SecurityCafé

“Pull up a chair at the Security Café – your monthly deep dive into the hottest cybersecurity news and trends. Each episode brings you an inspiring guest and a story that will spark your imagination. Produced by Quint & Menno (Atos), this is where insights meet conversation. Don’t just stay informed—join the discussion!”

SecurityCafé is a news podcast hosted by Unknown Host, with 0 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Unknown Host hosts SecurityCafé, a news show with 0 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #11

  # Practice for the worst — Kelvin Rorive Live from CybersecNL — Episode 2 of 7

  Sep 16, 202624 minS3

  Recorded at the Atos booth, CybersecNL 2026. Kelvin Rorive is CISO at ICT Group and runs the Cyber Chain Resilience Consortium (CCRC), which prepares organisations and their suppliers to handle a crisis together. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Day one, and nobody is quite awake yet 01:12 Kelvin: CISO at ICT Group, and what CCRC does 02:05 Why this conference feels like a family reunion 03:09 The message at the booth: practice for the worst 03:34 Survivability — a word picked up from a Ukrainian speaker 04:03 Weerbaarheid, veerkracht, and a telco under drone attack 05:25 Fine for the top 10. What about everyone below? 06:09 "My IT manager will handle it" — and why he won't 07:00 Quint: I talk about business risk, not about cyber 08:31 Crisis in the chain: rehearse it with your supplier present 10:08 Exercises spill over into day-to-day cooperation 10:28 The factory that has to stop because the trucks don't come 12:02 One organisation escalates 1-2-3. The other runs it in reverse. 13:23 CEOs walking out of the room with a list 13:44 Putting the CEO in the hot seat, and not letting them delegate 15:11 What not to do: questionnaire bombardment, and AI filling them in 15:47 Know the CISOs of your critical suppliers personally 16:21 The security family, and why you don't abuse it 18:14 FI-ISAC: competitors around one table, one shared goal 19:41 Compliance is not security 20:11 An APT campaign where every control was green 20:42 NIS2, and whether Europe adapts fast enough 22:11 The balance is shifting from prevention to resilience 22:40 The most important word is not cyber. It is resilience. ## Key takeaways - Survivability sits one level beyond resilience. It starts from the assumption that everything can be broken: people, buildings, data, networks. - A cyber crisis gets handed to the IT manager and then escalates into a chain crisis long before anyone at board level notices. - A crisis exercise only tests the chain if your critical supplier is in the room. Mismatched escalation ladders, unclear responsibilities and missing contacts surface in minutes. - Supplier questionnaires are close to worthless now. They are answered by AI, approved unread, and can be manipulated with instructions hidden in the document. - What works instead is a real relationship with the CISOs of your critical suppliers, used sparingly enough that a call means something. - Compliance is the floor, not the ceiling. Green controls and a long-running intrusion coexist comfortably. - Preventive measures still matter, but the centre of gravity has moved to resilience. Assume something gets through and train the goalkeeper. ## Mentioned Cyber Chain Resilience Consortium — https://ccrc.nl ICT Group — https://ict.eu FI-ISAC, the financial sector information sharing community CybersecNL 2026 — https://www.cybersecnl.nl ## Also in this series Ramsés Gallego on speed and governance — out now. Martin de Vries on sector differences — publishing 24 September. --- SecurityCafe. Powered by Atos.

  ListenShow Notes
• 

  Episode #10

  Speed, governance and a changing landscape — Ramsés Gallego

  Sep 14, 202625 minS3

  # Speed, governance and a changing landscape — Ramsés Gallego Special: Live from CybersecNL — Episode 1 of 7 Recorded live at the Atos booth, CybersecNL 2026. Ramsés Gallego is Chief Technologist at DXC, ISACA Hall of Fame, and president of the ISACA Barcelona chapter. Hosted by Menno van der Horst with Quint Ketting. ## Timestamps 00:00 Welcome and introductions 00:42 Why DXC came to CybersecNL: detect more, respond faster 01:28 Rivals, never enemies — why competitors share a stage 02:24 The other side collaborates better than we do 04:28 What integrators owe their customers: service over technology 06:34 A second risk equation: means, motives, opportunities 07:32 Are our frameworks still fit for purpose? 08:29 COBIT 2019 is ageing, and ISACA's AI certification track 09:53 "The human in the loop is dead" — as a reflex, not as a role 10:35 Quantum: RSA, Diffie-Hellman and elliptic curve on the clock 11:55 The part nobody talks about: code signing and certificates 12:38 ISACA Quantum Pulse Poll — the skills gap in numbers 13:21 It is not IT you are protecting. It is the business. 14:01 Trucks that stop delivering, invoices quietly altered 15:02 Why risk has to come from the business, not only the CISO 16:26 Enterprise risk management: risk is always plural 17:22 Should we still be calling it cybersecurity at all? 18:17 Business continuity is not resilience 18:54 The positive side of risk 19:34 Why a car has brakes 20:22 Three pillars: identity, data, applications 21:51 Non-human identities and the 100-to-1 future 23:18 Governance is not management, and we need AI-natives ## Key takeaways - The classic risk equation still holds, but means, motives and opportunities now sits next to it. AI has collapsed the cost of all three. - Business first. Customers do not speak Kubernetes, they speak euros. The database was not hacked — the business was. - Identity remains the cornerstone. Two of the three major incidents discussed on the CybersecNL main stage were identity related. - Non-human identity is the governance problem of the next few years. Almost nobody can say how many agents they run, let alone which accounts sit behind them. - Quantum is not only an encryption story. Code signing, certificates and anything that depends on keeping a secret are in scope. - Brakes let you go fast. Security exists so the business can move, not so it can stop. - Ramsés states that ISACA is already building COBIT 7, returning to a numbered release. Not independently confirmed at the time of publishing. - The 10-to-1 non-human to human identity ratio, and the projected 100-to-1, are cited from industry statistics and not sourced on air. - The 5-to-12-year window for cryptographically relevant quantum computing is Ramsés' own estimate. - ISACA Quantum Pulse Poll figures (2,586 respondents, 67 percent expecting new skill requirements) are quoted from memory. ## Mentioned ISACA — https://www.isaca.org DXC Technology — https://dxc.com Quantum World Association The brakes analogy is credited to Art Wong. ## Also in this series Martin de Vries on sector differences and why we may need a NIST 3 — referenced in this episode, publishing 24 September. Aernout Reijmer on collaboration after ASML — publishing 29 September. --- SecurityCafe. Powered by Atos.

  ListenShow Notes
• 

  Episode #9

  "Sovereignty Is the Wrong Word": Digital Autonomy with Mika Lauhde

  Jul 22, 202642 minS3

  SecurityCafe — "Sovereignty Is the Wrong Word": Digital Autonomy with Mika Lauhde Hosts: Menno van der Horst & Quint Ketting Guest: Mika Lauhde, Luxembourg House of Cybersecurity ( linkedin.com/in/mika-lauhde-4270711 ) About this episode Mika Lauhde spent 30 years across Nokia, Huawei, and ENISA before landing at Luxembourg House of Cybersecurity, the national hub keeping Luxembourg's municipalities, SMEs, and economy cyber-resilient. His argument: Europe has the wrong word. Not "sovereignty" — hard borders around who owns what — but autonomy : acting independently while still sharing tools and trust. From GPS glitches during US foreign policy disputes, to Europe always getting the second-best tech (fighter jets included), to a national CERT running entirely on open source — this one covers a lot of ground. In this episode 00:11 — Welcome & Mika's background (Nokia, Huawei, ENISA, Luxembourg House of Cybersecurity) 02:08 — News: an integrator data-leak claim ("888") and what makes integrator breaches different 06:06 — Android's new developer certificate as a "kill switch," African nations building their own internet, UK VPN/age-verification rollout, an EU "tech sovereignty" proposal that leans on non-European hardware 09:11 — A US court ruling that may have quietly broken a GDPR assumption on data transfers 10:34 — NIS2 finally live in NL (15 Aug) — are our laws fast enough for machine-speed attacks? 19:20 — The "SplinterNet," and why Mika argues for shared autonomy over walled-garden sovereignty 23:46 — The Cyber Resilience Act's unprecedented recognition of open source (79 mentions) 24:19 — AI models as the new trade weapon — allies get the previous generation, like fighter jets 26:50 — The GPS/Galileo story, and SES's Iris² as Europe's answer to Starlink 30:15 — EU tax rules that quietly disadvantage open source; the Nokia N900 as Europe's "Sputnik moment" 33:00 — Luxembourg's national CERT runs entirely on open-source tools 34:40 — The call to action: a free open-source toolkit so any EU SME can stand up a cyber ops center 36:41 — What to read: Quint's, Mika's, and Menno's picks 41:04 — Wrap-up Key takeaways Autonomy, not sovereignty — sharing open standards beats walling off borders Dependency is invisible until it breaks — GPS glitches led to Galileo, now to Iris² New tech follows old patterns — AI models, like military hardware, come second-best to allies Open source is operational, not aspirational — Luxembourg's CERT proves it at national scale Mentioned Accenture leak claims (unconfirmed) · NIS2 (NL) · Cyber Resilience Act · European OSPO network · SES Iris² · Trump v. Slaughter ruling Reads: The Subtle Art of Not Giving a F ck* by Mark Manson ( markmanson.net/books/subtle-art ) · Max Schrems / noyb ( noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers ) · Bert Hubert's blog ( berthub.eu ) SecurityCafe is hosted by Menno van der Horst and Quint Ketting. Powered by Atos.

  ListenShow Notes
• 

  Episode #8

  AI Where It Matters, Not AI Everywhere — with Zeina Zakhour, Global Cyber CTO Atos/Eviden

  Jun 24, 202629 minS3

  AI Where It Matters, Not AI Everywhere — with Zeina Zakhour, Global CTO Cybersecurity at Eviden (Atos) Recorded live at CISO Day, this episode brings Menno van der Horst and co-host Quint Ketting together with Zeina Zakhour, Global CTO for Cybersecurity at Eviden (Atos), for a fast-moving conversation on where cyber is heading and what it really takes to keep up. We open with a sobering reality: many of today's threats are exposing weaknesses that have existed for decades. The panic isn't warranted — but action is. Zeina makes the case that the issue is rarely a lack of technology depth, but a lack of security depth: the basic hygiene and foundational controls that too many organisations still treat as something for "next year." Spoiler — next year is no longer an option. From there we get into the heart of it: — Adaptive, systemic resilience. Security can't be an afterthought bolted on once innovation ships. It has to sit at the core. We dig into why maturity built once and then left alone decays faster than most leaders expect. — Risk first, always. You don't secure a water utility the way you secure a hospital, a retailer or a bank. Every organisation has its own ecosystem and purpose — and that's where Eviden's Prepare, Respond, Adapt approach starts: understanding who you are, then keeping your risk picture live rather than buried in a spreadsheet updated once a year. — AI, agents and the new attack surface. Not "AI everywhere" — AI where the risk, the data and the friction justify it. We talk identity as the number one attack vector, the danger of human-led processes throttling machine-speed tooling, prompt and meta-prompt injection, agent goal drift, kill switches, and what "identity" even means for an autonomous agent that has intent, makes decisions and calls tools. — Chained vulnerabilities. Why "we'll only fix the high-severity CVEs" is the wrong instinct — low-severity issues can be chained into something genuinely exploitable, fast. — Sovereignty vs autonomy. A crucial distinction too many conflate. We get into data residency, technological sovereignty, the model/middleware/GPU reality of "sovereign AI" today, post-quantum, and why Europe can only answer these questions together rather than country by country. We close where good security conversations always seem to land: sharing more, building a bubble of trust, backing European innovation and startups, and staying agile enough to adapt as the ground keeps shifting. Zeina's recommendations: 📑 Atos Cyber Shield blog and Threat Research Center — regular, genuinely interesting analysis on new campaigns and malware variants. 📖 The Five People You Meet in Heaven by Mitch Albom — nothing to do with cyber, everything to do with being worth your time. 🎧 Listen now, and let us know your take in the comments. #SecurityCafe #Cybersecurity #CISO #AISecurity #Resilience #DigitalSovereignty

  ListenShow Notes
• 

  Episode #6

  Data is the New Uranium: Critical Infrastructure, CISOCommunity & AI with Dimitri van Zantvliet (NS)

  May 28, 202628 minS3

  <p>A SecurityCafe special, recorded live at CISOday 2026 with Dimitri van Zantvliet — CISO & Cybersecurity Director at Nederlandse Spoorwegen (NS), Chairman of the CISO Community NL and co-founder of CISOday. Host Menno van der Horst is joined by co-host Quint Ketting for a wide-ranging conversation on what it actually takes to defend critical infrastructure in a world where the geopolitical, technological and threat landscape is shifting faster than ever.</p><p>In this episode:</p><p>- Why CISOday and the CISO Community NL exist, and how community accelerates maturity across the sector</p><p>- Becoming a NIS1 critical entity in...

  ListenShow Notes

Recent guests on SecurityCafé. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.