Speed, governance and a changing landscape — Ramsés Gallego

\# Speed, governance and a changing landscape — Ramsés Gallego **Special: Live from CybersecNL — Episode 1 of 7** Recorded live at the Atos booth, CybersecNL 2026. Ramsés Gallego is Chief Technologist at DXC, ISACA Hall of Fame, and president of the ISACA Barcelona chapter. Hosted by Menno van der Horst with Quint Ketting. \## Timestamps 00:00 Welcome and introductions 00:42 Why DXC came to CybersecNL: detect more, respond faster 01:28 Rivals, never enemies — why competitors share a stage 02:24 The other side collaborates better than we do 04:28 What integrators owe their customers: service over technology 06:34 A second risk equation: means, motives, opportunities 07:32 Are our frameworks still fit for purpose? 08:29 COBIT 2019 is ageing, and ISACA's AI certification track 09:53 "The human in the loop is dead" — as a reflex, not as a role 10:35 Quantum: RSA, Diffie-Hellman and elliptic curve on the clock 11:55 The part nobody talks about: code signing and certificates 12:38 ISACA Quantum Pulse Poll — the skills gap in numbers 13:21 It is not IT you are protecting. It is the business. 14:01 Trucks that stop delivering, invoices quietly altered 15:02 Why risk has to come from the business, not only the CISO 16:26 Enterprise risk management: risk is always plural 17:22 Should we still be calling it cybersecurity at all? 18:17 Business continuity is not resilience 18:54 The positive side of risk 19:34 Why a car has brakes 20:22 Three pillars: identity, data, applications 21:51 Non-human identities and the 100-to-1 future 23:18 Governance is not management, and we need AI-natives \## Key takeaways \- The classic risk equation still holds, but means, motives and opportunities now sits next to it. AI has collapsed the cost of all three. \- Business first. Customers do not speak Kubernetes, they speak euros. The database was not hacked — the business was. \- Identity remains the cornerstone. Two of the three major incidents discussed on the CybersecNL main stage were identity related. \- Non-human identity is the governance problem of the next few years. Almost nobody can say how many agents they run, let alone which accounts sit behind them. \- Quantum is not only an encryption story. Code signing, certificates and anything that depends on keeping a secret are in scope. \- Brakes let you go fast. Security exists so the business can move, not so it can stop. \- Ramsés states that ISACA is already building COBIT 7, returning to a numbered release. Not independently confirmed at the time of publishing. \- The 10-to-1 non-human to human identity ratio, and the projected 100-to-1, are cited from industry statistics and not sourced on air. \- The 5-to-12-year window for cryptographically relevant quantum computing is Ramsés' own estimate. \- ISACA Quantum Pulse Poll figures (2,586 respondents, 67 percent expecting new skill requirements) are quoted from memory. \## Mentioned ISACA — https://www.isaca.org DXC Technology — https://dxc.com Quantum World Association The brakes analogy is credited to Art Wong. \## Also in this series Martin de Vries on sector differences and why we may need a NIST 3 — referenced in this episode, publishing 24 September. Aernout Reijmer on collaboration after ASML — publishing 29 September. \--- SecurityCafe. Powered by Atos.