Cyber Security Summit 2026 in Sarajevo will examine the practical security questions organizations face when a supplier, network device or critical digital service fails: what breaks, who decides, and how quickly can operations recover?

A serious cyber incident does not need to begin on an organization’s core network to interrupt its operations. A compromised supplier account, an exposed edge device or an outage at a cloud provider can be enough to cut off access to a critical application, delay a transaction or halt a production process.

Cyber Security Summit 2026

That is the operational reality behind “supply chain risk”. The issue is not simply whether an organization has deployed a firewall, endpoint protection or multi-factor authentication. It is whether it understands the dependencies that keep essential services running, has rehearsed the failure of those dependencies, and can recover without improvising under pressure.

ENISA’s 2026 Threat Landscape offers a useful measure of the problem. Of the targeted organizations in its dataset, 73% were classified as essential or important entities under NIS2. Public administration was the most targeted sector, accounting for 32% of cases. ENISA also identifies cyber dependencies, including third-party and supply-chain attacks, as a source of potentially large-scale and high-impact incidents; ransomware remained the incident type with the greatest short-term impact.

The sixth Cyber Security Summit, organized by the e-Transformacija Association, will take place on November 18–19, 2026 at the Hills Congress Center Sarajevo. Its program places these questions alongside post-quantum cryptography, AI-enabled threats, network security, data-center resilience and incident recovery.

Post-quantum readiness is a migration problem, not a future problem

Quantum computing is often presented as a distant concern. That framing is no longer adequate for organizations that hold information with a long confidentiality life: financial records, intellectual property, health data, identity data and strategically sensitive communications.

In August 2024, NIST finalized its first three post-quantum cryptography standards: FIPS 203 for key establishment and FIPS 204 and FIPS 205 for digital signatures. NIST has urged organizations to start the transition because a full migration across products, protocols and suppliers will take time.

The immediate concern is not that today’s widely used public-key cryptography has already been broken by a quantum computer. It has not. The concern is harvest now, decrypt later: an adversary may collect encrypted data now, retain it, and attempt to decrypt it once a cryptographically relevant quantum computer becomes available. For long-lived secrets, the exposure can begin long before the machine that makes decryption practical exists.

That makes the first step an inventory exercise, not a wholesale replacement program. Security leaders need to establish where cryptography is used, identify data that must remain confidential for years, and ask suppliers whether their products and services can support cryptographic agility. They should also plan the operational consequences of replacing certificates, key-management workflows, VPNs, signing mechanisms and embedded-device firmware.

The program includes a session, Quantum Is Coming: Can You Afford To Wait?, led by Srebrenko Šehić of LevelBlue. The organizer says the session will examine the quantum threat, the “harvest now, decrypt later” scenario and practical post-quantum options for existing systems.

Asset visibility is the beginning of resilience

For many teams, the more immediate challenge is simpler and harder: they do not have a reliable view of the systems they depend on. Hybrid environments combine on-premises infrastructure, cloud services, remote access, network appliances, APIs, SaaS platforms and third-party administration. A vulnerability cannot be prioritized sensibly if the organization cannot determine whether the affected asset is exposed, business-critical or even still in use.

That is why an asset inventory should be treated as an operational capability, not a compliance spreadsheet. It needs to link systems to business services, owners, privileged identities, data flows and recovery dependencies. Only then can a security team assess the full path from an exposed router or compromised identity to a material business interruption.

The summit agenda includes Damir Avdić’s session, Walls Won’t Save You: Router or Weapon?, and a panel on data-center security and resilience, from network architecture to post-attack recovery. These are useful prompts for a broader question: can a security program show how a control failure would propagate through the business, rather than merely report that a control exists?

AI will accelerate the attack cycle, but it does not remove accountability

AI is changing the economics of cyber operations. The UK National Cyber Security Centre assesses that, by 2027, AI-enabled tools will almost certainly make elements of intrusion operations more efficient and increase the frequency and intensity of cyber threats. It expects AI to enhance reconnaissance, vulnerability research, exploit development, social engineering and the processing of stolen data.

The important distinction is that this does not make fully autonomous, end-to-end advanced attacks inevitable in the near term. The NCSC judges them unlikely by 2027, while expecting skilled attackers to use AI-assisted automation to increase scale and evade detection. Human operators will remain part of the attack chain.

Defenders face a comparable discipline. AI can support alert triage, code review, anomaly detection and threat analysis, but it cannot compensate for weak identity controls, poor data governance or unclear incident authority. Where organizations deploy more autonomous AI agents, the NCSC recommends limiting their access to the resources required for a task, using sandboxing, maintaining logging and monitoring, and retaining meaningful human oversight.

Cyber Security Summit 2026 will address that strategic challenge through Ilijana Vavan’s session, Redefining Resilience: Cybersecurity Strategy in an AI-Driven World. Dr Emir Vajzović is scheduled to examine the capability gap between formal credentials and the practical skills needed to work effectively in an AI-shaped environment.

The questions security leaders should be able to answer

The most useful outcome from a conference discussion is not another list of tools. It is a sharper set of decisions for boards, executives and security leaders: Which services, suppliers and identities could interrupt our most important business processes? How quickly would we detect a compromise, contain it and restore a priority service? Which encrypted data must remain confidential long enough to justify post-quantum migration planning now? Where does AI have authority to act, and where must a person approve or stop it? Have our recovery plans been tested against the failure of a third party, rather than only against an internal outage?

Those questions are as relevant to public institutions and critical-infrastructure operators as they are to banks, manufacturers and technology companies. The difficult work is not selecting the next security product. It is building an operating model that connects technology controls with accountable decisions, tested recovery and the dependencies that actually sustain a business.

For the Western Balkans, that is the practical resilience challenge: not preventing every intrusion, but ensuring that one compromise does not become a prolonged operational crisis.

More information and the current program are available from the Cyber Security Summit 2026 website.