ETSI Security Conference marks 20 years with focus on AI, CRA and quantum
ETSI's Security Conference celebrated its 20th anniversary from 19 to 22 October at the organisation's headquarters in Sophia Antipolis, France, bringing together more than 250 experts to look back at security history and ahead to future challenges. AI security, the Cyber Resilience Act and quantum readiness featured prominently across the four days.
- ETSI's 20th Security Conference ran from 19 to 22 October in Sophia Antipolis, France, with more than 250 experts.
- A critical PHP flaw affecting millions of websites, detected by AI that week, was cited as an example of the need for security by design.
- Topics included AI security, the Cyber Resilience Act, SMS blaster attacks and post-quantum cryptography.
- ETSI EN 304 223, the baseline security standard for AI systems and models, was introduced.
- The Women in Cyber session opened with a tribute to Issy Hall, who died in September 2026 aged 30.
Four days, many formats
According to ETSI, participants came from industry, government agencies, the European Commission, standards bodies, the open source community, academia and research organisations. The programme combined keynote addresses, panel discussions, dedicated sessions, side interviews with media, poster sessions and live demonstrations.
The first day opened with a review of the global security landscape, tracing how the threat environment and today's vulnerabilities have evolved. A critical PHP security flaw, detected by AI during the same week and affecting millions of websites, served as a real-time example. ETSI said it illustrates the need for security by design, an essential feature of standards, and one of the roles of AI in cybersecurity today.
Sessions on AI, cybercrime and digital resilience produced a clear takeaway, according to ETSI: vulnerability disclosure adoption and standardisation matter more than ever in 2026. A well-known speaker, as quoted by ETSI, said the "slopdemic" is already here and the "vulnpocalypse" is around the corner. Another speaker argued that security for AI is now as critical as AI for security, and a further speaker used AI to discover vulnerabilities in international standards under supervised expert oversight.
Cloud, telecom, regulation and quantum
The second day addressed cloud, SaaS, OT/IoT and product security, including mobile app security. AI security and resilience, the balance of risk and reward in AI, the role of standards and an overview of security regulations were also on the agenda. A session introduced ETSI EN 304 223, the baseline security standard for AI systems and models.
The third day covered networks and telecom security, including a use case on SMS blaster attacks and how organisations need to maintain transparency and accountability. Software security approaches across policy and practice were discussed, and the Cyber Resilience Act (CRA) was under the spotlight as industry prepares for its implementation.
The afternoon turned to cryptography and quantum readiness. Experts discussed post-quantum cryptography, crypto-agility and strategies for mitigating "harvest now, decrypt later" threats. ETSI quoted one speaker as saying that in security you do not need to be perfect, you just need to be on the right path.
Women in Cyber and a tribute to Issy Hall
One highlight of the second day was the "Women in Cyber" session, which began with a homage to Ms Issy Hall, who died at the age of 30 in September 2026. According to ETSI, she had been very active in its Cyber and Securing AI committees and was instrumental in building the conference programme, including this session. She also contributed to ETSI EN 304 223.
The session's key messages to women included understanding one's strengths and building self-confidence, remaining curious and not waiting until being 100% ready to move forward, bringing a colleague or peer into the community to add to the diversity of stakeholders, and staying creative.
Looking ahead to 2046
The final day opened with a keynote on education in standardisation, which ETSI called a key topic in cybersecurity today. It closed with sessions on AI security and resilience and a final session on the CRA.
David Boswarthinck, ETSI's Director of Strategy, said: "our challenge is not to predict 2046 but rather it is to make it open through global partnerships, trusted with security by design, proven with continued evidence, and accountable with human and machine oversight."
Presentations from all four days are available on the ETSI website for those who missed the event.
