Cloudfest 2026 Conference Review

The HackerSpace gets the security spotlight, but the main stage had several speakers directly relevant to anyone in cybersecurity.

• Radia Perlman (Fellow, Dell Technologies), the inventor of Spanning Tree Protocol, was a headline speaker. Her work on network resilience and trust is more relevant to modern cloud security architecture than most people in the room probably realized.
• David Cattler (Founder and Principal, Ironhelm Works), a former senior NATO intelligence official, brought a perspective on threat intelligence and geopolitical risk intersecting with cloud infrastructure that you rarely hear at infrastructure events. The room paid attention.
• Sebastian Schreiber (Managing Director, SySS GmbH), one of Germany’s most established penetration testing companies, brought a practitioner’s view of offensive security directly to the infrastructure provider audience.
• Brewster Kahle (Founder, Internet Archive) connected questions of digital preservation and institutional memory to the data integrity and sovereignty debates running through the Cybersecurity track.

Ralph Echemendia (The Ethical Hacker): Hacking Hollywood

Ralph is one of those people who can make a room genuinely uncomfortable in the best possible way. His point keeps getting ignored: the way security is portrayed publicly, in films, in board presentations, in vendor marketing, actively shapes how organizations hire, budget, and respond to real threats. The gap between the Hollywood version and operational reality isn’t just annoying; it’s dangerous. It creates board-level blind spots with real consequences.

Miriam Wiesner (Microsoft): MFA Is Not the Finish Line

This was the session people were still talking about at dinner. The title told you everything: “I’m in Your Browser, Eating Your Cookies (…and Bypassing Your MFA).”

Wiesner, Senior Security Research Program Manager at Microsoft, demonstrated live how browser-resident session tokens can be extracted and used to bypass MFA entirely, without ever touching the authentication mechanism itself. The auth worked perfectly. The attacker was already inside.

For hosting providers still leading with “we support MFA” as a security differentiator, this session was a direct challenge. Session management, token lifetimes, and browser security hygiene are now baseline expectations, not advanced features.

Pedro Conde & André Baptista (Ethiack): An AI That Hacks

The Hackian demo was the most forward-looking thing I saw all week. Ethiack built an AI agent that autonomously finds and exploits vulnerabilities. Not a scanner. An agent that reasons, adapts, and acts.

If offensive AI is already operational, periodic pen testing and annual threat modeling aren’t a security programme anymore. It’s a compliance ritual. The panel that followed made it worse: most production environments today run code that was partly written by AI, partly reviewed by humans, and deployed faster than either could be properly audited. AI attackers operating against AI-generated attack surfaces are a problem the industry is only beginning to confront.

Salvador Aguilar: Beyond Signatures

Aguilar said out loud what practitioners know but rarely tell customers: signature-based detection doesn’t work well enough for modern hosting threat environments. Behavioral intelligence, flagging meaningful deviations from what normal looks like, is where serious hosting security needs to move. It’s operationally complex at scale, but it’s no longer optional. Most of that 82% won’t be caught by signature matching.

Jesse & Reese Tuttle (AP2T Labs): Two Generations, One Room

I wasn’t sure what to expect from a father-and-daughter hacker keynote. Jesse Tuttle and Reese Tuttle from AP2T Labs delivered one of the better closing sessions I’ve attended at any event this year. The core message: the adversarial mindset hasn’t fundamentally changed across decades. The surface area has. Organizations that treat security as a rotation assignment rather than a craft will keep losing, not because of any single vulnerability, but because institutional security knowledge compounds, and those who don’t build it start from scratch every time.

A few things stood out from a security perspective across the 150+ official partners.

• WithSecure (formerly F-Secure Business) appeared as an official exhibiting partner. Endpoint protection and MDR are now actively targeting the cloud and hosting provider channel. A few years ago, dedicated security vendors didn’t treat CloudFest as a primary channel event. That has clearly changed.
• Patchstack sponsored the HackerSpace. Their focus on WordPress plugin vulnerability management and responsible disclosure is directly relevant to the hundreds of managed hosting providers and agencies in the room.
• Monarx had two speakers on stage: CEO Luke Langford and VP of Product Aaron Campbell. Web server malware detection at the hosting infrastructure layer is a real operational problem for shared and managed hosting providers, and Monarx is squarely positioned to fill that gap.
• Sectigo had two speakers: Director of Product Management Peter Roybal and Director of Sales Engineering Stephen Nyhan. Certificate management at hosting scale is an underappreciated security surface.
• CloudLinux and SySS GmbH were also present, reflecting ongoing conversations on kernel-level isolation and offensive security practices, respectively.

1. NIS2 Has Crossed from Legal Concern to Sales Filter

At CloudFest 2025, NIS2 was a compliance concern for the team. At CloudFest 2026, it was showing up in the first five minutes of enterprise sales conversations, before pricing, before technical considerations, before anything else.

Providers who have documented controls, incident notification procedures, and supplier risk assessments are advancing in deals. Those who haven’t are being filtered out before the commercial conversation starts. I watched a mid-sized European provider lose a meaningful enterprise deal specifically because their incident response documentation didn’t meet the buyer’s NIS2 audit requirements. This isn’t hypothetical anymore.

2. Sovereign AI Is a Product, Not a Pitch

Last year, private LLM deployments and data sovereignty were side meeting topics. This year, they were centre stage with real customers and case studies behind them.

The security story is non-negotiable: the value of sovereign AI infrastructure depends entirely on proving specific facts about where data lives, who can access it, how keys are managed, and the integrity of the inference environment. Providers who can’t put that in writing are losing Data Sovereignty track deals to those who can.

3. European Cloud Providers Are Winning on Compliance Credibility

The European cloud alternative story has been around since GDPR. What’s different now is that commercial execution is catching up. I spoke with multiple enterprise procurement contacts who had recently moved workloads to European providers, not because they were cheaper or faster, but because of the quality of NIS2 compliance documentation and willingness to make contractual security commitments in a framework their procurement teams actually understand.

4. DDoS, DNS Security, and AI Resilience Are Table Stakes

These are no longer differentiators. Providers who can’t document their DDoS mitigation architecture, DNS security posture, and AI workload hardening are being knocked out of enterprise procurement before pricing is even discussed. This threshold was crossed in the enterprise last year. It’s working down to mid-market now.

5. AI-Generated Code Security Is a Crisis Nobody Is Discussing Loudly Enough

The Hackian demo and the closing panel gave formal structure to something I had been hearing all week informally. Production environments are running code that was partly written by AI, partly reviewed by humans, and often deployed faster than either could be properly audited. If an autonomous hacking agent is already scanning that codebase for vulnerabilities, the exposure window is much shorter than most organizations are treating it as.

One Honest Criticism

The HackerSpace ran in parallel with several main stage sessions I wanted to attend. That scheduling conflict created genuine friction for people trying to get the full picture. For an event that’s now explicitly leaning into cybersecurity as a core track, the programme architecture should reflect that. The HackerSpace deserves better integration into the main schedule, not a parallel slot that forces a binary choice. That’s fixable, and I hope the organizers address it for 2027.

🔐 If you sell security solutions to cloud and hosting providers

CloudFest is now a qualified channel, not a nice-to-have. The appetite for NIS2 compliance tooling, behavioral intelligence platforms, and AI security at hosting scale is real and growing. Patchstack sponsored the HackerSpace; WithSecure, Monarx, and Sectigo were named partners. If you’re still treating this audience as secondary, you’re behind the curve.

🏢 If you’re a CISO buying cloud or hosting services

The 82% figure demands a supply chain response. Ask your providers for actual documentation: controls, evidence, incident-detection timelines, patch cadence, access-control architecture, and supplier risk assessments. NIS2 gives you a legal hook; use it. And if Miriam Wiesner’s session taught us anything, your providers’ “we support MFA” checkbox is worth a lot less than their session management and token rotation policies.

🔬 If you’re a security researcher or practitioner

The HackerSpace is worth your time. MFA bypass at the session layer, autonomous AI hacking agents, behavioral anomalies in shared hosting: these attack surfaces are live in production today, across infrastructure serving millions of sites. Research that reaches this audience gets deployed, not filed.

📋 If you work in policy or compliance

NIS2 is generating real operational pain for smaller European providers, and the risk is that it becomes a paperwork exercise rather than a genuine security improvement. The hosting industry is building practical implementation guidance through trade bodies and vendor coalitions right now. That guidance needs security depth to stay technically honest. The window to influence it is open, but not indefinitely.