Two conferences, two moods: at RSA the drumbeat was resilience; at InfoSec, it's sovereignty. Sean and I close the week with Forrester analyst Madelein van der Hout — beaming in from the Netherlands — on why Europe makes a framework out of everything, what AI deployment is doing to the boardroom, and the security jobs that don't exist yet.
ON LOCATION | Sean Martin & Marco Ciappelli — Infosecurity Europe 2026
Two conferences, two moods: at RSA the drumbeat was resilience; at InfoSec, it's sovereignty. Sean and I close the week with Forrester analyst Madelein van der Hout — beaming in from the Netherlands — on why Europe makes a framework out of everything, what AI deployment is doing to the boardroom, and the security jobs that don't exist yet.
📺 Watch | 🎤 Listen | ITSPmagazine.com
There's a building across the Thames from the InfoSecurity press room — Millennium Mills, a derelict flour mill that looks precisely as haunted as it sounds. I kept glancing at it while Sean and I talked with Madelein van der Hout, who this year was a kind of friendly ghost herself: fully in the conversation, quick as ever, and across the North Sea in the Netherlands. She couldn't make it to London this year. FOMO, she told us, is real.
Which turned out to be the point. Madelein is a senior analyst at Forrester — she reads this industry for a living — so the first thing we did was compare notes on what the week actually felt like. Sean kept hearing one word on the show floor: sovereignty. A few weeks earlier at RSA in San Francisco, the drumbeat had been resilience. Same industry, two continents, two moods. Madelein said it better than I could: RSA is where her blood pumps with enthusiasm for everything technology can do, good and bad, and InfoSec is where she comes to get grounded in reality. Flashy versus pragmatic. The far edge of the possible versus the guardrails.
Europe, she said with affection, will make a framework out of anything — the cloud sovereignty package announced that week being the newest one. And under all the frameworks sits the thing no European conference can avoid: hybrid warfare, close enough to feel.
AI is moving from experimentation to deployment inside real organizations, and the moment it does, it stops being a demo and becomes a liability that lands on a boardroom. That, Madelein argued, is what you're feeling here — the weight of being responsible for something you've only just let inside the walls. Her research points somewhere specific: security is drifting toward becoming a "trust and assurance" function, and with it come jobs that don't exist yet. Trust engineers. Agentic workflow assurance engineers. People whose whole task is to confirm that an AI agent did what the business actually intended, not just what it was told.
Sean's read was sharp: almost nothing on the expo floor addresses any of that. They're architecting for now, Madelein agreed, not for what's coming. Which is the oldest story in technology — we shout about the future and keep building for the present.
Near the end we argued about metaphors, which is the kind of thing I live for. I reached for Frankenstein: all these tools and agents and smart-city systems stitched together into something we then have to teach to move as one. Madelein offered a better image. Don't build a Frankenstein, she said — become a jellyfish. There's a species that works as a neural network, and when two of them are injured and collide, they don't compete. They merge and swim on as a single organism. More than synergy, Sean said. Exactly.
We spend enormous energy bolting parts together and calling it integration. Madelein is describing fusion instead of assembly — one organism, not a monster made of seams.
She's already made her peace with what all this means for her own work. This job will be automated, she said, maybe most of it, and she cannot wait to help reinvent what an analyst even is. That was the healthiest thing I heard all week. Not "will AI take my job," but "what is this job becoming."
So I'm watching a ghost mill through the rain while a colleague beams in from another country, and the question under all the frameworks and the shiny new job titles is quieter than any of them.
When everything can be orchestrated, what still has to be human?
Let's keep thinking.
The full conversation is part of our On Location coverage of Infosecurity Europe 2026 at ITSPmagazine.com. For more of my writing, subscribe to the newsletter at marcociappelli.com.
— Marco (with my co-host, Sean Martin)
Co-Founder ITSPmagazine & Studio C60 | Creative Director | Branding & Marketing Advisor | Personal Branding Coach | Journalist | Writer | Podcast: An Analog Brain In A Digital Age ⚠️ Beware: Pigs May Fly | 🌎 LAX🛸FLR 🌍
More from our Infosecurity Europe 2026 coverage:
Infosecurity Europe 2026 event coverage
Technology and cybersecurity conference coverage
About the Hosts
Marco Ciappelli is Co-Founder & CMO of ITSPmagazine, Co-Founder & Creative Director of Studio C60, and host of An Analog Brain In A Digital Age. Born in Florence and based in Los Angeles, he explores the intersection of technology, society, storytelling, and creativity. 🌎 marcociappelli.com
Sean Martin is Co-Founder of ITSPmagazine and host of the Redefining CyberSecurity Podcast, where he examines how to think about and operationalize security in the context of business. Together, Marco and Sean produce On Location event coverage from cybersecurity conferences around the world. 🌎 seanmartin.com
About the Guest
Madelein van der Hout is a Senior Analyst on the Security & Risk team at Forrester, based in the Netherlands. She leads Forrester's research on security organizational structure and operating models, and covers European security strategy, resilience regulation (including DORA and the Cyber Resilience Act), digital sovereignty, and API security. She advises security leaders on building and maturing their programs, and is frequently asked to comment on technology by outlets including the BBC, the Financial Times, and CIO Magazine. Before Forrester she worked at the Dutch telecommunications company KPN across innovation, transformation, cybersecurity, and identity.
EPISODE SUMMARY
On the final day of Infosecurity Europe 2026, Marco Ciappelli and Sean Martin close out their On Location coverage with Forrester senior analyst Madelein van der Hout, who couldn't travel to London this year and joined the conversation from the Netherlands. The three trade notes on how this event felt against RSA a few weeks earlier — RSA flashy and enthusiastic, InfoSec pragmatic and grounded, with "sovereignty" replacing "resilience" as the word of the week and hybrid warfare never far from the room. The serious core is Madelein's read on where security is heading: as AI moves from experimentation to deployment, it becomes a boardroom liability, and security itself is drifting toward a "trust and assurance" function with roles that don't yet exist — trust engineers, agentic workflow assurance engineers, AI governance advisors. Sean notes that almost nothing on the expo floor addresses any of it; the industry is architecting for now, not for what's coming. The conversation lands on a metaphor: instead of stitching together a Frankenstein, become a jellyfish — a neural-network organism that, when two are injured and collide, merges and swims on as one. Marco's through-line closes it out: when everything can be orchestrated, what still has to be human?
3 QUOTES — MADELEIN VAN DER HOUT
On the two conferences:
"At RSA my blood is pumping with enthusiasm for everything technology can do, good and bad. Then I come to InfoSec and get grounded in reality."
On the future of the security organization:
"Security is moving toward a trust and assurance organization. That means new roles — trust engineers, agentic workflow assurance engineers — people who validate that an agent did what the business actually intended."
On how we should build:
"Rather than creating a Frankenstein, maybe we should be more like jellyfish — neural networks that, when they're hurt and bump into each other, merge and flow on as one organism."
3 QUOTES — MARCO CIAPPELLI & SEAN MARTIN
Sean, on the expo floor:
"Almost nothing down on the expo hall does anything about what you just described. They're architecting for now, not for the future."
Marco, on the value of conferences:
"You don't really need to be on the floor to tell those stories. The benefit to the industry would be more knowledge that isn't paid for — more panels, more conversation on stage."
Marco, on the machine we're building:
"All these parts stitched together — and then something has to actually think and move them as one. That's when I think of Frankenstein."