Festive networking drinks to follow
Europe's defining gathering on digital governance
Digital governance has moved to the boardroom. So have we.
One room. One day. 350 of Europe's most senior leaders. The European Digital Governance Summit is where chairs, boards and executive leadership confront the ten digital risks they now personally own — guided by more than ten of Europe's foremost experts and practitioners, and hosted end to end by Paul C. Dwyer.
For every delegate
The book behind the summit.
Every delegate on 25 November receives a printed copy of The Top 10 Digital Risks Every European Board Must Own: the ten briefings behind the day's agenda, with the evidence, the legal mandates and the ten questions every director should be asking.
An episode discussing the book. Press play to start before you read a page.
Who's in the room
Leaders from Ireland's biggest institutions, already confirmed.
A cross-section of the boards, banks and organisations already sending leaders to EDGS.
Plus delegates already confirmed from
The seat you'll be sat beside
The concept
Ten risks. Four parts. One host.
This is not an expo. One day, one room, one agenda — no parallel tracks to choose between. The ten defining digital risks are explored in four parts: each opens with a scene-setting keynote from the summit's host expert, Paul C. Dwyer, followed by more than ten leading experts in focused sessions and boardroom panels, chosen for authority, not affiliation. These are board-level briefings, not technical deep-dives: what each risk really is, what regulators now expect, and what a defensible answer looks like. Selected partners are present around the room to engage during the breaks — on your terms — but the stage belongs to education. Nothing is ever pitched from it.
Chief executives, board members, risk and security leaders and specialist practitioners — in focused expert sessions and two boardroom panels. No panels of pitches.
Paul C. Dwyer curates and hosts the day end to end — welcome, four scene-setting keynotes, closing address. One thread, from first word to last.
350 leaders, together for the whole day. No breakouts to choose between, no sessions missed. Everyone leaves with the same complete picture.
Your host
Paul C. Dwyer
Founder & President, ICTTF International Cyber Threat Task Force
For more than 30 years, Paul has advised boards and governments on cyber risk and digital governance. He is the author of Cyber Risk Leadership and The Art of Cyber Risk Oversight, a TEDx speaker, and has been named among Ireland's Top 100 CEOs. Paul opens the summit, delivers the scene-setting keynote for each of the four parts, and closes the day.
Speakers & Panellists
Voices from the boardroom.
The chief executives, board members and risk and security leaders taking the stage on 25 November. More speakers will be announced as the programme is confirmed.
-
-
-
-
Moderator · 11:50Audrey Barrett
Data Protection Officer
SIPTU
Read bio +Close ×
Audrey BarrettAudrey is the Data Protection Officer for SIPTU, Ireland's largest trade union. She serves as Vice Chair of the Association of Data Protection Officers (ADPO) within the Irish Computer Society, Chair of the ICS Fellows Guild, and a member of the Strategic AI Network Executive Committee.
Audrey is a recognised voice in GDPR, AI governance and digital ethics, with a particular focus on translating regulatory requirements into practical governance frameworks that support both organisational accountability and innovation.
-
Panel · 11:50Kieran Harte
Data Protection Officer
Central Statistics Office (CSO)
Read bio +Close ×
Kieran HarteKieran Harte is a career civil servant working in the Data Office of the Central Statistics Office (CSO) on Skehard Road, Cork. He is part of a team that advises and supports the CSO on matters relating to statistical confidentiality and data protection.
Kieran is a qualified data practitioner with additional qualifications in IT and human resources, and is a member of the Association of Data Protection Officers (ADPO) executive committee, supporting training and certification.
The CSO collects, compiles, analyses and disseminates statistical information relating to the economic and social life of the country, and co-ordinates official statistics produced by other public authorities.
-
Panel · 11:50Lisa Power
Global Data Protection Officer
Carne Group
Read bio +Close ×
Lisa PowerLisa Power LIB, CDPO, CIPP/E, CIPM, AIGP has been an in-house DPO within the financial services sector for almost 10 years. Her accreditations include Certified Data Protection Officer (CDPO) via UCD and the Institute of Bankers, and both CIPP/E and CIPM via the International Association of Privacy Professionals (IAPP). She has also held the IAPP Artificial Intelligence Governance Professional (AIGP) accreditation since 2025.
Lisa is an active member of the IAPP, the Compliance Institute and the Institute of Bankers, sits on the Executive Committee of the Association of Data Protection Officers (ADPO) within the Irish Computer Society, and is Vice-Chair of the Strategic AI Network (SAIN).
-
Panel · 11:50Maeve Dunne
Founder & Fractional DPO
Privacy Path · ComplyVox
Read bio +Close ×
Maeve DunneMaeve Dunne is the founder of Privacy Path, a data protection consultancy, and co-founder of ComplyVox, which makes in-house compliance simple. She works as a fractional DPO for public and private sector organisations.
With a background in sales and marketing in the data space, she brings a business-first lens to GDPR. She is the outgoing Chair of the Association of Data Protection Officers (ADPO).
-
Panel · 11:50Jennifer Walsh
Information Governance Manager
HSE National Screening Service
Read bio +Close ×
Jennifer WalshJennifer Walsh is Information Governance Manager with the HSE’s National Screening Service. Her experience spans data protection, governance, risk and compliance, including previous roles with Skillnet Ireland and the Design & Crafts Council Ireland.
She has advised senior leadership and Audit & Risk Committees, led data governance initiatives and developed practical approaches to privacy and AI governance. Jennifer brings a clear, pragmatic perspective on embedding data protection into everyday decisions, strengthening accountability and supporting responsible innovation.
-
Energiser · 12:55Eoin Lacey
Performance Consultant & Functional Medicine Practitioner
Eoin Lacey Consultancy
LinkedIn -
-
Risk 04 · 13:55Neal Mullen
Chief Information Security Officer
HSE Health Service Executive
LinkedIn -
-
-
Moderator · 15:25Paul Hearns
Executive Director
Blockchain Ireland
Read bio +Close ×
Paul HearnsPaul Hearns provides content strategy and services to the technology sector. Working with multinationals, indigenous companies, and start-ups, he draws on more than 25 years experience as a journalist, author, editor, and presenter.
-
Panel · 15:25David Malone
Chief Executive Officer
Irish League of Credit Unions (ILCU)
Read bio +Close ×
David MaloneDavid Malone is the Chief Executive Officer of the ILCU. He holds a Master’s degree in Accounting and his primary degree is in Accounting and Finance, both from Dublin City University. He is a fellow of the Institute of Chartered Accountants Ireland.
Prior to joining the ILCU, David held senior management audit assurance roles in PwC. David was previously ILCU Financial Controller and was appointed CEO in July 2022. Working closely with the Board, David has overseen the implementation of the ILCU’s transformation programme. He passionately believes that the transformed ILCU can support credit unions unlock their full potential to become the primary financial institution of choice.
-
-
Panel · 15:25Jackie Campbell
Chief Risk Officer
Financial Sector
Read bio +Close ×
Jackie CampbellDirector and governance, risk and compliance professional providing compliance and risk management services to regulated firms. My expertise spans regulatory compliance, data protection, risk management, cyber security and digital operational resilience (DORA and NIS2), backed by Level 9 qualifications from UCD and professional certifications from the Compliance Institute, PRMIA, ICTTF and ICA.
-
-
Panel · 15:25Carol Boon
Digital Transformation & Resilience Manager
Progressive Credit Union
Read bio +Close ×
Carol BoonWith a 30-year career across the credit union sector, Carol has vast experience at both Board and Senior Management. Carol comes with a wide breadth of knowledge of the credit union, having worked in a number of Credit Unions, most recently Progressive Credit Union. Her role as Digital Transformation and Resilience Manager at Progressive Credit Union has seen her drive and transform their IT agenda over the past number of years.
In her current role she has responsibility for leading and developing the IT and Digital Transformation function. In tandem with Digital Transformation, Carol is responsible for the implementation and management of DORA Compliance. To support this, she has recently attained the DORA Certified Compliance Specialist qualification. She continues to collaborate with the team in ICTTF and with IT providers in implementing DORA compliance.
-
-
More speakers to be announced
Further speakers and panellists will be confirmed over the coming weeks.
The running order
Four parts. One narrative arc.
The day is structured in four themed parts — the new battleground, the extended enterprise, crisis & continuity, and the accountable board. Each opens with a scene-setting keynote from summit host Paul C. Dwyer, followed by expert sessions and panel discussion. All ten risks are covered across the day.
09:00 Registration · 09:50 Welcome · 15:50 Closing · 16:00 Festive networking & drinks
View the full agenda & session details ↓
| 09:00 – 09:50 | Registration, Coffee & NetworkingArrive at the historic Mansion House and settle in over coffee — your first chance to meet fellow board members, executives and risk leaders from across Europe. Please check in at the door on arrival. |
| 09:50 – 10:00 |
Welcome: 1 Day · 10 Risks · 350 Leaders · 0 Sales Pitches
Keynote · Paul C. Dwyer, Founder & President, ICTTF Summit host Paul C. Dwyer opens the day and explains how it is built: ten digital governance risks, explored across four parts, each opening with a scene-setting keynote followed by expert speakers and panel discussion. Paul sets out what delegates can expect to leave with, and why the questions raised today are no longer just for the CISO but for every member of the board. |
| Part 1 — The New Battleground | |
| 10:00 – 10:30 |
AI and Geopolitics: Who Controls the Rules?
Keynote · Paul C. Dwyer, Founder & President, ICTTF Sets the scene for: AI Adoption & Autonomous Decisions · Geopolitics, the Threat Landscape & the Board Horizon The battleground has moved from territory to data, and from bombs to algorithms. In this opening session, Paul C. Dwyer explores how AI is accelerating the convergence of geopolitics, cybercrime and regulation, and what that means for every board in the room. Drawing on real-world cases, Paul examines:
The session closes with a clear message for leaders: it is not the most advanced organisations that will win the AI race, but the most trusted. |
| 10:30 – 10:45 |
AI Adoption & Autonomous Decisions
AI no longer just processes work. It makes and shapes decisions: who gets a loan, which invoice is flagged, which candidate is shortlisted, what a customer is told. When those decisions are wrong, biased or impossible to explain, the liability doesn’t attach to the model. It attaches to the organisation, and to the leadership that let it govern blind. In this session, Rob Phillipson explores:
The boardroom questionCan anyone in this room list where AI is already making or shaping decisions in our name — and show me who is accountable for each one? About Rob PhillipsonRob Phillipson is Managing Director of the International Compliance Association (ICA) and CLYI. Having previously served as ICA's Commercial Development Director, he leads the organisation's work in supporting compliance professionals — and the regulated firms that employ them — as regulation, technology and financial crime risk continue to evolve. About ICAThe International Compliance Association is the leading professional body for the global regulatory and financial crime compliance community. With 30,000 members in 155 countries and more than 190,000 professionals trained, ICA works to see compliance recognised as a modern profession, benchmarked against international standards of competence. Its professional qualifications and courses span anti-money laundering, governance, risk and compliance, financial crime prevention, customer due diligence and sanctions. ICA is part of Wilmington plc. |
| 10:45 – 11:00 |
Geopolitics, the Threat Landscape & the Board Horizon
Geopolitics no longer stops at the firewall. The systems Europe depends on are caught up in strategic competition between powers. Energy, telecoms, transport, health and finance are under persistent state-linked targeting, and organisations with no stake in a conflict can still find themselves in its path. In this session, Robert O’Brien explores:
The boardroom questionWhat would a serious geopolitical escalation mean for our operations, our suppliers and our people — and who on this board’s behalf is watching that horizon? About Robert O’BrienRobert O’Brien, The Cybersecurity CEO, is a technology founder with 30 years’ experience building, scaling and protecting digital businesses. His work focuses on helping CEOs and boards take ownership of cybersecurity with the same discipline they apply to financial governance. He has founded six companies, including MetaCompliance, which he grew from a personalised security awareness platform into a leading European cybersecurity software company employing more than 300 people before its sale to French private equity in 2025. Working with senior leadership teams across multiple countries has given him direct experience of the gap between those responsible for running a business and those charged with protecting it. He is co-founder of Safe Harbour Security, which helps mid-market organisations strengthen their cyber resilience through practical advice and access to senior security expertise. He also hosts The Cybersecurity CEO podcast, exploring the leadership decisions and human behaviours that shape organisational security. Robert is currently writing Better Safe: A CEO’s Guide to Cybersecurity in the Age of AI, drawing on research with CEOs and CISOs to examine how cybersecurity needs to become a boardroom priority. His central argument is that progress requires CEOs to own cyber risk, implement security as a matter of corporate life or death, and make accountability part of everyday business. About The Cybersecurity CEOThe Cybersecurity CEO is a podcast hosted by Robert O’Brien, exploring the leadership decisions and human behaviours that shape organisational security — and what it takes for CEOs and boards to own cyber risk. |
| 11:00 – 11:20 | Coffee & Networking |
| Part 2 — The Extended Enterprise | |
| 11:20 – 11:50 |
When Ransomware Isn’t Ransomware: Could It Happen Again?
Keynote · Paul C. Dwyer, Founder & President, ICTTF Covers: Ransomware & Cyber Extortion · Third-Party & Concentration Risk · Cyber Insurance, Risk Transfer & Personal Liability · Data Protection, Privacy & Digital Sovereignty Almost a decade ago, organisations around the world saw what looked like a ransom note. There was no way to pay to get their data back, because the attack was never designed to give anything back. It was a cyber weapon dressed up as crime, delivered through a routine software update, and it went on to cause billions of dollars in damage. Global shipping, manufacturing and logistics companies with no connection to the intended target were among the victims. Paul C. Dwyer traces how ransomware evolved from a 1989 floppy-disk scam into a global criminal market of ransomware-as-a-service and double and triple extortion, and how it became a cover for state-sponsored destruction. He then asks the questions that matter most: what have we learnt in the last decade, and could it happen again today? Three issues every board now owns sit at the heart of the answer:
|
| 11:50 – 12:15 |
Panel: AI Governance and the DPO: Whose Desk Is It On?
AI governance has arrived on the Data Protection Officer’s desk, often without anyone deciding that it should. As organisations adopt AI tools and systems, the DPO is frequently the person expected to assess them, approve them and answer for them. In this panel, five data protection leaders discuss what that means for the role, and for the boards that rely on it:
The boardroom questionWho in this organisation owns AI governance, and does our DPO have the independence to challenge it? Moderator: Audrey Barrett, Data Protection Officer, SIPTU Panellists: Kieran Harte, Data Protection Officer, Central Statistics Office · Lisa Power, Global Data Protection Officer, Carne Group · Maeve Dunne, Founder, Privacy Path · Jennifer Walsh, Information Governance Manager, HSE National Screening Service Meet the panellists ↑ |
| 12:15 – 12:55 | Networking LunchA quick business lunch served at networking pods, designed to keep the conversations of the morning going and help delegates meet as many peers as possible. |
| 12:55 – 13:10 |
Energiser: Resilience for Leaders
All day we’ve talked about the resilience of systems, suppliers and organisations. But when the crisis comes, resilience depends on the people making the decisions. Leaders who are exhausted, stressed and running on empty make poorer calls at exactly the moment the stakes are highest. In this high-energy session, performance consultant Eoin Lacey turns the spotlight from the organisation to the individual. He explores how mental health, physical health and a sense of purpose combine to make leaders effective under pressure, and why looking after mind, body and spirit is not a personal luxury but a leadership responsibility. A short, practical and lively session to recharge the room before the afternoon’s crisis scenario.
Speaker
Eoin Lacey
Performance Consultant & Functional Medicine Practitioner · Eoin Lacey Consultancy
LinkedIn →
|
| Part 3 — Crisis & Continuity | |
| 13:10 – 13:40 |
Boom! You’re Under Attack — Now What?
Keynote · Paul C. Dwyer, Founder & President, ICTTF Sets the scene for: Incident Response, Crisis Leadership & Disclosure · Operational Resilience & the Continuity Test In one of the largest cyber heists ever recorded, the criminals didn’t break down the door. They came in through a phishing email, then watched and learned for months, recording staff screens until they understood the banks’ processes better than some of the people running them. Then they struck. They inflated account balances, made ATMs dispense cash on command to waiting money mules, and moved hundreds of millions out of financial institutions around the world. Paul C. Dwyer uses this real-world case to explore:
|
| 13:40 – 13:55 |
Incident Response, Crisis Leadership & Disclosure
Every organisation will have incidents. What sets them apart afterwards is not whether they were attacked, but how they responded in the first hours: who decided, who spoke, what was disclosed, to whom, and when. Regulators, customers and courts increasingly judge the response as harshly as the breach. In this session, Ellen Gunning explores leadership and communication when the clock is running:
The boardroom questionWho speaks for us in the first four hours of a serious incident — and when did that person last practise doing it? About Ellen GunningEllen Gunning has spent more than 30 years in public relations and journalism, and crisis communications is her specialty. Her approach to a crisis is direct: respond quickly, tell the truth, accept responsibility where it is yours, and have trained spokespeople ready before you need them. In 1992 she founded the Irish Academy of Public Relations, which now has graduates in 55 countries, and she is the author of Public Relations – A Practical Approach, a core text for third-level PR students worldwide. A regular media commentator, her awards include European Parliament Journalist of the Year, a Chambers Ireland CSR Award and Tech Entrepreneur of the Year. About MettacommsFounded in 2019, Mettacomms is a communications intelligence platform for communications professionals. It combines human curation with artificial intelligence, machine learning and natural language processing to search worldwide media coverage, parliamentary proceedings, public opinion, economic analysis and university research, giving teams a verified, global view of any topic in minutes and early warning of the trends worth watching. Mettacomms won the PR Technology award at the Stevie International Awards and has offices in Dublin and Boston. |
| 13:55 – 14:10 |
Operational Resilience & the Continuity Test
For twenty years, the guiding question was “how do we keep attackers out?” European regulation has changed it to something more honest: when disruption comes, whether attack, outage, failure or error, can you keep operating? That is resilience, and it is a different discipline from security. In this session, Neal Mullen explores what real resilience looks like when critical services are on the line:
The boardroom questionWhen did we last rehearse a severe-but-plausible outage end to end — with this board in the room — and what did we change afterwards? About Neal MullenNeal Mullen is Chief Information Security Officer and National Director of Operational Resilience at the Health Service Executive, where he leads the national cyber defence and resilience of Ireland's public health service. He brings more than 25 years' experience in cyber security and resilience across the healthcare, construction, technology and retail sectors. Before joining the HSE, he spent seven years as Group Deputy Director of ICT Operations at St Vincent's University Hospital, and worked with KPMG as a security and resilience specialist, with earlier roles at Bertelsmann, Dunnes Stores and CRH. About the HSEThe Health Service Executive (HSE) provides Ireland's public health and social care services, in hospitals and in communities across the country. Established in 2005, it is one of the largest organisations in the State — and one of the clearest examples of why operational resilience is a matter of essential services, not just IT. |
| 14:10 – 14:25 | Coffee & Networking |
| Part 4 — The Accountable Board | |
| 14:25 – 14:55 |
The Rules of the Game Have Changed: From Compliance to Accountability
Keynote · Paul C. Dwyer, Founder & President, ICTTF Sets the scene for: Regulatory Convergence: DORA, NIS2 & the AI Act · Identity, Access & the Human Perimeter In less than a decade, digital regulation has moved from guidance to obligation and from the IT department to the boardroom. The regulators have stopped writing to the IT department. They now write to the board. Paul C. Dwyer traces how compliance has evolved and why the shift now under way is a paradigm change, not just more regulation:
|
| 14:55 – 15:10 |
Regulatory Convergence: DORA, NIS2 & the AI Act
Europe hasn’t passed one digital law. It has passed a lattice of them. For many organisations the practical challenge is no longer any single regulation but the overlap: working out which regimes apply, where the duties intersect, and where one piece of evidence can serve several masters. In this session, Chris Hammans explores how to turn regulatory overlap into a single, coherent response:
The boardroom questionWhich of these regimes apply to us — mapped, in writing — and where exactly does my personal accountability begin under each? About Chris HammansChris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments. His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI). About FireMonFireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it. FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up. |
| 15:10 – 15:25 |
Identity, Access & the Human Perimeter
The firewall around the building is gone. Work happens across cloud services, personal devices, home networks and third-party platforms. What remains as the perimeter is identity: the credentials, tokens and privileges that decide who can touch what. Most attackers no longer break in. They sign in. In this session, Gavin Carpenter explores why identity is now where cyber regulation becomes real:
The boardroom questionWho — including our suppliers — holds the keys to everything we depend on, and how quickly would we know if those keys were stolen? About Gavin CarpenterGavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself. Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials. About PhonovationFounded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant. Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company. |
| 15:25 – 15:50 |
Panel: From Obligation to Evidence — What Regulators Now Expect of the Board
The day’s final discussion brings the boardroom view to everything that has gone before. Moderated by Paul Hearns, our panel brings together board members, risk leaders, a CISO and practitioners from financial services and credit unions to discuss what it really means to sit at the table when accountability is personal and the evidence must hold up:
Moderator: Paul Hearns, Executive Director, Blockchain Ireland Panellists: David Malone, CEO, Irish League of Credit Unions · Padraic Hamrock, Non-Executive Director, Financial Sector · Jackie Campbell, Chief Risk Officer, Financial Sector · Pádraigh Griffin, Chief Information Security Officer, eir Business · Carol Boon, Digital Transformation & Resilience Manager, Progressive Credit Union · Michael Conway, Managing Director, Renaissance Meet the panellists ↑ |
| 15:50 – 16:00 |
Closing: From Ten Risks to Ten Capabilities
Keynote · Paul C. Dwyer, Founder & President, ICTTF Taken together, the ten risks are not a threat catalogue. They are a mirror. Each one reflects a governance capability a board either has or doesn’t: visibility of dependencies and AI, tested rather than assumed resilience, identity discipline, data accountability, a single coherent answer to converging regulation, rehearsed crisis leadership, honest risk transfer and a watched horizon. Paul C. Dwyer closes the summit with the ten boardroom questions every delegate should take to their next board meeting. Risks are managed, capabilities are built, and building them is board work. |
| 16:00 | Festive Networking & DrinksContinue the conversation over festive drinks in the Mansion House, decorated for Christmas. |
Agenda correct as of publication and subject to change. Session order, timings and speakers may be adjusted as the programme is finalised — the definitive agenda will be issued to registered delegates ahead of the summit.
Who it's for
The people the regulation now names.
- Chairs, non-executive directors and board members
- CEOs and executive leadership of regulated organisations
- Chief Risk Officers and Chief Information Security Officers
- Heads of compliance, audit and operational resilience
- Leaders preparing their organisations for DORA, NIS2 and the EU AI Act
Who’s going to Dublin
Every board has one. The one who’s already booked.
Six short films, six boardrooms in varying states of denial, and in every one somebody gets up and leaves for Dublin. They’re the people you’ll be sitting beside on 25 November: the director who reads the risk report properly, the officer who asks about the lifeboats, the one who says the dashboard is measuring the wrong things. The people who stay behind are the reason the summit exists.
Bynance Board Meeting
Going to DublinMargaret. She read the book, flagged the watermelon metrics 18 months ago, and has the ticket to prove it.
Staying homeThe board whose dashboard stays green while 6.3 billion walks out the door.
Digital Resilience Lessons on the Titanic
Going to DublinThe officer who knows the difference between a risk register and a lifeboat.
Staying homeThe chairman confirming the iceberg is on page 247 and still within risk appetite.
Watermelon Metrics
Going to DublinThe director who said it out loud: we’re measuring the wrong things.
Staying homeThe chairman whose fix for a red watermelon is to change it to green.
The Cybersecurity Market
Going to DublinThe buyers who asked about testing, then walked away from the stall.
Staying homeDave. Deluxe bubble wrap for ransomware, incident response by rebranding (extra).
Jurassic Lessons in Digital Risk Management
Going to DublinThe one who knows what an existential risk actually looks like.
Staying homeThe chairman who has put the asteroid on next quarter’s agenda.
The Digital Resilience Office Leader
Going to DublinThe colleague who wanted a second opinion on offering the ransomware gang a grand, cash.
Staying homeBarry. Hacked three times, outsourced the lot to Dave, and got a kettle thrown in.
Recognise someone who’s staying home? You know who needs a ticket.
Why now
Accountability has been reassigned — upwards.
A new generation of European regulation places responsibility for digital risk squarely with leadership.
The question in the boardroom is no longer “are we secure?” It is “can I evidence that we are resilient?”
DORA
Operational resilience is now a regulatory obligation for financial entities — with the management body expected to direct, approve and oversee it.
NIS2
Cybersecurity duties now extend across essential and important sectors, with accountability attaching to management — not just to the IT function.
EU AI Act
As organisations adopt AI, boards are expected to govern its use with the same rigour they apply to any other material risk.
The ten risks
Ten risks. One day. No noise.
The summit is built around The Top 10 Digital Risks Every European Board Must Own — the ten risks that now define board accountability across Europe. They are not ten separate talks: the risks are woven through the day's four parts and covered in three ways — practical, evidence-based and free of vendor pitches.
Paul C. Dwyer opens each part with a scene-setting keynote that frames two to four of the risks and sets up the experts who follow.
A leading practitioner takes one risk and gives the boardroom view: what it is, what regulators expect, and what a defensible answer looks like.
Board members, risk leaders and practitioners debate where the risks meet in practice, and what supervisors now expect of the board.
Below, each risk shows where it is covered on the day. Open a risk for the briefing, the boardroom question and the session details.
01Ransomware & Cyber Extortion
Keynote · Part 2Paul C. Dwyer
Ransomware is no longer a virus problem. It is an extortion business — organised, industrialised and profitable — whose product is your worst trading day. Modern operators rarely stop at encrypting systems: they steal data first, threaten publication, and price their demand against what they estimate an outage costs you per day.
They don't price the ransom against your data. They price it against your downtime.
The boardroom questionIf ransomware took our core systems down this morning, how many days could we trade — and who has independently verified that answer?
On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
02Third-Party & Concentration Risk
Keynote · Part 2Paul C. Dwyer
Every organisation has outsourced pieces of itself — cloud, payments, payroll, security, software. Each contract made sense on its own. Taken together, they have quietly relocated your operational risk into companies you do not control, cannot inspect at will, and often share with every competitor you have.
You can outsource the function. You cannot outsource the risk.
The boardroom questionWhere are we exposed to the same critical providers as everyone else in our sector — and what, precisely, happens to us on the day one of them fails?
On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
03AI Adoption & Autonomous Decisions
Expert briefing · Part 1Rob Phillipson · ICA
AI is entering your organisation faster than your governance of it. Decisions once made by accountable people are increasingly made, shaped or accelerated by systems — often adopted team by team, without anyone approving the sum of it at the top.
You can delegate the decision to a machine. You cannot delegate the accountability.
The boardroom questionCan anyone in this room list where AI is already making or shaping decisions in our name — and show me who is accountable for each one?
On 25 November · 10:30 – 10:45 · Leading this session
About Rob Phillipson
Rob Phillipson is Managing Director of the International Compliance Association (ICA) and CLYI. Having previously served as ICA's Commercial Development Director, he leads the organisation's work in supporting compliance professionals — and the regulated firms that employ them — as regulation, technology and financial crime risk continue to evolve.
About ICA
The International Compliance Association is the leading professional body for the global regulatory and financial crime compliance community. With 30,000 members in 155 countries and more than 190,000 professionals trained, ICA works to see compliance recognised as a modern profession, benchmarked against international standards of competence.
Its professional qualifications and courses span anti-money laundering, governance, risk and compliance, financial crime prevention, customer due diligence and sanctions. ICA is part of Wilmington plc.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
04Operational Resilience & the Continuity Test
Expert briefing · Part 3Neal Mullen · HSE
Every organisation has a continuity plan. Far fewer have evidence that it works. Resilience is not the existence of a document — it is the demonstrated ability to keep your most important services running through disruption, within tolerances the board has set.
Continuity you haven't tested is continuity you don't have.
The boardroom questionWhen did we last rehearse a severe-but-plausible outage end to end — with this board in the room — and what did we change afterwards?
On 25 November · 13:55 – 14:10 · Leading this session
About Neal Mullen
Neal Mullen is Chief Information Security Officer and National Director of Operational Resilience at the Health Service Executive, where he leads the national cyber defence and resilience of Ireland's public health service. He brings more than 25 years' experience in cyber security and resilience across the healthcare, construction, technology and retail sectors.
Before joining the HSE, he spent seven years as Group Deputy Director of ICT Operations at St Vincent's University Hospital, and worked with KPMG as a security and resilience specialist, with earlier roles at Bertelsmann, Dunnes Stores and CRH.
About the HSE
The Health Service Executive (HSE) provides Ireland's public health and social care services, in hospitals and in communities across the country. Established in 2005, it is one of the largest organisations in the State — and one of the clearest examples of why operational resilience is a matter of essential services, not just IT.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
05Identity, Access & the Human Perimeter
Expert briefing · Part 4Gavin Carpenter · Phonovation
Digital identity no longer stops at usernames, passwords and access controls. Organisations must also be able to trust the communications through which identities are verified, transactions are confirmed, customers are contacted and critical instructions are delivered.
The human perimeter is increasingly targeted through impersonation, phishing, smishing, spoofed messages, compromised credentials and AI-enabled social engineering — any voice, video call, email or text that can convincingly pass for someone you trust. Secure communications, trusted messaging channels, strong authentication and resilient identity processes are therefore becoming central to digital governance.
Boards must understand how their organisations protect not only access to systems, but also the integrity of the communications used to establish trust with employees, customers, suppliers and other stakeholders.
Attackers don't break in anymore. They log in.
The boardroom questionWho — including our suppliers — holds the keys to everything we depend on, and how quickly would we know if those keys were stolen?
On 25 November · 15:10 – 15:25 · Leading this session
About Gavin Carpenter
Gavin Carpenter is Chief Executive Officer of Phonovation, the Dublin-headquartered secure messaging company that has been building business communications services since 1988. Under his leadership, Phonovation has focused on a problem boards increasingly own: making sure the messages organisations send to customers can be trusted — from protecting bank customers against SIM swap fraud to verifying identity through the mobile device itself.
Gavin has long been a public voice on the risks hiding in everyday customer communications, from SIM swap attacks to fake bank texts and phishing that lure customers into handing over their credentials.
About Phonovation
Founded in 1988 and headquartered in Dún Laoghaire, Co. Dublin, with offices in London and Newcastle, Phonovation is a specialist in secure Application-to-Person (A2P) messaging. The company designs, builds and manages its own services, handling high volumes of calls and text messages every year for organisations ranging from sole traders to large European multinationals. Phonovation is ISO 27001 certified and GDPR compliant.
Its PhonoSecure suite helps businesses protect their customers from cyber fraud. It includes SIM Swap Protection, in use with most banking organisations, and Mobile ID, which binds a customer's SIM and device to a mobile app for secure two-factor authentication. Mobile ID was named overall winner and Most Disruptive Fintech at the Deloitte Financial Services Innovation Awards in 2022, and Phonovation has also been recognised as a Deloitte Best Managed Company.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
06Data Protection, Privacy & Digital Sovereignty
Keynote + panel · Part 2Paul C. Dwyer · AI Governance & the DPO panel
Data is the one asset you can lose while still possessing it. Where your data lives, under whose laws, who can access it and who can compel access to it — these are now questions of sovereignty and strategy, not storage.
Data is the only asset you can lose and still hold.
The boardroom questionIf our largest data store were exposed tomorrow, could we state precisely what was in it, who it belonged to, and which laws attach to it?
On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, then the panel “AI Governance and the DPO: Whose Desk Is It On?” (11:50 – 12:15)
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
07Regulatory Convergence: DORA, NIS2 & the AI Act
Expert briefing + panel · Part 4Chris Hammans · FireMon
Europe's digital regulations were written separately, but they converge on a single expectation: that the management body directs, oversees and evidences the organisation's digital risk. Treating them as three compliance projects misses the point — together they define one governance discipline.
That evidence increasingly lives in the controls themselves, not in policy documents. The firewall rules, network segmentation and cloud security policies that decide who and what can reach critical systems now number in the thousands in most large organisations, and they change every day across on-premises, cloud and third-party networks. Rules accumulate, exceptions outlive their purpose, and the gap widens between the risk appetite the board approved and the controls actually being enforced.
A point-in-time audit shows what was true on the day of the audit. Converged regulation expects more: continuous visibility of the whole network estate, controlled and recorded change, and audit-ready evidence on demand. Boards that can show their security policy matches their stated obligations, every day rather than once a year, are the ones answering regulators with evidence instead of assurances.
Regulators no longer ask what your IT department did. They ask what your board decided.
The boardroom questionWhich of these regimes apply to us — mapped, in writing — and where exactly does my personal accountability begin under each?
On 25 November · 14:55 – 15:10 · Leading this session
About Chris Hammans
Chris Hammans is an experienced cybersecurity and cloud leader with over 15 years supporting enterprise organisations across EMEA. As Regional Manager for Northern Europe at FireMon, he helps customers strengthen their security posture, simplify policy management, and navigate the operational challenges of complex, hybrid network environments.
His background spans cybersecurity, compliance and risk management, cloud security, CSPM, observability, and SecOps-related platforms, giving him strong commercial and strategic insight into the challenges faced by large, regulated organisations — including financial services, fintech, insurance, and critical national infrastructure (CNI).
About FireMon
FireMon founded the network security policy management category more than two decades ago, built on a simple premise: policy, not any mix of firewalls or consoles, should govern network security. That premise holds today. Firewalls, cloud security groups, and segmentation platforms execute policy; none of them govern it.
FireMon is the control plane that sits above every vendor and every environment, on-prem, cloud, and hybrid, so enterprises can see, prove, and safely change policy from one place instead of reconciling it console by console. We care about the people running it: audits measured in minutes instead of weeks, and changes made with confidence instead of a midnight page. No fluff. No empty dashboards. Just results that hold up.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
08Incident Response, Crisis Leadership & Disclosure
Expert briefing · Part 3Ellen Gunning · Mettacomms
The incident tests your systems. The hours that follow test your board. European notification regimes start the clock almost immediately — which means who leads, who speaks, who notifies and in what order must be decided, and rehearsed, long before the worst day arrives.
A crisis reveals the decisions you didn't make in peacetime.
The boardroom questionWho speaks for us in the first four hours of a serious incident — and when did that person last practise doing it?
On 25 November · 13:40 – 13:55 · Leading this session
About Ellen Gunning
Ellen Gunning has spent more than 30 years in public relations and journalism, and crisis communications is her specialty. Her approach to a crisis is direct: respond quickly, tell the truth, accept responsibility where it is yours, and have trained spokespeople ready before you need them.
In 1992 she founded the Irish Academy of Public Relations, which now has graduates in 55 countries, and she is the author of Public Relations – A Practical Approach, a core text for third-level PR students worldwide. A regular media commentator, her awards include European Parliament Journalist of the Year, a Chambers Ireland CSR Award and Tech Entrepreneur of the Year.
About Mettacomms
Founded in 2019, Mettacomms is a communications intelligence platform for communications professionals. It combines human curation with artificial intelligence, machine learning and natural language processing to search worldwide media coverage, parliamentary proceedings, public opinion, economic analysis and university research, giving teams a verified, global view of any topic in minutes and early warning of the trends worth watching.
Mettacomms won the PR Technology award at the Stevie International Awards and has offices in Dublin and Boston.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
09Cyber Insurance, Risk Transfer & Personal Liability
Keynote · Part 2Paul C. Dwyer
Insurance has a role in digital risk — but a narrower one than many boards assume. Policies pay some costs, under conditions, with exclusions. What they do not transfer is accountability: regulatory duties, disclosure obligations and, increasingly, personal exposure for those who govern.
Insurance transfers cost. It does not transfer accountability.
The boardroom questionHave we read our cyber policy’s exclusions as carefully as the underwriter will after a claim — and do we know which of our risks no policy covers?
On 25 November · 11:20 – 11:50 · Covered in Paul C. Dwyer’s keynote, “When Ransomware Isn’t Ransomware”
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
10Geopolitics, the Threat Landscape & the Board Horizon
Expert briefing · Part 1Robert O’Brien · The Cybersecurity CEO
Your threat landscape is now shaped in capitals as much as in code. Conflict, sanctions, supply-chain realignment and state-aligned cyber activity reach directly into European organisations — which makes horizon scanning a governance duty, not a luxury.
Geopolitics no longer stops at the firewall.
The boardroom questionWhat would a serious geopolitical escalation mean for our operations, our suppliers and our people — and who on this board’s behalf is watching that horizon?
On 25 November · 10:45 – 11:00 · Leading this session
About Robert O’Brien
Robert O’Brien, The Cybersecurity CEO, is a technology founder with 30 years’ experience building, scaling and protecting digital businesses. His work focuses on helping CEOs and boards take ownership of cybersecurity with the same discipline they apply to financial governance.
He has founded six companies, including MetaCompliance, which he grew from a personalised security awareness platform into a leading European cybersecurity software company employing more than 300 people before its sale to French private equity in 2025. Working with senior leadership teams across multiple countries has given him direct experience of the gap between those responsible for running a business and those charged with protecting it.
He is co-founder of Safe Harbour Security, which helps mid-market organisations strengthen their cyber resilience through practical advice and access to senior security expertise. He also hosts The Cybersecurity CEO podcast, exploring the leadership decisions and human behaviours that shape organisational security.
Robert is currently writing Better Safe: A CEO’s Guide to Cybersecurity in the Age of AI, drawing on research with CEOs and CISOs to examine how cybersecurity needs to become a boardroom priority. His central argument is that progress requires CEOs to own cyber risk, implement security as a matter of corporate life or death, and make accountability part of everyday business.
About The Cybersecurity CEO
The Cybersecurity CEO is a podcast hosted by Robert O’Brien, exploring the leadership decisions and human behaviours that shape organisational security — and what it takes for CEOs and boards to own cyber risk.
The full briefing on this risk — evidence, legal mandate and board insight — is included in the Executive Guide. Register & download your free copy →
The complete briefing
Every risk. One document.
Download the Executive Guide — The Top 10 Digital Risks Every European Board Must Own — all ten briefings in a single board-ready document: the evidence, the legal mandates, and the ten questions every director should be asking.
Download the Executive Guide
Enter your details and your copy will be emailed to you.
Watch before you come
Six short films. One full briefing.
The Executive Awareness Series — six short films made for the people the regulation now names — plus the full one-hour webinar in which Paul C. Dwyer walks through all ten risks. Pick any one to start, then bring the questions it raises to the Round Room on 25 November.
Every video raises a question. On 25 November, the room answers it.
Buy tickets — €695We've been here before
Ten years ago, we filled this room.
In 2016, ICTTF brought the Cyber Threat Summit to the Round Room at the Mansion House. This short film shows what that day looked like.
Ten years on, we're returning to the same room. The threats have grown, and accountability for them has moved to the boardroom — so this time, so has the agenda.
ICTTF has brought Europe's security, risk and governance leaders together for more than a decade. EDGS is that community at its most senior — and the people in the photographs below are the people you'll be sat beside.
A decade of ICTTF events — browse the full gallery on Flickr →
The venue
The Round Room, The Mansion House, Dublin.
The Round Room · The Mansion House · Dawson Street, Dublin 2 · Directions
Festive networking for teams
Close the year as a team — in the room that sets next year's agenda.
The Mansion House will be dressed for Christmas on 25 November. Bring your security, risk or compliance team for the day's briefing, sit together at a reserved team table, and stay on as the day closes for festive networking drinks in one of Dublin's most historic rooms.
- Reserved tables for teams of eight to ten
- Four keynotes, 10+ experts and two panels — one shared picture for the whole team
- Festive drinks and networking as the summit closes
- A year-end team day that stands up as development, not just a night out
For VIP delegates: every VIP place includes the pathway to the Certified Digital Governance Professional (CDGP) credential, delivered through the EU Cyber Academy — so the day doesn't end when the room empties. The CDGP course commences on 4 January 2027.
Good to know
Frequently asked questions
What’s the difference between a standard ticket and a VIP pass?
Both give you the full summit day: every keynote, expert briefing and panel, the networking lunch, and the festive networking drinks.
The main difference is that a VIP pass also includes complimentary access to the Certified Digital Governance Professional (CDGP) certification course, delivered through the EU Cyber Academy. The course commences on 4 January 2027, and VIP delegates then have 90 days to work through the material and complete the certification exam.
VIP passes are allocated by invitation only. If you're attending on a standard ticket and would like to take the CDGP, the course will also open for wider enrolment in December 2026.
Will there be name badges?
No, and that's by design. EDGS is a gathering of peers, not a trade show, so we've chosen not to print badges, lanyards or plastic holders that end up in the bin by the end of the day.
Every delegate is on our registered guest list. Simply give your name to our team at the door and you'll be welcomed straight in. Introductions happen the way they should at a boardroom-level event: in person.
When does the CDGP course start?
The Certified Digital Governance Professional (CDGP) course, delivered through the EU Cyber Academy, commences on 4 January 2027. It is included with every VIP place.
From the start date, VIP delegates have 90 days to work through the course material and complete the certification exam.
Will the event be photographed or filmed?
Yes. EDGS will be photographed, filmed and audio-recorded, and this material may be used for event coverage, promotion and education. By attending, you acknowledge that you may appear in photographs, video or audio recordings.
If you have any concerns, please contact events@icttf.org before the event or speak to a member of our team on the day.
Is the agenda final?
The agenda is correct at the time of publication, but session times, order and speakers may change as the programme is finalised. The definitive running order will be issued to registered delegates ahead of the summit. See the current agenda ↑
Another question? Email events@icttf.org and we'll come back to you.
Be in the room.
350 places. Ten risks. One day that sets the agenda for the year ahead. Secure your seat beside the chairs, CEOs and CISOs the regulation now names — before the room fills.
Buy tickets — €695Looking to partner rather than attend? Partner with EDGS ↓
For partners
350 leaders. One room. Nowhere to hide in a crowd.
EDGS was built to be different from every governance event you've been asked to sponsor. There is no expo hall, no shared logo wall, and no stage time sold to the highest bidder. Instead, a select group of partners stands alongside our expert faculty, in front of 350 of Europe's most senior digital governance leaders.
Chairs, CEOs, CROs and CISOs — the people DORA, NIS2 and the EU AI Act now name, who hold the budget and the mandate — together in one room for the whole day.
Recognition across the ICTTF community — 50,000+ members strong — and introductions to delegates for follow-up after the event, in line with GDPR.
Partners have a branded presence on the delegate floor and a dedicated stand at the room's perimeter — built for the real conversations that happen in the breaks — plus complimentary delegate passes for client and prospect hosting.
Partnerships are being confirmed now. Places on the delegate floor are limited by the room, and are allocated on a first-come basis.
Looking for a different kind of presence at the summit? We're open to discussing a bespoke partnership — tell us your goals and we'll talk it through.
Partner with EDGS
Stand alongside the summit.
Tell us about your organisation and what you'd like to achieve, and we'll send the partner prospectus, investment and terms straight over, and set up a call with our events team.
Request the partner prospectus
Tell us about your organisation and what you'd like to achieve — we'll come back to you within one working day.
Prefer to talk first? events@icttf.org
Hosted by the ICTTF International Cyber Threat Task Force · digitalgovernance.eu · Buy tickets — €695
HEAD OFFICE
-
ICTTF Ltd
ICTTF House
First Floor Unit 15
N17 Business Park
Tuam, Co Galway
H54 H1K2 -
info@icttf.org
support@icttf.org -
+353 (0)1 905 3263

