Festive networking drinks to follow
Europe's defining gathering on digital governance
Digital governance has moved to the boardroom. So have we.
One room. One day. 350 of Europe's most senior leaders. The European Digital Governance Summit is where chairs, boards and executive leadership confront the ten digital risks they now personally own — guided by ten of Europe's foremost experts, one for each risk, and hosted end to end by Paul C. Dwyer.
Who's in the room
Leaders from Ireland's biggest institutions, already confirmed.
A cross-section of the boards, banks and organisations already sending leaders to EDGS.
Plus delegates already confirmed from
The seat you'll be sat beside
Industry Partners
Standing alongside EDGS
We've been here before
Ten years ago, we filled this room.
In 2016, ICTTF brought the Cyber Threat Summit to the Round Room at the Mansion House. This short film shows what that day looked like.
Ten years on, we're returning to the same room. The threats have grown, and accountability for them has moved to the boardroom — so this time, so has the agenda.
The concept
Ten risks. Ten experts. One host.
This is not an expo. The day is built around ten defining digital risks — and for each one, a dedicated leading expert takes the stage, chosen for authority, not affiliation. Ten experts, ten focused sessions, each delivering the boardroom view: what the risk really is, what regulators now expect, and what a defensible answer looks like. Threading it all together is the summit's overall host expert, Paul C. Dwyer. Selected partners are present around the room to engage during the breaks — but the stage belongs to education. Nothing is ever pitched from it.
One dedicated expert per risk — ten authoritative voices, each with one focused session and the floor to deliver it. No panels of pitches.
Paul C. Dwyer curates and hosts the day end to end — opening keynote, every conversation, closing address. One thread, from first word to last.
350 leaders, together for the whole day. No breakouts to choose between, no sessions missed. Everyone leaves with the same complete picture.
Ten years of rooms like this
The conversations happen between the sessions.
ICTTF has brought Europe's security, risk and governance leaders together for more than a decade. EDGS is that community at its most senior — and the people in the photographs are the people you'll be sat beside.
A decade of ICTTF events — browse the full gallery on Flickr →
Why now
Accountability has been reassigned — upwards.
A new generation of European regulation places responsibility for digital risk squarely with leadership. The question in the boardroom is no longer "are we secure?" — it is "can I evidence that we are resilient?"
DORA
Operational resilience is now a regulatory obligation for financial entities — with the management body expected to direct, approve and oversee it.
NIS2
Cybersecurity duties now extend across essential and important sectors, with accountability attaching to management — not just to the IT function.
EU AI Act
As organisations adopt AI, boards are expected to govern its use with the same rigour they apply to any other material risk.
Watch the briefing
The ten risks, in one hour.
Before the summit, see the thinking behind it. In this recorded webinar, Paul C. Dwyer walks through The Top 10 Digital Risks Every EU Board Should Own — what each one is, why it now sits with the board, and the question every director should be asking about it.
On 25 November, each of these risks gets its own expert and its own session.
Buy tickets — €495 early birdBuy tickets — €695The Executive Awareness Series
Six videos. Six conversations your board should be having.
A series of briefings made for the people the regulation now names. Pick any video to start — then bring the questions it raises to the Round Room on 25 November.
Every video raises a question. On 25 November, the room answers it.
Buy tickets — €495 early birdBuy tickets — €695The agenda
Ten risks. One day. No noise.
The summit is built around The Top 10 Digital Risks Every European Board Must Own — the ten risks that now define board accountability across Europe. Each is addressed in a single, focused, expert-led session: practical, evidence-based and free of vendor pitches.
01Ransomware & Cyber Extortion
Ransomware is no longer a virus problem. It is an extortion business — organised, industrialised and profitable — whose product is your worst trading day. Modern operators rarely stop at encrypting systems: they steal data first, threaten publication, and price their demand against what they estimate an outage costs you per day.
They don't price the ransom against your data. They price it against your downtime.
The boardroom questionIf ransomware took our core systems down this morning, how many days could we trade — and who has independently verified that answer?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
02Third-Party & Concentration Risk
Every organisation has outsourced pieces of itself — cloud, payments, payroll, security, software. Each contract made sense on its own. Taken together, they have quietly relocated your operational risk into companies you do not control, cannot inspect at will, and often share with every competitor you have.
You can outsource the function. You cannot outsource the risk.
The boardroom questionWhich single provider, if it failed today, would take us down with it — and when did this board last see that map?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
03AI Adoption & Autonomous Decisions
AI is entering your organisation faster than your governance of it. Decisions once made by accountable people are increasingly made, shaped or accelerated by systems — often adopted team by team, without anyone approving the sum of it at the top.
You can delegate the decision to a machine. You cannot delegate the accountability.
The boardroom questionWhere is AI already making decisions in our name — and who approved that?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
04Operational Resilience & the Continuity Test
Every organisation has a continuity plan. Far fewer have evidence that it works. Resilience is not the existence of a document — it is the demonstrated ability to keep your most important services running through disruption, within tolerances the board has set.
Continuity you haven't tested is continuity you don't have.
The boardroom questionWhen did we last test our most important business service to the point of failure — and what did we change afterwards?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
05Identity, Access & the Human Perimeter
Gavin Carpenter · Phonovation
Digital identity no longer stops at usernames, passwords and access controls. Organisations must also be able to trust the communications through which identities are verified, transactions are confirmed, customers are contacted and critical instructions are delivered.
The human perimeter is increasingly targeted through impersonation, phishing, smishing, spoofed messages, compromised credentials and AI-enabled social engineering — any voice, video call, email or text that can convincingly pass for someone you trust. Secure communications, trusted messaging channels, strong authentication and resilient identity processes are therefore becoming central to digital governance.
Boards must understand how their organisations protect not only access to systems, but also the integrity of the communications used to establish trust with employees, customers, suppliers and other stakeholders.
Attackers don't break in anymore. They log in.
The boardroom questionIf a convincing call, message or email asked us to move money or change a customer's details today, what — exactly — stands between that request and the action?
On 25 November · 10:55 – 11:15 · Leading this session
About Gavin Carpenter
Gavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself.
Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials.
About Phonovation
Founded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant.
Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
06Data Protection, Privacy & Digital Sovereignty
Data is the one asset you can lose while still possessing it. Where your data lives, under whose laws, who can access it and who can compel access to it — these are now questions of sovereignty and strategy, not storage.
Data is the only asset you can lose and still hold.
The boardroom questionDo we know where our critical data resides, under which jurisdictions — and who could compel access to it tomorrow?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
07Regulatory Convergence: DORA, NIS2 & the AI Act
Chris Hammans · FireMon
Europe's digital regulations were written separately, but they converge on a single expectation: that the management body directs, oversees and evidences the organisation's digital risk. Treating them as three compliance projects misses the point — together they define one governance discipline.
That evidence increasingly lives in the controls themselves, not in policy documents. The firewall rules, network segmentation and cloud security policies that decide who and what can reach critical systems now number in the thousands in most large organisations, and they change every day across on-premises, cloud and third-party networks. Rules accumulate, exceptions outlive their purpose, and the gap widens between the risk appetite the board approved and the controls actually being enforced.
A point-in-time audit shows what was true on the day of the audit. Converged regulation expects more: continuous visibility of the whole network estate, controlled and recorded change, and audit-ready evidence on demand. Boards that can show their security policy matches their stated obligations, every day rather than once a year, are the ones answering regulators with evidence instead of assurances.
Regulators no longer ask what your IT department did. They ask what your board decided.
The boardroom questionIf a regulator asked us today to prove that the security controls running across our networks and cloud match the policies this board approved, could we produce that evidence — and how long would it take?
On 25 November · 14:55 – 15:15 · Leading this session
About Chris Hammans
Chris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments.
His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI).
About FireMon
FireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it.
FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
08Incident Response, Crisis Leadership & Disclosure
The incident tests your systems. The hours that follow test your board. European notification regimes start the clock almost immediately — which means who leads, who speaks, who notifies and in what order must be decided, and rehearsed, long before the worst day arrives.
A crisis reveals the decisions you didn't make in peacetime.
The boardroom questionIf the incident began right now — who leads, who speaks, who notifies — and have we ever rehearsed it together?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
09Cyber Insurance, Risk Transfer & Personal Liability
Insurance has a role in digital risk — but a narrower one than many boards assume. Policies pay some costs, under conditions, with exclusions. What they do not transfer is accountability: regulatory duties, disclosure obligations and, increasingly, personal exposure for those who govern.
Insurance transfers cost. It does not transfer accountability.
The boardroom questionDo we know what our policy actually excludes — and what exposure remains, for the organisation and for us, after it pays?
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
10Geopolitics, the Threat Landscape & the Board Horizon
Robert O’Brien · The Cybersecurity CEO
Your threat landscape is now shaped in capitals as much as in code. Conflict, sanctions, supply-chain realignment and state-aligned cyber activity reach directly into European organisations — which makes horizon scanning a governance duty, not a luxury.
Geopolitics no longer stops at the firewall.
The boardroom questionWhich geopolitical scenario would hurt us most — and does it appear anywhere on our risk register?
On 25 November · 10:35 – 10:55 · Leading this session
About Robert O’Brien
Robert O’Brien is a serial technology entrepreneur with more than three decades in the IT industry. He began his career at organisations including Capita and Intergraph, co-founded AMT Sybex and was running its Irish operations by the age of 26. He later led a management buyout of Intergraph’s Irish business, which became Intertech and was sold to Maxima PLC in 2006.
Robert went on to found MetaCompliance, a company focused on the people side of cybersecurity and privacy compliance — helping organisations keep staff safe online, protect their digital assets and safeguard their reputation. Having helped build and exit several technology businesses, he has been a finalist for the EY Entrepreneur of the Year award. He now hosts The Cybersecurity CEO podcast.
About The Cybersecurity CEO
The Cybersecurity CEO is a podcast hosted by Robert O’Brien, featuring conversations with security leaders and executives about cyber risk as a business and leadership issue — drawing on Robert’s experience of building, running and selling technology companies.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
The complete briefing
Every risk. One document.
Download the Executive Guide — The Top 10 Digital Risks Every European Board Must Own — all ten briefings in a single board-ready document: the evidence, the legal mandates, and the ten questions every director should be asking.
Download the Executive Guide
Enter your details and your copy will be emailed to you.
Speakers & Panellists
Voices from the boardroom.
The chief executives, board members and risk and security leaders taking the stage on 25 November. More speakers will be announced as the programme is confirmed.
-
-
-
-
-
-
-
-
-
Panellist · Session TBCRhonda Reihill
Chief Operating Officer
Cyber Risk International (CRI)
LinkedIn -
-
Panellist · Session TBCCarol Boon
Digital Transformation & Operational Resilience Manager
Progressive Credit Union
LinkedIn -
-
-
-
More speakers to be announced
Further speakers and panellists will be confirmed over the coming weeks.
The running order
Three blocks. One narrative arc.
The day is structured in three themed blocks — the threat you face, the dependencies you've created, and the response you owe — each building on the last.
View the full agenda
| 09:00 – 10:00 | Registration, Coffee & Networking |
| 10:00 – 10:15 | Opening Address: Digital Governance Has Moved to the Boardroom |
| Block 1 — The Threat You Face | |
| 10:15 – 10:35 | Ransomware & Cyber Extortion |
| 10:35 – 10:55 |
Geopolitics, the Threat Landscape & the Board Horizon
About Robert O’BrienRobert O’Brien is a serial technology entrepreneur with more than three decades in the IT industry. He began his career at organisations including Capita and Intergraph, co-founded AMT Sybex and was running its Irish operations by the age of 26. He later led a management buyout of Intergraph’s Irish business, which became Intertech and was sold to Maxima PLC in 2006. Robert went on to found MetaCompliance, a company focused on the people side of cybersecurity and privacy compliance — helping organisations keep staff safe online, protect their digital assets and safeguard their reputation. Having helped build and exit several technology businesses, he has been a finalist for the EY Entrepreneur of the Year award. He now hosts The Cybersecurity CEO podcast. About The Cybersecurity CEOThe Cybersecurity CEO is a podcast hosted by Robert O’Brien, featuring conversations with security leaders and executives about cyber risk as a business and leadership issue — drawing on Robert’s experience of building, running and selling technology companies. |
| 10:55 – 11:15 |
Identity, Access & the Human Perimeter
About Gavin CarpenterGavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself. Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials. About PhonovationFounded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant. Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company. |
| 11:15 – 11:40 |
Panel 1: From Obligation to Evidence — What Regulators Now Expect of the Board
Digital operational resilience is no longer a matter for IT alone. Under DORA and NIS2, accountability sits with the management body, and the question facing boards is shifting from "do we have the policies?" to "can we demonstrate oversight?" This panel brings together three perspectives: chief executive, non-executive director and chief risk officer. They discuss what credible evidence of governance looks like in practice, how boards should challenge management on ICT and third-party risk, where accountability gaps open up between executive and board, and what a good answer looks like when the supervisor asks the board to show its work. Panellists: David Malone, CEO, Irish League of Credit Unions · Padraic Hamrock, Non-Executive Director, Financial Sector · Jackie Campbell, Chief Risk Officer, Financial Sector Meet the panellists ↑ |
| 11:40 – 11:55 | Coffee Break |
| Block 2 — The Dependencies You've Created | |
| 11:55 – 12:15 | Third-Party & Concentration Risk |
| 12:15 – 12:35 | AI Adoption & Autonomous Decisions |
| 12:35 – 12:55 | Data Protection, Privacy & Digital Sovereignty |
| 12:55 – 13:40 | Lunch |
| Block 3 — The Response You Owe | |
| 13:40 – 14:00 | Operational Resilience & the Continuity Test |
| 14:00 – 14:20 | Incident Response, Crisis Leadership & Disclosure |
| 14:20 – 14:40 | Cyber Insurance, Risk Transfer & Personal Liability |
| 14:40 – 14:55 | Coffee Break |
| 14:55 – 15:15 |
Regulatory Convergence — DORA, NIS2 & the AI Act (Capstone)
About Chris HammansChris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments. His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI). About FireMonFireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it. FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up. |
| 15:15 – 15:40 | Panel 2: Ask the Faculty — The Ten Questions Your Board Should Be Asking |
| 15:40 – 16:00 | Closing Address & CDGP Announcement |
Agenda correct as of publication and subject to change. Session order, timings and speakers may be adjusted as the programme is finalised — the definitive agenda will be issued to registered delegates ahead of the summit.
The format
Built for people who chair meetings, not attend them.
- One day, one room, one agenda — no parallel tracks to choose between
- Ten focused sessions, each led by a dedicated subject-matter expert
- Board-level briefings, not technical deep-dives
- No sales pitches from the stage — partner conversations happen in the breaks, on your terms
- Structured networking with peers who hold the same responsibilities
Who it's for
The people the regulation now names.
- Chairs, non-executive directors and board members
- CEOs and executive leadership of regulated organisations
- Chief Risk Officers and Chief Information Security Officers
- Heads of compliance, audit and operational resilience
- Leaders preparing their organisations for DORA, NIS2 and the EU AI Act
The venue
The Round Room, The Mansion House, Dublin.
The Round Room · The Mansion House · Dawson Street, Dublin 2 · Directions
Festive networking for teams
Close the year as a team — in the room that sets next year's agenda.
The Mansion House will be dressed for Christmas on 25 November. Bring your security, risk or compliance team for the day's briefing, sit together at a reserved team table, and stay on as the day closes for festive networking drinks in one of Dublin's most historic rooms.
- Reserved tables for teams of eight to ten
- Ten expert briefings, one shared picture for the whole team
- Festive drinks and networking as the summit closes
- A year-end team day that stands up as development, not just a night out
Your host
Paul C. Dwyer
Founder & President, ICTTF International Cyber Threat Task Force
For more than 30 years, Paul has advised boards, governments and intelligence bodies on cyber risk and digital governance — including the UK National Crime Agency. He is the author of Cyber Risk Leadership and The Art of Cyber Risk Oversight, a TEDx speaker, and has been named among Ireland's Top 100 CEOs. Paul opens the summit, leads every conversation, and closes the day.
For VIP delegates: every VIP place includes the pathway to the Certified Digital Governance Professional (CDGP) credential, delivered through the EU Cyber Academy — so the day doesn't end when the room empties. Full details will be announced alongside the agenda.
Be in the room.
350 places. Ten risks. One day that sets the agenda for the year ahead. Secure your seat beside the chairs, CEOs and CISOs the regulation now names — before the early bird closes on 15 October and the room fills.
Buy tickets — €495 early birdBuy tickets — €695Looking to partner rather than attend? Claim your risk domain ↓
For partners
Ten risks. Ten partners. Nowhere to hide in a crowd.
EDGS was built to be different from every governance event you've been asked to sponsor. There is no expo hall, no shared logo wall, and no stage time sold to the highest bidder. Instead, ten organisations — one per risk on the agenda — stand alongside our expert faculty as the credible, trusted voice on the risk they know best, in front of 350 of Europe's most senior digital governance leaders.
No shared themes, no competitors in your space. Your organisation is the name associated with one defined risk, across every piece of EDGS branding and material — for the life of the event, not just the day.
Each partner delivers a focused session on their chosen risk — what it is, why it matters for leaders, and how it can be addressed. Thought leadership, not a pitch: the same standard the stage holds every other speaker to.
Beyond the stage, partners have a branded presence on the delegate floor and a dedicated stand at the room's perimeter — built for the real conversations that happen in the breaks, not just visibility from a distance.
Why partner now
The people in this room are the people the regulation now names.
DORA, NIS2 and the EU AI Act have moved digital risk ownership to the boardroom — which means the budget, the mandate and the urgency now sit with exactly the audience EDGS brings into one room: chairs, CEOs, CROs, CISOs and the leaders preparing their organisations for these obligations. Reaching them here means reaching the people who will decide, not the people who will escalate.
What's included
Built for real access, not passive visibility.
- Exclusive ownership of one named risk domain across all EDGS branding and materials
- A 20-minute speaking slot on your chosen risk — education, not a product pitch
- Complimentary delegate passes for client and prospect hosting
- A branded table on the delegate floor and a dedicated stand at the room's perimeter
- Recognition across the ICTTF community — 50,000+ members strong
- Introduction to delegates for follow-up after the event, in line with GDPR
Full partnership details, including investment and terms, are set out in our partner prospectus. Request the prospectus below and we'll send it straight over.
Ten slots. Going now. Each risk domain is available to one partner only, and slots are being confirmed on a first-come basis. Once a domain is taken, it isn't available again until next year.
Not a neat fit for one of the ten named risks, or looking for a different kind of presence at the summit? We're open to discussing a bespoke partnership — tell us your goals and we'll talk it through.
Partner with EDGS
Claim your risk domain.
Ten risks, ten partners, one per domain — and once yours is gone, it's gone until 2027. Tell us which risk you want to own and we'll send the partner prospectus, investment and terms straight over, and set up a call with our events team.
Request the partner prospectus
Tell us about your organisation and the risk domain you're interested in — we'll come back to you within one working day.
Prefer to talk first? events@icttf.org
Hosted by the ICTTF International Cyber Threat Task Force · digitalgovernance.eu · Buy tickets — €495 early birdBuy tickets — €695
CONNECT
