Cybersecurity Is Everyone’s Business. In 2026, Resilience Is the Real Test.
From operational technology security to AI, digital sovereignty and business continuity: two editions of Cybersec Netherlands reveal how cybersecurity has moved from a technical concern to a boardroom and operations priority.
Original conceptual illustration · no third-party event photography
2025 put the spotlight on operational technology and shared responsibility. 2026 broadened the discussion to AI, sovereignty and resilience. The common denominator is clear: cyber risk now affects production continuity, customer trust and the ability to operate—not only IT systems.
Two editions. One decisive shift.
Cybersec Netherlands brought the Dutch and international cybersecurity community together at Jaarbeurs Utrecht in both 2025 and 2026. Read together, the programmes show how the discussion has matured.
Make OT security visible
The Merlyn 2025 recap emphasised the OT Security Dome, IT–OT convergence, cloud sovereignty, specialist skills and the need for shared organisational responsibility.
Build resilience across the business
Held on 9–10 September, the 2026 edition highlighted AI, digital sovereignty, evolving threats and stronger cooperation across industry, government and knowledge institutions.
These are not competing priorities. They form a sequence: understand where digital dependencies and industrial exposures sit, then build the governance and practical recovery capability to withstand disruption.
What industrial leaders should take away
OT protection is business continuity
Networks, PLCs, historians, MES and remote vendor access are part of an operating system. A security incident can become downtime, safety exposure or delivery disruption.
AI changes both sides of the equation
Automation can support detection and analysis, while expanding exposure through new tools, data flows and supplier dependencies. Controls and accountability must keep pace.
Know which dependencies matter
Cloud hosting, software providers, identity systems and external maintenance partners can be operational single points of failure. Resilience requires visibility, portability and fallback options.
Cyber resilience is cross-functional
Boards, operations, IT, engineering, procurement and people teams need common priorities, clear incident roles and exercises that reflect real production constraints.
The most relevant cybersecurity question for an industrial business is no longer only “Can we prevent an attack?” It is also “Can we continue and recover when something fails?”
From the SOC to the shop floor
Industrial environments introduce conditions that conventional office-IT security programmes may miss: legacy equipment, limited maintenance windows, long-lived controllers, third-party access and strict availability requirements.
Protect the process—not just the endpoint
- Map dependencies: assets, data flows, plant networks, control systems and supplier connections.
- Segment thoughtfully: separate critical production zones from business IT and govern remote access.
- Secure identities: apply appropriate access controls and strong authentication wherever technically feasible.
- Test recovery: validate backups, restoration steps and safe restart procedures with operations teams.
- Rehearse decisions: know who can isolate systems, halt production and communicate with customers.
The original 2025 Merlyn article stressed the importance of specialised OT expertise. That concern remains relevant: IT security methods should be adapted to the physical process, with engineering and safety teams involved.
AI and digital sovereignty need operational answers
Cybersec Netherlands 2026 placed AI and digital sovereignty prominently on the agenda. For companies, this should translate into concrete decisions rather than abstract debates about technology ownership.
Evaluate where sensitive production or customer data is stored, which providers can access it, how identities are controlled, and what happens when a critical platform or integration becomes unavailable. Assess AI tools not only for benefits, but also for data handling, approval paths, model access and human oversight.
Digital sovereignty does not necessarily mean replacing every external provider. It means understanding concentration risk, contractual dependencies and viable alternatives before a disruption occurs.
A practical 90-day resilience agenda
Use the momentum from Cybersec Netherlands and European Cybersecurity Month 2026 to turn awareness into measurable improvement.
-
Days 1–15 — Identify critical operations.Agree on the processes that cannot fail, map their digital dependencies and name accountable business owners.
-
Days 16–30 — Review exposure.Assess IT–OT boundaries, remote vendor access, identity controls, cloud concentration and basic security hygiene.
-
Days 31–60 — Reduce priority risks.Address the highest-impact gaps, validate restoration procedures and define vendor escalation routes.
-
Days 61–90 — Exercise and improve.Run a realistic cross-functional incident scenario, test recovery assumptions and assign owners to the next actions.
Effective governance pairs technical controls with incident response capability and executive decisions. For organisations subject to EU cybersecurity regulation, legal applicability and obligations should be assessed individually rather than assumed from an industry label.
Resilience is a management capability
Cybersecurity cannot be delegated to a single specialist team. In manufacturing, logistics and supply chains, it affects the stability of operations, the reliability of digital systems and the confidence of customers and partners.
Merlyn Consult’s perspective is to connect business strategy, operational processes and technology decisions. That means giving leadership a clear view of exposure, choosing proportionate improvements and ensuring the organisation can respond when disruption crosses departmental boundaries.
The lesson from 2025 and 2026 is consistent: cybersecurity is everyone’s business—and resilience is how that responsibility becomes operational.
Event background and further reading
This article is an original Merlyn editorial synthesis of publicly available event coverage. It does not reproduce conference photography, promotional artwork or extended third-party quotations, and it does not imply that Merlyn organised, sponsored or attended either edition.
- Merlyn Consult — Cybersecurity Is Everyone’s Business (2025) · background on OT, sovereignty and shared responsibility.
- Royal Dutch Jaarbeurs — Cybersec Netherlands 2026 · event dates and location.
- Royal Dutch Jaarbeurs — 2026 event retrospective (17 September 2026) · AI, digital sovereignty, collaboration.
- Cybersec Netherlands — official event website · 2026 retrospective and 2027 dates.
- ENISA — European Cybersecurity Month · broader October awareness programme.
Editorial note: descriptions of 2025 are attributed to Merlyn’s earlier article; descriptions of 2026 are based on organiser publications. The 90-day agenda is Merlyn’s practical recommendation, not an official event programme.
Turn cyber awareness into operational resilience.
Explore how business processes, supplier dependencies and technology decisions can strengthen continuity.