the breaks — plus complimentary delegate passes for client and prospect hosting.

A partner in conversation with delegates at their stand during a break at an ICTTF event
The Stand
A partner speaker delivering a session at an ICTTF event
The Session

Partnerships are being confirmed now. Places on the delegate floor are limited by the room, and are allocated on a first-come basis.

Looking for a different kind of presence at the summit? We're open to discussing a bespoke partnership — tell us your goals and we'll talk it through.

Partner with EDGS

Stand alongside the summit.

Tell us about your organisation and what you'd like to achieve, and we'll send the partner prospectus, investment and terms straight over, and set up a call with our events team.

Request the partner prospectus

Tell us about your organisation and what you'd like to achieve — we'll come back to you within one working day.

Prefer to talk first? events@icttf.org

Hosted by the ICTTF International Cyber Threat Task Force  ·  digitalgovernance.eu  ·  Buy tickets — €695