Summary

This World Economic Forum panel discussion focused on the evolving landscape of cyber threats and the need for enhanced cybersecurity resilience in an increasingly interconnected world. The panel, moderated by Samir Saran, brought together leaders from Europol, telecommunications, financial services, and cybersecurity to examine how cyber risks are changing and what responses are needed.

Michelle Zatlyn from Cloudflare highlighted that cyber attacks are becoming “bigger and more,” with DDoS attack records being broken 25 times in 2025 and AI-powered bot impersonation increasing by 1400%. She noted a growing divide between well-protected organizations, particularly financial institutions, and vulnerable smaller enterprises that haven’t adopted modern security solutions. Catherine De Bolle from Europol described how the “DNA of crime” is changing, with criminals now treating data as a weapon following a “steal, deal and repeat” cycle, while organized crime groups are increasingly investing in in-house digital capabilities and AI tools.

Hatem Dowidar emphasized the shift from traditional criminal behavior to weaponized cybercrime involving state actors, particularly threatening critical infrastructure across multiple nations. Michael Miebach from Mastercard stressed that cybersecurity is now systemic, cutting across physical, geopolitical, and corporate domains, and argued that without trust in AI systems, their adoption will be limited. The panelists agreed that traditional law enforcement approaches are insufficient and that new forms of public-private partnerships are essential.

Key solutions discussed included moving from permission-based to trust-based security architectures, implementing zero-trust frameworks, improving threat intelligence sharing, and addressing supply chain vulnerabilities. The discussion concluded with calls for better workforce training, enhanced digital literacy, stronger identity systems, and treating cybersecurity as a fundamental business responsibility requiring board-level attention rather than just technical oversight.

Keypoints

Major Discussion Points:

– Evolving Cyber Threat Landscape: The panel discussed how cyber threats are becoming “bigger and more” with AI accelerating new attack types. DDoS attack records were broken 25 times in 2025, and AI bots impersonating humans increased by 1400%. The convergence of physical and digital threats, along with geopolitical tensions, is creating a more complex security environment.

– Digital Divide in Cybersecurity Preparedness: There’s a growing gap between organizations with modern cyber defenses (particularly financial institutions) and those still relying on legacy systems. Large corporations are generally better protected, while small businesses remain vulnerable as the “weakest link” that fraudsters target.

– Blurred Lines Between Criminal and State Actors: The weaponization of cyberspace by nation-states has complicated the threat landscape. Organized crime groups are hiring digital experts and investing in AI capabilities, while state actors use criminal groups as proxies, creating challenges for traditional law enforcement approaches.

– Need for Enhanced Public-Private Partnerships: The discussion emphasized that traditional law enforcement methods are insufficient for modern cyber threats. New collaborative models are emerging, including information sharing between law enforcement agencies like Europol and private sector companies, though legal and trust barriers still exist.

– Trust-Based Security Architecture and AI Agents: The conversation explored the transition from permission-based to trust-based security systems, particularly as AI agents become more prevalent. This includes implementing zero-trust architectures and developing guardian systems to monitor AI agent behavior within organizations.

Overall Purpose:

The discussion aimed to examine the current state of cybersecurity threats and resilience strategies, focusing on how leaders can adapt to an increasingly complex threat environment that combines traditional cybercrime, state-sponsored attacks, and emerging AI-powered threats. The panel sought to identify practical solutions and partnership models for protecting organizations and critical infrastructure.

Overall Tone:

The discussion maintained a serious but constructive tone throughout. While acknowledging the severity and complexity of current cyber threats, the panelists balanced concern with optimism about available solutions. The tone was collaborative and solution-oriented, with participants building on each other’s insights rather than debating. There was a sense of urgency about the need for action, but also confidence that with proper investment, partnerships, and modern defenses, organizations can effectively protect themselves against evolving threats.

Speakers

– Samir Saran: Moderator of the panel discussion

– Catherine De Bolle: Executive Director of Europol, speaking on international partnerships and criminal perspective on cybersecurity

– Michelle Zatlyn: Co-Founder and President of Cloudflare, working on keeping organizations safe from cyber threats

– Michael Miebach: Chief Executive Officer of MasterCard USA, part of the International Business Council, working on cyber resilience and cyber threats

– Hatem Dowidar: Group Chief Executive Officer, EN, from the UAE, bringing perspective from telecommunications and critical infrastructure management across 20 countries

– Audience:

Additional speakers:

– Dave: Chief Technology Officer for Pearson (the world’s largest learning company) – audience member who asked a question about AI agents and cybersecurity training

Comprehensive Report: World Economic Forum Panel Discussion on Cybersecurity Resilience

Executive Summary

This World Economic Forum WEF26 panel discussion, moderated by Samir Saran, brought together senior leaders from law enforcement, telecommunications, financial services, and cybersecurity to examine the rapidly evolving landscape of cyber threats and the urgent need for enhanced cybersecurity resilience. The panel featured Catherine De Bolle (Executive Director of Europol), Michelle Zatlyn (Co-Founder and President of Cloudflare), Michael Miebach (Chief Executive Officer of MasterCard USA), and Hatem Dowidar (Group Chief Executive Officer, EN, UAE).

As Saran noted in his opening remarks, the discussion was framed by findings from a global cybersecurity outlook report and focused on “convergence of real threats, physical threats, supply chain threats, digital threats, the geopolitical moment, the polarizations, the lack of international cooperation” and the struggle for “defining partnerships for the future that can keep up with technology.”

The discussion revealed a consensus amongst industry leaders that cyber threats have fundamentally transformed, becoming exponentially more sophisticated, frequent, and dangerous. The panellists agreed that traditional approaches to cybersecurity are insufficient and that new forms of collaboration between public and private sectors are essential for addressing these evolving challenges.

The Evolving Cyber Threat Landscape

Unprecedented Scale and Sophistication

Michelle Zatlyn opened the discussion by highlighting the dramatic escalation in cyber threats, noting that cyber attacks are becoming “bigger and more” with artificial intelligence serving as a significant accelerator. She presented striking statistics demonstrating this escalation: according to Zatlyn’s data, DDoS attack records were broken 25 times in what she referenced as 2025, and AI-powered bot impersonation increased by an extraordinary 1400%. These figures underscore the rapid evolution of the threat landscape and the role of AI in amplifying both the scale and sophistication of attacks.

Zatlyn also highlighted emerging insider threats, noting concerning examples of Iranian government employees working within organizations, demonstrating how traditional security perimeters are being compromised from within.

The Changing DNA of Crime

Catherine De Bolle provided a law enforcement perspective on this evolution, describing how “the DNA of crime is changing” through digitalisation. She introduced the concept of criminals following a “steal, deal and repeat” cycle, treating data not merely as a target but as a weapon in their operations. This fundamental shift represents a move from traditional one-off criminal activities to systematic, repeatable business models that leverage digital assets.

De Bolle explained that organised crime groups are increasingly investing in in-house digital capabilities and utilising AI tools to facilitate their business models. This professionalisation of cybercrime has created more sophisticated and persistent threats that require new approaches from law enforcement.

Convergence of Criminal and State Actors

The discussion revealed a particularly concerning development: the blurred lines between organised crime groups, non-state actors, and legitimate state operations. When Saran raised questions about the weaponisation of cyberspace by legitimate state actors, De Bolle provided detailed insights into this complex landscape.

“We see that the lines between state actors, non-state actors, organised crime groups are blurring,” De Bolle explained. She described how criminals might work for states during the day and launch independent attacks at night, creating a complex threat environment where traditional distinctions between different types of adversaries are becoming increasingly meaningless.

This convergence has necessitated new approaches to defense, requiring what De Bolle termed closer cooperation between “defense, police, and intelligence services” to address threats that span multiple domains and jurisdictions.

Hatem Dowidar emphasised the shift from traditional criminal behaviour to weaponised cybercrime involving state actors, particularly threatening critical infrastructure across multiple nations. This convergence has created what Michael Miebach characterised as fundamentally systemic threats, cutting across physical, geopolitical, societal, and corporate domains.

The Digital Divide in Cybersecurity Preparedness

The “Messy Middle” Problem

One of the most significant concerns raised during the discussion was the growing divide in cybersecurity preparedness between different types of organisations. Zatlyn identified what she termed a “separation of the field,” where some organisations—particularly financial institutions—have implemented modern defences and are well-protected, whilst others in the “messy middle” have not adopted modern solutions for various reasons.

This digital divide creates systemic vulnerabilities, as Miebach pointed out that small businesses, despite being the largest employers globally, often represent the “weakest link” that fraudsters specifically target. The challenge is particularly acute because these smaller organisations may lack the resources, expertise, or awareness necessary to implement adequate cybersecurity measures.

Implications for Systemic Security

The existence of this digital divide has implications beyond the individual organisations that are poorly protected. In an interconnected digital ecosystem, the security of the entire system is only as strong as its weakest components. This reality means that the cybersecurity challenges of small and medium-sized enterprises become everyone’s problem, as they can serve as entry points for attacks on larger, better-protected organisations through supply chain vulnerabilities.

Public-Private Partnership Solutions

Inadequacy of Traditional Approaches

There was unanimous agreement amongst the panellists that traditional law enforcement approaches are insufficient for addressing modern cyber threats. De Bolle explicitly stated that “traditional law enforcement activities are not sufficient anymore” and emphasised the need to explore new ways of working with the private sector.

Emerging Collaborative Models

The discussion highlighted several emerging models for public-private collaboration in cybersecurity. De Bolle described specific collaborative projects, including Europol’s “Asset” project, which demonstrates how information sharing between law enforcement agencies and private sector companies enables immediate protective actions. When law enforcement identifies new threats or attack patterns, they can quickly share this intelligence with private sector partners, allowing them to implement protective measures before attacks occur.

Miebach noted that despite broader geopolitical fragmentation, new partnership models are emerging in cybersecurity because cyber threats transcend national borders. He referenced MasterCard’s acquisition of “Record the Future,” a threat intelligence company, as an example of how private sector organisations are investing in enhanced threat detection capabilities. He also highlighted the development of cybersecurity centres that bring together private sector organisations and law enforcement agencies, though he acknowledged that these solutions tend to be pragmatic and localised rather than comprehensive global arrangements.

Dowidar provided concrete examples of successful collaboration models, describing the UAE’s national cybersecurity council that brings together government and private sector stakeholders. He also highlighted the role of international industry bodies like the GSMA security center for the telecommunications industry, which facilitates threat information sharing across the sector.

Challenges in Collaboration

Despite the recognised need for enhanced collaboration, the panellists acknowledged several barriers to effective public-private partnerships. These include legal constraints around information sharing, concerns about liability in litigious societies, and the need to balance transparency with operational security requirements.

Trust-Based Security Architecture and Zero-Trust Implementation

Transition from Permission-Based to Trust-Based Models

The discussion explored the fundamental shift from permission-based to trust-based security architectures. Zatlyn explained this transition using a practical analogy: traditional security was like having one key to your house, but modern zero-trust architecture requires verification at every access point, similar to having multiple locks and verification systems throughout a building.

Miebach elaborated on the zero-trust approach, explaining that it requires verification at every access point using multiple data signals for authentication. He noted that modern defences utilising AI and multiple data sources can provide high-probability transaction validation, enabling organisations to make real-time decisions about the legitimacy of activities within their systems.

Practical Implementation Challenges

The panellists discussed practical challenges in implementing zero-trust architectures, particularly in organisations with legacy systems and established workflows. The transition requires not only technical changes but also cultural shifts in how organisations think about access control and verification.

AI Agent Security Framework

Audience Engagement on AI Agent Challenges

A significant portion of the discussion was devoted to addressing questions from Dave Treat, CTO of Pearson, who raised important concerns about AI agent security. Treat asked how to create AI agents that are “inherently suspicious and not easily fooled by the same tactics that fool humans,” highlighting the unique challenges of securing autonomous AI systems.

Treating AI Agents as Workforce Extensions

The panellists quickly reached consensus that AI agents should be treated as extensions of the existing workforce, with the same zero-trust principles applied to their activities. Zatlyn advocated for treating AI agents like employees within existing security frameworks, noting that “we should treat agents like we treat employees” with appropriate access controls and monitoring.

Guardian Agent Architecture

Dowidar introduced the concept of hierarchical guardian agents that monitor AI agent behaviour, drawing parallels to human call monitoring systems in customer service environments. He explained that just as human agents are monitored for quality and compliance, AI agents require similar oversight mechanisms to ensure they operate within acceptable parameters.

This approach recognises that AI agents, like human employees, may make mistakes or be compromised, requiring systematic monitoring and intervention capabilities.

Integration with Existing Payment Systems

Miebach suggested that existing payment security frameworks could be extended to protect agentic commerce transactions, viewing AI agents as additional entities within current ecosystems rather than requiring entirely new security approaches. This perspective reflects a pragmatic approach to AI security that builds upon proven methodologies rather than starting from scratch.

Global Standards for AI Governance

De Bolle highlighted the need for worldwide standards for AI agent monitoring and governance that are accepted globally. This requirement reflects the international nature of both AI development and cyber threats, necessitating coordinated approaches to ensure consistent security standards across different jurisdictions and organisations.

Supply Chain Vulnerabilities and Third-Party Risks

Interconnected System Risks

The discussion identified supply chain vulnerabilities as representing major risks in increasingly interconnected systems. Zatlyn emphasised that third-party vulnerabilities can compromise even well-protected organisations, as attackers often target the weakest links in complex supply chains to gain access to their ultimate targets.

Contractual Security Standards

As a solution to supply chain risks, Zatlyn suggested that large organisations should insist on cybersecurity standards in contracts with third-party suppliers. This approach would help raise the overall security posture across supply chains by requiring smaller suppliers to meet minimum security requirements as a condition of doing business with larger, better-protected organisations.

Crown Jewels Protection and Nth-Degree Assessment

Miebach introduced the concept of identifying and protecting organisational “crown jewels” with what he termed “nth-degree supply chain security assessment.” This approach recognises that whilst organisations cannot apply maximum security to every aspect of their operations, they must identify their most critical assets and ensure these receive the highest levels of protection, including comprehensive assessment of all supply chain components that could affect these critical systems.

Dowidar emphasised that companies must prioritise security assessment of supply chains as a business prerequisite, noting that critical infrastructure requires intelligent networks that can monitor and isolate unusual behaviour before it spreads throughout interconnected systems.

Leadership and Workforce Development Challenges

Executive-Level Engagement

A recurring theme throughout the discussion was the need for cybersecurity to receive greater attention at board and C-suite levels. Zatlyn emphasised that cybersecurity must be treated as a business topic rather than merely a technical issue, requiring executives to develop personal expertise rather than delegating entirely to technical teams.

This perspective reflects the recognition that cybersecurity decisions have strategic business implications that extend far beyond technical considerations. When cybersecurity is viewed only as a technical concern, organisations may fail to allocate appropriate resources or make necessary strategic adjustments to address evolving threats.

Workforce Shortage Crisis

Miebach highlighted a massive cybersecurity workforce shortage, noting that there are over 700,000 unfilled cybersecurity positions in the United States alone. This shortage represents a critical constraint on organisations’ ability to implement and maintain effective cybersecurity programmes.

The workforce challenge extends beyond simply hiring cybersecurity professionals to include training existing employees on incident response procedures. Miebach noted that many organisations have security measures in place but their workforces are not prepared to respond effectively when attacks occur, often freezing during ransomware attacks rather than following established procedures.

Educational and Training Reform

De Bolle emphasised the need for investment in digital literacy and critical thinking skills for society as a shared responsibility. This perspective recognises that cybersecurity is not solely the responsibility of cybersecurity professionals but requires a digitally literate population that can recognise and respond appropriately to cyber threats.

Dave Treat from the audience criticised current cybersecurity training methods as ineffective, advocating for embedding security learning into daily workflows rather than conducting separate training sessions. This approach would make cybersecurity awareness a natural part of employees’ regular activities rather than an additional burden that may be ignored or forgotten.

Infrastructure and Identity Solutions

Global Identity Systems

Miebach identified the development of better global identity systems as fundamental infrastructure needed across both private and public sectors. He described the current situation as a “smorgasbord” of divergent identity solutions across the world, with too much fragmentation creating vulnerabilities that can be exploited by attackers.

Dowidar provided specific examples of identity verification technologies, highlighting SIM card technology and location-based verification systems that combine telecommunications and financial data to provide robust identity confirmation. These technologies demonstrate practical approaches to solving identity verification challenges in a mobile-first world.

Critical Infrastructure Protection

Dowidar, speaking from his experience managing telecommunications infrastructure across 20 countries, emphasised the need for intelligent networks that can monitor and isolate unusual behaviour. This capability is particularly important for critical infrastructure, where attacks can have cascading effects across multiple systems and potentially affect national security.

The protection of critical infrastructure requires not only technical measures but also coordination between different sectors and jurisdictions, as these systems often span multiple countries and involve numerous stakeholders with different security capabilities and requirements.

Trust as an Enabler of Innovation

AI Adoption and Trust

Miebach made a particularly insightful observation about the relationship between cybersecurity and innovation, noting that “if people don’t trust AI, they will not use it.” He reframed cybersecurity from a defensive necessity to an enabler of innovation and economic growth, arguing that without trust in AI systems, their adoption will be limited.

This perspective shifts the cybersecurity conversation from cost centre to value enabler, making it a strategic business imperative rather than just a technical requirement. If organisations cannot demonstrate that their AI systems are secure and trustworthy, they will struggle to realise the potential benefits of these technologies.

Building Trusted Technology Layers

The discussion emphasised the need to build trusted layers around new technologies from the outset rather than attempting to add security as an afterthought. This approach requires collaboration between technology developers, cybersecurity professionals, and business leaders to ensure that security considerations are integrated into the design and deployment of new systems.

Panelists’ Key Recommendations for Leaders

In response to Saran’s final question about “one big idea or one big investment that leaders need to be making now,” each panelist provided specific actionable advice:

Catherine De Bolle emphasised the need for investment in digital literacy and critical thinking skills as a shared societal responsibility, recognising that cybersecurity requires an educated and aware population.

Michelle Zatlyn advocated for treating cybersecurity as a business topic requiring executive-level expertise, moving beyond delegation to technical teams to direct leadership engagement.

Michael Miebach highlighted the critical need to address the massive cybersecurity workforce shortage, particularly the 700,000+ unfilled positions in the United States, as a fundamental constraint on organisational security capabilities.

Hatem Dowidar stressed the importance of intelligent network infrastructure that can monitor and isolate threats before they spread, particularly for critical infrastructure protection.

Areas of Strong Consensus

Threat Evolution Recognition

All panellists demonstrated remarkable consensus on the fundamental evolution of cyber threats. They agreed that attacks are becoming more sophisticated, frequent, and dangerous, with AI serving as a significant accelerator. This shared understanding provides a foundation for coordinated responses and policy development.

Partnership Necessity

There was universal agreement that traditional approaches are inadequate and that effective cybersecurity requires unprecedented collaboration between law enforcement, government agencies, and private sector organisations. This consensus spans technical, organisational, and policy dimensions, indicating maturity in the field’s strategic thinking.

AI Agent Integration

Despite the novelty of AI agents as business tools, the panellists quickly reached consensus that these systems should be integrated into existing security frameworks rather than requiring entirely new approaches. This agreement suggests that the cybersecurity community is developing pragmatic approaches to emerging technologies.

Workforce Development Priority

All speakers recognised the critical need for better cybersecurity education and training, though they focused on different aspects of the solution. This consensus on the importance of human capital development reflects an understanding that technology alone cannot solve cybersecurity challenges.

Unresolved Challenges and Future Considerations

Geopolitical Complexities

Despite the consensus on many technical and operational issues, the discussion revealed several unresolved challenges. The weaponisation of cyberspace by legitimate state actors creates complex situations where traditional good-versus-evil narratives break down. How to maintain cybersecurity cooperation whilst navigating geopolitical tensions remains an open question.

Scaling Solutions

Whilst the panellists agreed on the need to protect smaller organisations in the “messy middle,” practical solutions for scaling enterprise-level security to small businesses remain elusive. The resource constraints and expertise gaps that affect smaller organisations cannot be easily addressed through the collaborative mechanisms that work for larger enterprises.

Training Effectiveness

Although there was consensus on the need for better cybersecurity training, the most effective methods for delivering this training remain unclear. Traditional approaches are widely recognised as ineffective, but alternative methods that embed security awareness into daily workflows are still being developed and tested.

Global Standardisation

The need for global standards in areas such as identity systems and AI agent governance is clear, but the mechanisms for developing and implementing such standards in a fragmented geopolitical environment remain challenging.

Conclusion

This World Economic Forum panel discussion revealed a cybersecurity community that has developed a sophisticated understanding of the challenges facing organisations in an increasingly connected and threatened digital environment. The high level of consensus amongst leaders from different sectors and regions suggests that there is a shared foundation for coordinated action.

The discussion moved beyond traditional cybersecurity talking points to address fundamental questions about the role of cybersecurity in enabling innovation, the need for new forms of public-private collaboration, and the systemic nature of modern cyber threats. The panellists demonstrated an understanding that cybersecurity is not merely a technical challenge but a comprehensive business and societal issue that requires coordinated responses across multiple domains.

The substantive audience engagement, particularly around AI agent security, demonstrated the practical relevance of the discussion and the community’s ability to quickly develop consensus around emerging challenges. The panellists’ specific recommendations for immediate action provide concrete guidance for leaders seeking to improve their organisations’ cybersecurity posture.

However, the discussion also highlighted significant unresolved challenges, particularly around scaling solutions to protect smaller organisations, developing effective training methods, and navigating the complex geopolitical dimensions of cybersecurity. These challenges will require continued collaboration and innovation to address effectively.

The overall tone of the discussion was urgent but constructive, with panellists demonstrating confidence that with proper investment, partnerships, and modern defences, organisations can effectively protect themselves against evolving threats. This optimism, combined with a realistic assessment of the challenges ahead, provides a foundation for the continued development of cybersecurity capabilities and collaborative mechanisms.

The discussion’s emphasis on trust as an enabler of innovation, the need for executive-level engagement with cybersecurity issues, and the importance of treating AI agents as extensions of existing workforces provides practical guidance for organisations seeking to improve their cybersecurity posture whilst embracing new technologies. These insights reflect a mature understanding of cybersecurity as a strategic business enabler rather than merely a defensive necessity.

Agreement points

Cyber threats are escalating in scale, sophistication, and frequency

Speakers

– Michelle Zatlyn
– Catherine De Bolle
– Hatem Dowidar
– Michael Miebach

Arguments

Cyber attacks are becoming bigger, more frequent, and more sophisticated with AI acceleration

The DNA of crime is changing through digitalization, with criminals using ‘steal, deal and repeat’ approach to data

Cyber threats are expanding from organizational attacks to weaponized infrastructure attacks by state actors

Cyber threats are systemic and cut across physical, geopolitical, societal and corporate worlds

Summary

All speakers agree that cyber threats have fundamentally evolved, becoming more sophisticated, frequent, and dangerous. They recognize AI as an accelerating factor and acknowledge that threats now span multiple domains beyond traditional cybercrime.

Topics

Cybersecurity

Public-private partnerships are essential for effective cybersecurity

Speakers

– Catherine De Bolle
– Hatem Dowidar
– Michael Miebach

Arguments

Traditional law enforcement activities are insufficient; collaboration with private sector is essential

National coordination entities and international industry bodies facilitate threat information sharing

New partnership models are emerging despite geopolitical fragmentation, as cyber threats transcend borders

Summary

There is strong consensus that traditional approaches are inadequate and that effective cybersecurity requires collaboration between law enforcement, government agencies, and private sector organizations through information sharing and coordinated responses.

Topics

Cybersecurity

AI agents require similar security oversight as human employees

Speakers

– Michelle Zatlyn
– Hatem Dowidar
– Michael Miebach
– Audience

Arguments

AI agents should be treated as extensions of employee base with same zero-trust principles applied

AI agents require supervisory architecture similar to human agent monitoring systems

Existing payment security frameworks can be extended to protect agentic commerce transactions

AI agents need to be trained to be suspicious and not easily fooled like humans, requiring guardian agents for monitoring

Summary

All speakers agree that AI agents should be integrated into existing security frameworks with appropriate monitoring and oversight, treating them as extensions of the workforce rather than requiring entirely new security paradigms.

Topics

Cybersecurity

There is a significant divide in cybersecurity preparedness between organizations

Speakers

– Michelle Zatlyn
– Michael Miebach

Arguments

There’s a separation between organizations with modern defenses (like financial institutions) and those with legacy solutions

Small businesses are the weakest link and primary targets for fraudsters despite being the largest employers globally

Summary

Both speakers recognize a critical gap where well-resourced organizations (especially financial institutions) have strong defenses while smaller organizations remain vulnerable, creating systemic risks.

Topics

Cybersecurity

Investment in cybersecurity workforce and education is critical

Speakers

– Catherine De Bolle
– Michael Miebach
– Audience

Arguments

Investment in digital literacy and critical thinking skills for society is a shared responsibility

Massive cybersecurity workforce shortage requires capacity building initiatives

Current cybersecurity training methods are ineffective and need to be embedded into people’s daily workflows

Summary

There is consensus that current cybersecurity education and workforce development approaches are inadequate, requiring fundamental changes in how we train both cybersecurity professionals and general users.

Topics

Cybersecurity

Similar viewpoints

Both speakers recognize the convergence of state and criminal actors in cyberspace, where traditional distinctions between different types of threat actors are becoming increasingly blurred.

Speakers

– Catherine De Bolle
– Hatem Dowidar

Arguments

There are blurred lines between state actors, non-state actors, and criminal groups working together

Cyber threats are expanding from organizational attacks to weaponized infrastructure attacks by state actors

Topics

Cybersecurity

Both emphasize that cybersecurity must be elevated from a technical concern to a strategic business issue requiring executive leadership and sophisticated authentication approaches.

Speakers

– Michelle Zatlyn
– Michael Miebach

Arguments

Cybersecurity needs greater attention at board and C-suite level as a business topic, not just technical issue

Zero-trust approach requires verification at every access point with multiple data signals for authentication

Topics

Cybersecurity

Both advocate for breaking down traditional barriers between law enforcement and private sector to enable real-time threat intelligence sharing and coordinated responses.

Speakers

– Catherine De Bolle
– Michael Miebach

Arguments

Information sharing between law enforcement and private sector enables immediate protective actions

New partnership models are emerging despite geopolitical fragmentation, as cyber threats transcend borders

Topics

Cybersecurity

Unexpected consensus

Cybersecurity transcends geopolitical boundaries and enables cooperation despite broader fragmentation

Speakers

– Michael Miebach
– Catherine De Bolle
– Hatem Dowidar

Arguments

New partnership models are emerging despite geopolitical fragmentation, as cyber threats transcend borders

Traditional law enforcement activities are insufficient; collaboration with private sector is essential

National coordination entities and international industry bodies facilitate threat information sharing

Explanation

Despite the panel’s acknowledgment of increasing geopolitical tensions and fragmentation, there was unexpected consensus that cybersecurity creates a unique space for international cooperation because cyber threats don’t respect national borders, leading to pragmatic collaboration even among otherwise competing nations.

Topics

Cybersecurity

AI agents can be secured using existing security frameworks rather than requiring entirely new approaches

Speakers

– Michelle Zatlyn
– Michael Miebach
– Hatem Dowidar

Arguments

AI agents should be treated as extensions of employee base with same zero-trust principles applied

Existing payment security frameworks can be extended to protect agentic commerce transactions

AI agents require supervisory architecture similar to human agent monitoring systems

Explanation

Rather than viewing AI agents as requiring revolutionary new security approaches, there was unexpected consensus that existing security frameworks can be adapted and extended to cover AI agents, treating them as additional team members rather than fundamentally different entities.

Topics

Cybersecurity

Overall assessment

Summary

The panel demonstrated remarkably high consensus across all major cybersecurity challenges, from threat evolution to solution approaches. Key areas of agreement included the escalating nature of cyber threats, the necessity of public-private partnerships, the digital divide in preparedness, and the need for workforce development.

Consensus level

Very high consensus with no significant disagreements identified. This strong alignment suggests that cybersecurity professionals and leaders have developed a shared understanding of the challenges and necessary responses, which could facilitate coordinated action and policy development. The consensus spans technical, organizational, and policy dimensions, indicating maturity in the field’s strategic thinking.

Different viewpoints

Unexpected differences

Overall assessment

Summary

The discussion showed remarkable consensus among speakers on the fundamental challenges and solutions in cybersecurity, with no direct disagreements identified. All speakers acknowledged the evolving threat landscape, the need for public-private partnerships, and the importance of addressing AI agent security.

Disagreement level

Very low disagreement level. The speakers demonstrated strong alignment on core issues while offering complementary perspectives on implementation approaches. This high level of consensus suggests a mature understanding of cybersecurity challenges among industry leaders and law enforcement, though it may also indicate that more nuanced debates about trade-offs and priorities were not fully explored in this format. The lack of disagreement could be beneficial for coordinated action but might also suggest that some contentious issues around sovereignty, regulation, and resource allocation were not deeply examined.

Partial agreements

Similar viewpoints

Both speakers recognize the convergence of state and criminal actors in cyberspace, where traditional distinctions between different types of threat actors are becoming increasingly blurred.

Speakers

– Catherine De Bolle
– Hatem Dowidar

Arguments

There are blurred lines between state actors, non-state actors, and criminal groups working together

Cyber threats are expanding from organizational attacks to weaponized infrastructure attacks by state actors

Topics

Cybersecurity

Both emphasize that cybersecurity must be elevated from a technical concern to a strategic business issue requiring executive leadership and sophisticated authentication approaches.

Speakers

– Michelle Zatlyn
– Michael Miebach

Arguments

Cybersecurity needs greater attention at board and C-suite level as a business topic, not just technical issue

Zero-trust approach requires verification at every access point with multiple data signals for authentication

Topics

Cybersecurity

Both advocate for breaking down traditional barriers between law enforcement and private sector to enable real-time threat intelligence sharing and coordinated responses.

Speakers

– Catherine De Bolle
– Michael Miebach

Arguments

Information sharing between law enforcement and private sector enables immediate protective actions

New partnership models are emerging despite geopolitical fragmentation, as cyber threats transcend borders

Topics

Cybersecurity

Key takeaways

Cyber threats are becoming exponentially more sophisticated, frequent, and dangerous, with AI acceleration enabling new attack vectors like AI bot impersonation (up 1400%) and record-breaking DDoS attacks

A dangerous digital divide exists where organizations with modern defenses (especially financial institutions) are well-protected, while small businesses and those with legacy systems remain highly vulnerable as the weakest links

The convergence of organized crime, state actors, and cyber criminals has created blurred lines of responsibility, with criminals using ‘steal, deal and repeat’ data strategies and state actors weaponizing cyberspace for legitimate operations

Traditional law enforcement approaches are insufficient – success requires unprecedented public-private partnerships with real-time information sharing and coordinated response capabilities

Organizations must transition from permission-based to zero-trust security architectures, treating AI agents as extensions of their workforce with the same security protocols

Supply chain vulnerabilities represent critical systemic risks that require contractual security standards and comprehensive third-party risk assessment

Cybersecurity must be elevated from a technical issue to a board-level business priority, with CEOs developing personal expertise rather than delegating entirely to technical teams

Building societal resilience through digital literacy, critical thinking skills, and better global identity systems is essential infrastructure for the digital economy

Resolutions and action items

Large organizations should insist on cybersecurity standards in contracts with third-party suppliers to raise overall security posture across supply chains

Companies must implement AI agent monitoring systems with guardian agents and supervisory architectures similar to human agent oversight

Investment needed in cybersecurity workforce development to address massive shortage (700,000+ open positions in US alone)

Joint public-private initiatives should be established to develop better global identity systems as fundamental security infrastructure

Organizations should prioritize identifying and protecting their ‘crown jewels’ with nth-degree supply chain security assessment

Information sharing mechanisms between law enforcement and private sector should be expanded with legal protections to encourage participation

Training programs needed for workforce on incident response procedures to avoid freezing during ransomware attacks

Unresolved issues

How to effectively stop nation-states from weaponizing cyberspace while maintaining legitimate defensive capabilities

Balancing the need for information sharing with legal liability concerns in litigious societies

Developing global standards for AI agent security monitoring and governance

Addressing the fundamental tension between cybersecurity needs and geopolitical fragmentation

Scaling modern cybersecurity solutions to protect small businesses that cannot afford enterprise-level defenses

Creating effective training methods that go beyond traditional ‘pencils down’ cybersecurity education to embed learning in daily workflows

Establishing clear boundaries and coordination mechanisms between defense, police, and intelligence services in cyber operations

Suggested compromises

Pragmatic approach to partnerships – accepting that comprehensive global solutions are unrealistic, focus on regional ‘digital spheres’ with secured arrangements

Hybrid public-private coordination models where private sector provides innovation and technology while law enforcement provides authority and legal framework

Tiered security approach where organizations apply maximum security to critical assets (‘crown jewels’) while using standard protections for less critical systems

Extending existing security frameworks (like payment security) to new technologies (like agentic commerce) rather than building entirely new systems

Shared responsibility model where large organizations help raise security standards for smaller partners through contractual requirements and knowledge sharing

We call it in fact that the DNA of crime is changing and the DNA for us is a digitalization online that is making, that is the new crime area we need to work on. It’s nurtured online and it’s accelerated by AI… When we look at criminals now it’s a feature, it’s a weapon and how we describe the cycle of digital data it’s steal, deal and repeat.

Speaker

Catherine De Bolle

Reason

This comment reframes cybercrime from a static threat to an evolving ecosystem with its own lifecycle. The ‘steal, deal and repeat’ framework provides a clear conceptual model for understanding how cybercriminals operate differently in the digital age, treating data as a renewable weapon rather than a one-time target.

Impact

This shifted the conversation from discussing individual cyber threats to understanding cybercrime as a systematic, evolving business model. It established the foundation for later discussions about the convergence of organized crime and cyber operations, and influenced how other panelists framed their responses about the changing nature of threats.

If people don’t trust AI, they will not use it. So, this is not the defense side of this conversation, it’s the offense side of the conversation… If we don’t build in a trusted layer around these technologies, the use will not be there.

Speaker

Michael Miebach

Reason

This comment fundamentally reframes cybersecurity from a defensive necessity to an enabler of innovation and economic growth. It connects cybersecurity directly to AI adoption and business value, making it a strategic business imperative rather than just a technical requirement.

Impact

This perspective shift elevated the entire discussion from technical threat management to strategic business enablement. It influenced subsequent conversations about small business protection and the need for embedded security solutions, and helped establish cybersecurity as a prerequisite for digital transformation rather than an afterthought.

National governments and formal actors today are weaponizing cyberspace… How does this development, where now it is seen as a legitimate arena of contest, color the capabilities to keep businesses safe? Because now we are dealing in a real world, right?

Speaker

Samir Saran

Reason

This provocative question directly addresses the elephant in the room – that legitimate state actors are contributing to the weaponization of cyberspace. It challenges the traditional good guys vs. bad guys narrative and forces the panel to confront the complexity of operating in a domain where allies and adversaries use similar tactics.

Impact

This question created the most tension and depth in the discussion, forcing panelists to acknowledge the blurred lines between legitimate and illegitimate cyber activities. Catherine’s response about ‘blurred lines between state actors, non-state actors and criminal groups’ became a pivotal moment that shaped the conversation toward more nuanced solutions involving multi-stakeholder cooperation.

There’s a separation of the field and so there’s a group of organizations who have modern defenses and are in good positions but there’s kind of the messy middle where they haven’t quite adopted it for a bunch of reasons… and that is worrisome.

Speaker

Michelle Zatlyn

Reason

This observation identifies a critical vulnerability in the global cybersecurity ecosystem – the digital divide in security capabilities. It moves beyond technical solutions to highlight systemic inequalities that create weak links affecting everyone’s security.

Impact

This comment introduced the theme of cybersecurity inequality that ran throughout the discussion. It influenced Michael’s later emphasis on protecting small businesses as the ‘weakest link’ and shaped conversations about supply chain vulnerabilities and the need for collective defense mechanisms.

We need better identity. We generally need better identity… the smorgasbord that we have on identity solutions across the world… there’s too much divergence there, and that is a big building block in terms of somebody is behind any activity.

Speaker

Michael Miebach

Reason

This comment identifies identity as the fundamental building block for cybersecurity, cutting across all other technical solutions. It connects cybersecurity to broader issues of digital governance and international cooperation, suggesting that fragmented identity systems are a core vulnerability.

Impact

This insight tied together multiple threads from the discussion – from insider threats to agent supervision to cross-border cooperation. It provided a unifying framework for understanding why many cybersecurity challenges persist and influenced the conversation toward systemic solutions rather than point fixes.

The same way that people are using AI capability or agents for hacking or for bad action, we also have agents that are looking at new behavior or different behavior and isolating it early on to be able to protect the network.

Speaker

Hatem Dowidar

Reason

This comment introduces the concept of an ‘AI arms race’ in cybersecurity, where both attackers and defenders are leveraging the same technologies. It suggests that the solution isn’t to limit AI but to ensure defensive AI capabilities evolve as quickly as offensive ones.

Impact

This perspective influenced the later detailed discussion about AI agent supervision and guardrails. It helped frame AI not as a threat to be contained but as a tool to be properly managed, leading to practical discussions about monitoring systems and zero-trust architectures for AI agents.

Overall assessment

These key comments fundamentally elevated the discussion from a technical cybersecurity briefing to a strategic conversation about the future of digital society. The most impactful insights reframed cybersecurity as an enabler of innovation rather than just a defensive necessity, acknowledged the complex reality of state actors weaponizing cyberspace, and identified systemic vulnerabilities like the cybersecurity digital divide and fragmented identity systems. The conversation evolved from discussing individual threats to understanding cybersecurity as an ecosystem challenge requiring new forms of public-private cooperation, better identity infrastructure, and recognition that defensive capabilities must evolve as quickly as offensive ones. The panelists’ willingness to engage with provocative questions about state weaponization and systemic inequalities created a more honest and nuanced discussion that moved beyond typical cybersecurity talking points to address the fundamental challenges of securing an interconnected digital world.

How can different sorts of enterprises (big vs. small) better respond to the new age of cyber threats, particularly addressing the ‘messy middle’ of organizations that haven’t adopted modern solutions?

Speaker

Michelle Zatlyn

Explanation

Zatlyn identified a concerning divide where some organizations have modern defenses while others in the ‘messy middle’ haven’t adopted modern solutions and are vulnerable to attacks, often becoming emergencies on weekends when teams aren’t online.

How can law enforcement agencies better align with the private sector to make digital ecosystems safer for the future?

Speaker

Catherine De Bolle

Explanation

De Bolle emphasized that traditional law enforcement activities are not sufficient anymore and there’s a need to explore new ways of working together with private sectors to tackle evolving cyber crimes.

How should defense, police, and intelligence services work together to tackle the blurred lines between state actors, non-state actors, and criminal groups?

Speaker

Catherine De Bolle

Explanation

De Bolle noted the need to reflect on future collaboration models between different agencies while respecting boundaries, as traditional policing systems are insufficient for addressing sophisticated cyber threats involving multiple actor types.

How can organizations better manage cyber resilience when dependent on so many external parties for supply chain and third-party integrations?

Speaker

Samir Saran

Explanation

This addresses the critical vulnerability of supply chain security and third-party dependencies that organizations face, which was identified as a key challenge in maintaining secure systems.

What new forms of partnerships and arrangements are emerging in the cyber threat domain to respond to these challenges?

Speaker

Samir Saran

Explanation

Saran referenced emerging innovative systems like mini-laterals and public-private partnerships as potential solutions, seeking to understand what new collaborative models are developing in cybersecurity.

How can we create and tune AI agents to be inherently suspicious and not be fooled by the same tactics that fool humans?

Speaker

Dave Treat (Audience member)

Explanation

This addresses the critical challenge of securing AI agents in enterprise environments, particularly how to embed security awareness into AI systems and create guardian agents for monitoring.

How can we collectively share insights around creating guardian agents and establishing proper guardrails for AI agent supervision?

Speaker

Dave Treat (Audience member)

Explanation

This focuses on the need for industry collaboration in developing best practices for AI agent security and supervision, recognizing that this is a shared challenge requiring collective solutions.

How can we better address the human element in cybersecurity training, moving beyond traditional ‘pencils down’ training methods to embed learning into people’s daily lives?

Speaker

Dave Treat (Audience member)

Explanation

This addresses the fundamental challenge that current cybersecurity training methods are ineffective and there’s a need for more integrated, practical approaches to security awareness.

How can we develop worldwide standards for AI agent monitoring and governance that are accepted globally?

Speaker

Catherine De Bolle

Explanation

This addresses the need for international coordination and standardization in AI security practices, recognizing that cyber threats are global and require coordinated responses.

How can we build better identity solutions globally, moving beyond the current ‘smorgasbord’ of divergent identity systems?

Speaker

Michael Miebach

Explanation

Miebach identified the lack of consistent, robust identity solutions as a fundamental building block problem that needs joint public-private sector investment to solve.

How can we address the massive cybersecurity workforce shortage (700,000 open jobs in the US alone) and build necessary cyber capacity?

Speaker

Michael Miebach

Explanation

This addresses a critical resource constraint in cybersecurity defense capabilities, highlighting the need for workforce development and training programs.

How can we better prepare organizational workforces to respond effectively during actual cyber attacks, moving beyond just prevention to incident response training?

Speaker

Michael Miebach

Explanation

This addresses the gap between having security measures and actually knowing how to respond when attacks occur, particularly avoiding the tendency for people to freeze during ransomware attacks.