Date

22.04.26 - 23.04.26

Location

Radisson Blu Scandinavia Hotel
Holbergs gate 30
0166 Oslo

Map

Program (the program is subject to change)

  • 09:00

    Registration & Coffee

  • 10:00

    Welcome

    Karin Sundsvik | NFEA

  • Chair: Øystein Brekke-Sanderud | NORMA Cyber

  • 10:15

    KEYNOTE

    Independent security and regulatory advisor for the Critical Infrastructure and Key Resource sectors

    Patrick Miller | Ampyx Cyber

  • 11:00

    Today's threat landscape for our facilities

    Marianne Mangersnes | Equinor ASA

  • 11:30

    Lunch

  • 12:30

    Elevating OT Security: Unifying Logging, Visibility, and Detections

    James Young & Camille Felx Leduc | Mandiant

  • 13:00

    Is That Supposed to be There? - From OT Newcomer to Threat Hunter

    Kevin Widlund | Truesec

  • 13:30

    Break - Meet companies in the exhibition area for networking

  • Chair: Trond Kvamme | Equinor ASA

  • 14:00

    Critical Infrastructure Defense – Incident Response in Powergrid

    Ozan Dayanc | Omicron Electronic

  • 14:30

    ON104

    Graeme Dick | Offshore Norge

  • 15:00

    Break - Meet companies in the exhibition area for networking

  • 15:30

    Baseline Security, Strategic Gaps: Where ON 104 fits in the current threat Landscape

    Kristian Solheim Teigen | Havtil

  • 16:00

    OT in a Barrier Management Context – Real Case

    Anne Wahlstrøm | DNV & Ragnar Heksem | Aker BP

  • 16:30

    End of Day 1

  • 19:00

    Dinner at "Holberg" at the hotel

  • Chair: Anne Marie Wahlstrøm | DNV

  • 09:00

    Fundamental Principles of OT

    TBA

  • 09:30

    Who’s talking to whom – and why? OT-Network monitoring with open source

    Jens Wiesner | BSI – German Federal Office for Information Security

  • 10:00

    Go to Sessions/ Break - Meet companies in the exhibition area for networking

  • 10:30

    When standards go through digitalization and become smart

    Trond Salater | NEK & Kenneth Titlestad | Omny AS

  • 11:00

    How geopolitical changes impact cybersecurity in manufacturing

    Knut Håkon Tolleshaug Mørch | Director IT Architecture and Cybersecurity | Tine SA

  • 11:30

    Lunch

  • Chair: Marie Moe | Mandiant Consulting, Google Cloud

  • 12:30

    Digital Sovereignty: Ready, Set, Risk Dashboard of Red

    Ron Brash | Ampyx Cyber

  • 13:00

    Experiences with EqHub

    Øyvin Høynes | Equinor ASA & Yngve Nilsen | CoOper8 AS

  • 13:30

    Break - Meet companies in the exhibition area for networking

  • 14:00

    Using AI & ML to Reduce Noise and Alert Fatigue in OT Security

    Paul Smith | Honeywell AS

  • 14:30 - 14:45

    Closing remarks Committee Chair

    Marie Moe | Mandiant Consulting, Google Cloud

  • Chair: Knut-Erik Tovslid | Triple-S

  • 09:30

    Securing Your Operations 24/7: What We've Seen To Fail In One Of Your Most Important Security Controls - And How To Fix It

    Pekka  Pirttiaho | SensorFu

  • 10:00

    Break

  • 10:30

    From Silos to Resilience: Holistic Cybersecurity for OT and Supply Chains

    Elliot Gidley | Claroty

  • 11:00

    Asset Management: Connecting-the-Dots

    Rob Rhind | Netsecurity AS

  • 11:30

    Lunch

  • 12:30

    Evolving Vulnerability Management to Continuous Threat and Exposure Management

    Emerson Kastrati | Omnysecurity

  • 13:00

    Defending Uptime with OT-SDN Segmentation Strategies

    Thomas Vasen | HMS Networks

  • 13:30

    Break

  • 14:00

    Go to Maintrack

  • 14:30

    Closing remarks by Committee Chair Marie Moe (Maintrack)

  • 08:00-16:00

    Workshop: Expanding the Horizon of IDS

    This workshop provides a hands-on introduction to Intrusion Detection Systems (IDS), focusing on network-based IDS (NIDS). Participants will learn how IDS works, analyze network traffic, configure IDS rules, and use IDS for other purposes (e.g., asset identification and vulnerability management). The session includes practical labs using off-the-shelf tools like Zeek and Suricata, ensuring attendees gain real-world experience from specific cases.

    Lab Requirements: Windows, Linux, or Mac machine (16 GB RAM, 32GB Hard Disk). User must be capable of installing the analysis tools (Docker containers).

    Speakers: K. Reid Wightman & Oscar Delgado | Dragos

  • 08:00

    Workshop: The Horizons of IDS

  • 10:00

    Break

  • 10:30

    Workshop continues

  • 11:30

    Lunch

  • 12:30

    Workshop continues

  • 13:30

    Break

  • 14:00

    Workshop continues

  • 16:00

    Workshop closes

Presenters

Thomas Vasen | Product and Business Leader | HMS Networks

Product and Business Leader at HMS Networks since 2023, specializing in Operational Technology (OT) cybersecurity. ISA/IEC 62443 certified and Product Management Certification (PMC) Level VII. More than 25 years of international experience across telecom, cybersecurity, industrial automation, and B2B software services. Group lead for the Cybernode.se Security in ICS/OT theme and active member of the HSD Securitydelta.nl OT Security Expert Platform (IPCS). Frequent international speaker and trusted advisor on OT security, networking, and digital transformation.

Traditional segmentation in OT environments is often perceived as complex, risky, and costly to deploy. This session shows how OT-SDN (Software-Defined Networking for Operational Technology) fundamentally changes that reality.

We explore how OT-SDN enables fine-grained, deterministic micro-segmentation without redesigning the network, re-addressing devices, or relying on fragile and hard-to-maintain rule sets. By separating security policy from physical network configuration, asset owners can define clear, enforceable communication rules that are easier to deploy, visualize, and operate over time.

The talk focuses on practical outcomes: reducing blast radius, defending uptime, and supporting IEC 62443 zoning and conduits with a deny-by-default policy for all devices. Real-world examples demonstrate how segmentation can be introduced incrementally, with minimal disruption, even in brownfield industrial networks.

If micro-segmentation has felt too hard to justify or too risky to implement, this session shows how OT-SDN makes it achievable.

Ron Brash | Ampyx Cyber

Ron Brash is a well-known problem solver in the ICS community, and has a history of tackling challenging new ideas in product, research, or through consulting engagements. Today, Ron advises on product development, has over a decade of experience including: industrial networks, protocols, technologies, embedded systems, binary analysis, C-SCRM, standards, and consulting in several verticals ranging from aviation, energy, O&G and more

Ozan Dayanc | OMICRON

Ozan studied Electronic and Communication Engineering and has built his career across the energy and railway sectors, working on commissioning of SCADA, control, and IT systems. Since joining OMICRON in 2020, he has specialized in OT security, conducting security assessments for utilities worldwide and implementing cybersecurity solutions. He is currently the product management for OMICRON’s cybersecurity portfolio, focusing on technical strategy,  product positioning, and knowledge sharing through publications and documentation.

Elliot Gidley | Claroty

With over 20 years of cybersecurity experience, Elliot Gidley specialises in bridging the gap between IT and OT environments, helping organisations secure their critical infrastructure. As Field CTO at Claroty, he is dedicated to maximising the value of the Claroty platform, guiding customers through technically complex challenges, and enabling them to achieve robust cyber-physical security across diverse industries.

Marianne Mangersnes | Equinor | Senior Manager SSU

Marianne Mangersnes is Senior Manager SSU at Equinor, with more than 25 years of leadership experience across operations, maintenance, and project execution. She has several years’ experience in leading Cybersecurity within Operational Technology (OT).

In her talk, Marianne will address the cyber threat landscape facing our facilities and highlight risks that may impact safety and availability.

Patrick Miller | Ampyx Cyber

Norway’s energy infrastructure is not incidental to European security. It is central to it. The adversaries currently operating against European energy systems have demonstrated patience, technical understanding, and a willingness to act. But capability alone is not what makes the current moment different. Today’s energy infrastructures are essentially software platforms that deliver electrons, and the December 2025 attacks against Polish infrastructure, the April 2025 Iberian blackout, and incidents closer to home suggest that these systems can be made to defeat themselves under the right conditions. This keynote examines what changes when the threat model shifts from opportunistic intrusion to adversaries who have studied the system’s physics, seasonal exposure windows, and interdependencies, and asks whether current security architectures are calibrated to the adversary that actually exists.

Oscar J. Delgado | Principal Detection Engineer | Dragos Inc.

Oscar J. Delgado is a Principal Detection Engineer at Dragos, Inc., a global leader in industrial cybersecurity. With a background as a Process Engineer at major consulting firms, he has delivered projects across the Oil and Gas, Mining, and Water/Wastewater Treatment sectors. This hands-on industrial experience gives him a strong foundation for identifying and developing threat detections targeting operational technology (OT) and industrial control systems (ICS). Oscar holds a Bachelor’s degree in Chemical Engineering from Universidad Nacional de Colombia.

Kristian Solheim Teigen | Principal Engineer | Havtil

Kristian Solheim Teigen is Principal Engineer digital security for Havtil, the Norwegian Ocean Industry Authority.
In this presentation, he will place the newly published industry cybersecurity guideline, ON 104, within today’s evolving threat and regulatory landscape. The talk explains how Havtil views ON 104 as a key contribution to raising baseline security across the sector, particularly against the most likely and frequent cyber threats. At the same time, the presentation reflects on the current state of infrastructure protection, the changing threat picture, and why securing industrial infrastructure must be approached as both a short‑term necessity and a long‑term strategic effort.

Kevin Widlund | Senior OT Security Engineer | Truesec

Kevin Widlund works as a Senior OT Security Engineer at Truesec, working at the core of Truesec’s Operational Technology Domain. He focuses on protecting industrial environments through continuous monitoring, proactive threat hunting, and operational insights across OT platforms, networks, and underlying systems.

Beyond the monitoring aspect, he takes a broader operational role, overseeing Truesec’s threat hunting efforts in industrial environments and continuously refining OT detection processes to maintain high‑quality detection as industrial systems become increasingly connected.

In his talk he will explore the 5-year journey of entering the OT field from scratch, focusing on the transition from researching industrial protocols to building a functional OT-SOC. He will highlight how technical curiosity, supported by strong mentorship, enables a path from observing network traffic toward developing methods for detecting threat actors within industrial environments.

Yngve Nilsen | Service area responsible Material Management | Cooper8

Yngve has more than 25 years of experience implementing services in Norwegian and international industries. He has in recent years been responsible for establishing Magnet JQS and the Material Management Portfolio in Offshore Norge as industry services for the NCS, and previously held senior management roles for service companies delivering to a global market. Yngve also has board experience supporting growth for both start up companies and established companies. He studied informatics and mathematics at University of Bergen and holds a BSc from Norges Handelshøyskole.


Cyber Security 2026 takes place in Oslo – the capital of Norway April 22 – 23.

Cyber security is of increasing importance in Norway for most industries. With Cyber Security 2026, NFEA intends to show how real the cyber threats are for different areas of society. We will also demonstrate which practical measures large and small companies and institutions have taken to meet the threats.

The conference is also an ideal arena to exchange experiences and discuss best practices, as well as lessons learned about things where we have room for improvement.

Sign up and learn how to improve cyber security with a focus on Operational Technology (OT). We will give practical examples of how cyber incidents have been handled.

Up to date information on International Standards cybersecurity in OT and how they are used in practice for various companies’ processes and procedures will also be presented.

Conference Tracks – Cyber Security 2026

Day 1
The conference features a Main Track with a shared program for all participants, focusing on key topics, industry insights, and strategic perspectives within cyber security.

Day 2
On Day 2, the conference offers three parallel tracks:

  • Main Track – Continued plenary sessions and in-depth presentations
  • Technology Track – Practical insights, solutions, and case studies from technology providers
  • Full-Day Workshop – A hands-on, in-depth workshop running throughout the day

Track selection:
The Main Track and Technology Track can be freely chosen on-site on Day 2.

Please note:
Participation in the Full-Day Workshop requires separate registration and is subject to a limited number of seats. Early registration is recommended.

Other NFEA events can be found here!

Practical information

Date

22.04.26 - 23.04.26

Location

Radisson Blu Scandinavia Hotel
Holbergs gate 30
0166 Oslo

Map

Participation fee

  • Company member NOK 9 700,-
  • Personal member NOK 9 700,-
  • Education member NOK 6 700,-
  • Education Non member NOK 7 750,-
  • Non member NOK 11 700,-

Press participates for free! (*dinner is not included) Send email to [email protected] for registration.

Read more about our cancellation and refund policy by clicking HERE.

Dinner

The conference dinner will be held on the evening of April 22, and participation is optional.
Price NOK 1300,- (3 course dinner, including two drinks. Additional drinks must be paid for individually).
Sign up for the conference dinner through the conference registration form.

Accommodation

Each participant must book and pay for their own accommodation.
NFEA has received a code that can be entered on the conference hotel’s website.
To book a room, use the code NFEARS on the hotel’s website

Single room: NOK 2,450 incl. breakfast, incl. VAT
Double room: NOK 2,550 incl. breakfast, incl. VAT

The final deadline to book the reserved rooms is  27 February 2026. After this date, the rooms will be released.

Exhibition / logo

Exhibition package: includes a 3 × 2 m exhibition space, a standard table and two conference chairs, a white tablecloth, standard power supply, and wireless internet.

Exhibition (max 3×2 meter) :

  • NOK 13 000,- (+ Participation fee)

Exhibition incl. logo on eventpage/in app etc:

  • NOK 17 000,- (+ Participation fee)

Logo on the event site & in the app:

  • Members NOK 6 000,-
  •  Non members NOK 8 500,-

Exhibitors: Setup can begin from 07:00 (the venue is not available the evening before).
Equipment may be shipped to the hotel no earlier than 2 days prior to the event and must be clearly labeled with the name of the conference.

Program Committee

Committee chair: Marie Moe | Google
Knut-Erik Tovslid | Triple-S AS
Judith Rossebø | ABB AS
Øystein Brekke-Sanderud | NORMA Cyber
Anne Marie Wahlstrøm | DNV AS
Lars Erik Smevold | Statkraft AS
Trond Kvamme, Equinor ASA
Karin Sundsvik | NFEA
Tonje Olsen Benestad | NFEA

Other information

DOWNLOAD THE NFEA MULTI-EVENT APP

The NFEA app is available for download on the App Store and Google Play. To log in, use the same email address you used when registering for the conference.
In the app, you will find the participant list, program, sponsors, and, when permitted, PDF versions of select presentations. Note: This app is also used for other NFEA conferences. Participant list: Each attendee has the option to hide their identity in the app.

Please check for app updates on your phone to ensure that you have the latest version of the app.

Having trouble and using an Androide phone? Try this:

  1. Open Settings on your phone.
  2. Tap Apps (it may also be called Applications, App management, or Apps & notifications).
  3. Select the app you want to clear cache for.
  4. Tap Storage or Storage & cache.
  5. Tap Clear Cache.

HERE you will find NFEAs Terms for cancellation and refund