You will be breached. What matters is what happens next.

NIC 2026 SPEAKER SERIES "5 questions with"

Ahead of NIC 2026, we're sitting down with some of the practitioners leading sessions this October, the same five questions, put to people who spend their working lives in the trenches rather than on a stage. First up: Hasain Alshakarti, Principal Cybersecurity Advisor at Truesec, and co-lead of this year's Breaking the Kill Chain masterclass.

What do you believe that most of your peers would disagree with?

Most of the industry still treats prevention, stopping every attack with better tooling, as the goal. I don't. Breaches are inevitable. The real measure of security is how well an organization withstands an attack, recovers, and keeps operating. Resilience and recovery matter more than preventing every possible compromise.

What do teams still accept as normal, even though it creates unnecessary risk?

Keeping legacy systems alive well past their intended lifespan. Organizations hang onto outdated systems because someone might still need old data, or because a migration never quite finished. It feels like a practical compromise, but it expands your attack surface, raises maintenance costs, and leaves you running systems nobody's patching anymore. Modernization, archiving, and decommissioning aren't optional extras, they're part of a resilient security strategy.

When did something last go wrong that genuinely surprised you, and what changed afterwards?

A developer trying to locate a single Arduino device on the network used an AI-recommended scanning tool, and it triggered network-wide activity across multiple regions before anyone realized what was happening. It became a real security incident, and a clear reminder that AI can push an action well beyond its intended scope the moment appropriate controls aren't in place. Afterwards, the organization added stronger guardrails: better network segmentation, more monitoring, and real governance over how diagnostic and security tools get used.

What is one thing someone can change on Monday morning without waiting for a project, budget, or permission?

Turn on logging. It doesn't need a dedicated project, special permissions, or real budget, start by storing logs locally and making sure they're part of your routine backups. Even that basic step gives you real visibility and preserves evidence you'll be glad to have during an investigation, a recovery effort, or just making a fast decision mid-incident.

What will people experience at NIC that they cannot get from a blog post or webinar?

A direct line to people solving these problems for a living, not a summary of them. You get practical insight and firsthand experience through an actual conversation, in person, with someone who's been in the room when it went wrong. No algorithms, no auto-generated answers, just expert perspectives, real conversations, and a hundred percent AI-free learning.

Hasain is co-leading Breaking the Kill Chain: A Gamified Cyber Incident Recovery Masterclass at NIC 2026 on October 13, a full day inside a simulated enterprise breach, built with Truesec colleagues Mikael Nyström and Viktor Hedberg. He's also back on the main stage twice: Gone in 180 Minutes: From Social Engineering to Domain Dominance with Viktor Hedberg on Wednesday at 11:20am (Room 6), and Tales from Incident Response: "It's Probably Nothing" (Until It Is) with Mikael Nyström on Thursday at 11:10am (Room 1).

‍

Nordic IT organisations are being hit simultaneously by the AI Act, NIS2, DORA, cloud sovereignty requirements, and a board that wants AI yesterday. The people being asked to make sense of all of it are infrastructure architects and security engineers. This is not what they signed up for.

Oslo, June 2026

There's a meeting happening in organisations across Norway right now. It's usually called something like "AI governance working group" or "digital sovereignty task force." In the room: someone from legal, someone from IT, someone from the business, and one increasingly anxious infrastructure architect who has just realised that the policies being discussed will land on their plate to implement.

Welcome to 2026.

The convergence no one planned for

The Nordic compliance picture this year is unlike anything that came before it - not because any single regulation is new, but because of what's arriving at the same time.

"The Nordics face a unique situation, with major compliance requirements such as the AI Act, NIS2, GDPR, and ISO 42001 all taking effect simultaneously. Yet many organisations still approach these frameworks as separate systems, which only adds to costs and complexity." - Twoday, Nordic AI Governance in 2026, February 2026

NIS2 is no longer coming - it's here. Denmark reached full compliance in July 2025. Finland has seven sector-specific authorities enforcing it. Sweden's Cybersäkerhetslagen entered force on 15 January 2026, and is widely regarded as one of the most comprehensive NIS2 implementations in Europe. Norway is targeting AI Act implementation for summer 2026.

At the same time, the broader wave of EU digital regulation is breaking. DORA applies to the financial sector from January 2025. The bulk of the EU AI Act obligations for high-risk systems land on 2 August 2026. The Cyber Resilience Act starts reporting requirements in September 2026. Seven overlapping frameworks, all live within roughly the same eighteen months.

The fines for getting it wrong are not abstract. Under NIS2, essential entities face penalties of up to €10 million or 2% of global annual turnover - and in serious cases, management can face personal liability and temporary bans from holding leadership functions.

The analysts have been watching

Deloitte's State of AI in the Nordics 2026 report - drawn from interviews with 170 senior executives across Denmark, Finland, Norway, and Sweden - paints a specific picture of where organisations stand:

55% feel prepared on infrastructure. Strategic preparedness: down to 43%. Talent preparedness: just 14%. - Deloitte, State of AI in the Nordics 2026

Read that again. Technical readiness is relatively strong. Strategic and talent readiness has collapsed.
That gap - between the capability to build things and the organisational capacity to govern them - is where the real risk lives right now. And it's not a leadership problem or a legal problem in isolation. It's an infrastructure problem. Because governance only has teeth when it's implemented, and implementation is infrastructure.

The sovereignty question is no longer abstract

Data sovereignty was a policy discussion two years ago. Today it's an architecture decision.
Where does this AI workload run? Which jurisdictions does that data touch? Who has legal access to it under what circumstances? If the model is hosted by a hyperscaler, what does that mean for NIS2 obligations? If the pipeline processes data under GDPR, what happens when it passes through a model you don't fully control?
These aren't questions a CTO can answer alone. They require someone who understands the architecture deeply enough to trace the data flows, the dependencies, the points of exposure.
Norway is better positioned than most to build answers to these questions. Significant data centre investment is underway - Statnett and regional grid provider Fagne are both building new substations to support expansion.

"The Nordics are proving increasingly well-positioned. The appeal is becoming increasingly practical rather than aspirational." - Techerati, Nordic Data Centres Move From Ambition to Execution, May 2026

But infrastructure advantage only translates into compliance advantage if the organisations consuming that infrastructure know how to leverage it. Right now, many don't.

The AI layer makes everything harder

Before AI, compliance had a relatively bounded scope. Data sat somewhere. It moved through defined systems. You could map it, audit it, demonstrate control over it.

AI breaks that model.

Netsecurity, who works directly with Norwegian critical infrastructure clients, was direct about the threat landscape shift:

"The upcoming NIS2 directive will extend requirements to more sectors and introduce significant sanctions for non-compliance. But the legislation describes minimum requirements, not sufficient protection. Businesses that only aim for compliance are already lagging behind in the face of a threat landscape that is evolving faster than the regulations." - Netsecurity, AI-driven cyberthreats to critical infrastructure, 2026

When an AI model processes queries about your systems, makes decisions inside your infrastructure, or interacts with your identity stack, the compliance surface area expands in ways that are genuinely new. The question of whether an AI-assisted incident response process satisfies NIS2's 24-hour early warning requirement, for instance, isn't a question that most legal teams or most infrastructure teams can answer alone. It requires both.

The organisations navigating this well are the ones treating AI governance as an infrastructure problem, not a policy problem - because that's ultimately where it lands.

The governance gap has a name now

The World Economic Forum put a frame on it earlier this year that cuts through a lot of noise:

"When AI becomes embodied, governance becomes infrastructure. AI governance - rather than raw technical capability - has become the decisive factor." - World Economic Forum, February 2026

That's the shift. Governance isn't a layer you add on top of infrastructure. In 2026, it is infrastructure. The people who design, build, and run these systems are the people being asked to make governance real - whether they were trained for it or not.

Jeffrey Snover - who spent thirty years building the infrastructure the industry runs on, and who now works on AI governance at Harvard's Berkman Klein Center - framed the operational challenge directly ahead of NIC 2026:

"AI is changing both what's possible and the effort required to reach what's possible - and those goalposts move every quarter. We need to be honest about that, hold our beliefs loosely, and share best practices for the balance that matters most: delivering results today while continually figuring out how AI can help us deliver them better." - Jeffrey Snover, NIC 2026 Keynote Speaker

The conversation that needs to happen

There is good thinking happening across the Nordic IT community right now, on both sides of this problem: people who have worked through what the regulations demand in practice, and people who have built infrastructure to support those demands. The problem is that those two groups aren't always in the same room.

That's the conversation NIC 2026 is designed to enable. Not sessions walking you through regulatory text you can read yourself. Practical, honest exchanges between people who have had to figure out what NIS2 actually means for their monitoring architecture, what cloud sovereignty requirements mean when you're making a hybrid architecture decision under budget pressure, and where AI governance policy meets the production system.

The frameworks are here. The questions are real. The people with the answers are, mostly, practitioners who've been working through it themselves.

October is the best time to find them all in one room.

The infrastructure professional of 2026 is being asked to do something they were never hired to do: supervise machines that are starting to do their job for them. That shift is happening now, faster than any org chart has caught up with.‍

Oslo, June 2026

There's a conversation happening in IT departments across Norway and the Nordics right now. It usually starts quietly - someone notices that a vendor has embedded an AI agent into the monitoring stack, or that an automation tool has started making decisions it used to ask a human about. Then someone asks the obvious question: who owns this?
No one raises their hand.
That's not a staffing failure. It's a structural one. The role of the infrastructure professional is changing in real time, but the job descriptions, the org charts, and the training programmes are still catching up to a world that moved on without them.‍

‍
What's actually shifting

For the last decade, automation in IT has largely meant taking things a human used to do manually and making them faster and more repeatable. Scripts, runbooks, pipelines. The human was still in the loop - designing the automation, reviewing the output, making the call.
What's different now is the nature of the agent.
AI agents in 2026 aren't just running pre-defined playbooks. They're detecting anomalies, correlating root causes, suggesting and in some environments autonomously executing remediation - without a human in the loop at all. The numbers back it up.

"By 2029, 70% of enterprises will deploy agentic AI as part of IT infrastructure operations - up from less than 5% in 2025." - Gartner, Predicts 2026: AI Agents Will Transform IT Infrastructure and Operations

That isn't a distant horizon. It's four years. And the early movement is already visible in production environments today.
The infrastructure engineer who spends their days configuring, monitoring, and responding is becoming the professional who defines what the agent should do, what it should never do - and who takes accountability when the agent gets it wrong. That's a fundamentally different job. And it requires a fundamentally different set of skills.‍

‍
The gap between the demo and the production environment

If you've sat through a vendor briefing in the last twelve months, you've seen the demo. The AI catches the incident before the pager fires. The agent patches the vulnerability while the engineer is still drinking their morning coffee. The remediation loop closes in seconds instead of hours.
Some of that is real. But the gap between the demo environment and a production system - with its legacy dependencies, political constraints, security requirements, and blast radius considerations - is where the real work happens.
The industry is feeling that gap acutely. A recent KPMG pulse survey found that 65% of organisations cite agentic system complexity as their top barrier to deployment, for two consecutive quarters. In the same period, the share reporting a lack of organisational infrastructure as a blocker more than tripled.

"AI agents are beginning to be deployed in today's I&O organisations. It is crucial for heads of I&O to assess not only their benefits, but to also remain aware of their continuing challenges to ensure safe and successful production implementations." - Gartner, December 2025

The honest questions that get asked in production, not in demos: What does this agent have access to? How do you audit what it did and why? If it remediates the wrong thing, who carries that? Where does the agent stop and the human start - and who decided that?
These aren't questions a vendor whitepaper answers. They're questions practitioners work out in production, over time, often the hard way.‍

‍
The skills gap is real - and it's landing on infrastructure teams

Here's a number that should land hard:
94% of engineering leaders now report critical gaps in agentic AI expertise in their organisations. (Industry survey, Interview Kickstart, 2026)  
Around a third say those shortages are affecting between 40 and 60 percent of the roles they need filled. This isn't a future problem. Organisations are hiring for it now - and struggling.

"86% of organisations expect significant changes to job roles and responsibilities within the next year. 75% are expanding hiring for AI-focused positions even as they reduce headcount in traditional technical roles." - Interview Kickstart industry survey, 2026

That last sentence deserves a pause. The reduction isn't because the work is disappearing - it's because the shape of the work is changing. The infrastructure engineers who will thrive are the ones who can answer the new questions:

• What governance model makes sense for an AI agent operating in our environment?
• How do we define acceptable autonomy - and what requires human sign-off?
• How does an AI agent in the ops stack interact with our identity infrastructure? Our security posture?
• Who trains it, who monitors it, and who pulls the plug?

These aren't theoretical questions. They're operational ones. And the people best positioned to answer them aren't consultants or AI researchers - they're the practitioners who've been running this infrastructure for years and understand what's at stake when it breaks.
The role that's emerging

"AI agents will proliferate in 2026 and play a bigger role in daily work, acting more like teammates than tools. Building trust in them will be essential - starting with security." - Vasu Jakkal, VP Security, Microsoft

That framing - trust, starting with security - is exactly the lens an infrastructure team brings. Not blind adoption. Not refusal. Informed, sceptical, responsible integration.

"These digital agents will enable IT professionals to focus on defining service expectations, policy, and business intent - delivering a more seamless and efficient experience for their organisations." - Cisco, How AI Will Transform the Workplace in 2026

Defining expectations. Setting policy. That's not a diminished role - it's an expanded one. But it asks for different muscles than most people in infrastructure have had to develop until now.

Why this conversation belongs at NIC

NIC has always been built around one premise: the people in the room know things that the slides don't say. Practitioners who've made the calls, lived with the consequences, and learned things you can't read in a vendor report.
This October in Oslo, that conversation has a new edge to it.
We're not gathering to discuss whether AI is changing infrastructure work. It is. We're gathering to work out how - what the transition actually looks like in practice, what mistakes have already been made, and what the people who've navigated it well did differently.
The session that tells you what an AI agent did in their environment and why it went wrong is worth more than ten sessions explaining what AI agents theoretically can do.
That's the kind of content NIC is built for. And in a year when everyone has an opinion about AI in IT, the most useful place to be in October is Oslo.