KIDANVerse 2026

THE TWO FORCES RESHAPING IT RIGHT NOW

SECURITY & AI

Leadership Insights from KIDANVerse:
Eight of Switzerland’s most senior IT and security leaders, two cities, two unfiltered panels. No vendor slides, no theory, just what works, what fails, and where the hidden vulnerabilities actually live in the modern enterprise.

10-min read

Held May 2026

Swiss C-Suite & IT Leaders

Hosted by KIDAN

Swiss IT Leaders Convened

0 +

Across Zurich and Lausanne

CIOs & CISOs On Panel

Banking, humanitarian, marketplace, public

2

Cities · 2 Panels

One premise: peers solving identical problems

Rooms With Shadow AI in Use

~ 0 %

Show of hands employees using unsanctioned tools

Five years ago, conversations about corporate cybersecurity and artificial intelligence were largely theoretical. Security was a compliance line item. AI was a speculative research topic. Both sat safely at the edges of corporate strategy, managed by isolated specialists and rarely dictating the core decisions of enterprise leadership.

That era is officially over. Today, cybersecurity threats and AI adoption are pressing operating realities. Every organization regardless of industry or budget must hold a definitive position on both fronts. Threat actors do not wait for your annual budget cycle to clear, and AI adoption will not pause while you draft governance policies. The executives managing this shift are not theorists. They are operational leaders navigating real-time risk and carrying the weight of enterprise decisions every day.

This strategic friction was the exact catalyst for KIDANVerse 2026.

Eight Leaders, Two Cities, One Premise

The most valuable insights come from peers who are actively navigating identical problems. Every session was built around unfiltered honesty about what works, what fails, and where the hidden vulnerabilities lie centered entirely on enterprise security and AI.

In May 2026, KIDAN convened more than 120 Swiss IT leaders across Zurich and Lausanne for the inaugural edition of KIDANVerse. The annual executive forum was deliberately structured to bypass vendor theatre: two panels, in two cities, anchored by eight executives who run security and IT for some of Switzerland’s most demanding environments from private banking to global humanitarian operations.

The Zurich Panel

The Zurich session brought together four leaders whose mandates span global IT strategy, financial-services security, humanitarian data protection, and large scale digital marketplaces a deliberate cross-section of the pressures facing Swiss enterprises today.

The Zurich panel on stage. Left to right: moderator, Christine Fahlberg (CISO, Swisscard AECS), Prabjot Singh (CISO, Caritas Schweiz), Olivier Bloch (Head of Global IT, IQAir AG), and Mostafa Hassanin (Group CISO/CSO, SMG Swiss Marketplace Group).

Olivier Bloch

Head of Global IT
IQAir AG

Leads global IT strategy across cloud, AI, and IoT for a Swiss air-quality technology company operating in 100+ countries. 25+ years of international experience, including UBS and operations in China the voice of the IT leader who must make security functional inside a complex, live business.

Christine Fahlberg

Chief Information Security Officer
Swisscard AECS GmbH

Recognized as Swiss CISO of the Year. Directs security for a premier credit-card provider a joint venture between Credit Suisse and American Express. Her career has been spent transforming security from a reactive compliance box into a core business strategy.

Prabjot Singh

Chief Information Security Officer
Caritas Schweiz

15+ years across information security, the UK Ministry of Defence, and critical national infrastructure. Specializes in secure-by-design architecture, AI-driven defense, and ISO 27001 / NIST protecting sensitive humanitarian data with banking-grade rigor.

Mostafa Hassanin

Group CISO / CSO
SMG Swiss Marketplace Group

Oversees cybersecurity, digital trust, and safety across 17+ platforms serving millions of users. Executive degrees from Oxford and INSEAD, 14+ years building cyber-resilient architectures, and one of Switzerland’s most direct advocates for zero trust and passwordless authentication.

The Lausanne Panel

In French-speaking Switzerland, the panel shifted toward operational resilience, ecosystem collaboration, and the realities of regulated financial software grounded by leaders who treat infrastructure failure as a real-world consequence, not a slide.

The Lausanne panel on stage. Left to right: Lennig Pedron (CEO, Trust Valley), Pascale Cornut (CIO, Médecins Sans Frontières), Flavien Bau (CIO, Multifonds), and Julien Walker (Group Head of Identity Security, Azqore), with the moderator at right.

Pascale Cornut

Chief Information Officer
Médecins Sans Frontières

Drives IT modernization for one of the largest humanitarian networks on earth 65,000 personnel across 70+ countries. 20+ years in technology deployment, viewing IT strictly through an operational lens where infrastructure failures carry severe, real-world consequences.

Lennig Pedron

CEO · Program Director
Trust Valley · EPFL Innovation Park

Named European Cyber Woman 2023. Operates at the intersection of public-private collaboration, digital trust, and cybersecurity advising startups, enterprises, and public institutions on building collaborative defense structures across the Swiss ecosystem.

Flavien Bau

Chief Information Officer
Multifonds

25+ years in technology, including two decades as Group CIO within international banking-software group Temenos. Multifonds is a leading global provider of investment fund administration software Bau brings strategic precision and deep operational depth.

Julien Walker

Group Head of Identity Security
Azqore

20+ years in highly regulated financial environments, specializing in private-banking digital ecosystems. His approach centers on hands-on execution mapping practical, on-the-ground vulnerabilities rather than relying on theoretical slide decks.

Security Strategy: Mindset Outperforms Toolsets

Asked how a CISO should prioritize amid compounding budget pressure, regulatory shifts, and an expanding attack surface, the Zurich panel bypassed software entirely. The consensus: effective risk management requires shifting security from a technical issue to an organizational discipline.

A CISO can no longer focus solely on securing an IT perimeter. The modern objective is building a culture where every employee recognizes their role in the security architecture because the most advanced technology fails the moment a user clicks a malicious link.

Christine Fahlberg

CISO, Swisscard AECS paraphrased from the Zurich panel

Continuous security awareness, Fahlberg argued, is not a superficial training exercise it is the core defensive strategy. Mostafa Hassanin extended this into a framework for prioritization based entirely on business criticality: executives must identify the specific core processes the business cannot survive without and concentrate resources there. Security spending that fails to anchor to tangible business value becomes expensive background noise.

Prabjot Singh reinforced the point from a humanitarian perspective: risk alignment must be measured by what an operational failure means to the people who rely on the organization to function not by abstract technical severity indexes.

Security is not an IT function it is a business responsibility. Every system we deploy, every process we design, and every decision we make must strengthen the trust our customers, employees, and partners place in us.

Flavien Bau

CIO, Multifonds

Security is everyone’s responsibility, but leadership sets the standard.

Protecting the business starts with securing the technology.

Security is not a project; it is a continuous commitment.

Strong security enables business growth, innovation, and trust.

Cybersecurity is a leadership priority, not just a technical requirement.

Compliance gets you certified. Security keeps you protected.

As security leaders, we are accountable for building secure foundations, reducing risk, and ensuring compliance. Security must be embedded into everything we do not added as an afterthought. My motto is Secure by Design. Secure by Default. Secure Every Day.

Culture is the control layer

Every department owns a piece of the security architecture. Awareness is the defense, not an HR formality.

Anchor spend to business criticality

Identify what the business cannot survive without, and fund that. Unanchored security spend is noise.

Measure risk by stakeholder impact

For humanitarian and regulated environments, failure is measured in human and operational consequence not CVSS alone.

In Lausanne, Flavien Bau pushed the concept into leadership accountability. Cultural awareness, he argued, cannot be achieved through static policy handbooks. It demands decisive action from the top: unannounced incident-response simulations, visible consequences for lapses, and executive leadership speaking about risk transparently. Organizations that successfully transform their security culture do so through memorable, high-impact internal actions.

Grounding Security in IT Reality

Olivier Bloch provided a crucial reality check from the IT director’s seat. Day-to-day operations are rarely as clean as theoretical security frameworks assume. Enterprise environments are constrained by legacy systems, production dependencies, and commercial timelines that cannot stop for security adjustments.

True collaboration succeeds only when security professionals adapt their goals to the actual, messy operational environment not an unachievable ideal state.

The Hidden Gaps in Zero Trust

While zero trust identity and access management is widely accepted as the correct strategic direction, both panels acknowledged that very few enterprises have achieved full deployment.

Mostafa Hassanin noted that legacy architecture makes immediate, total zero trust adoption impractical for most organizations. But the true value of the model lies in its function as an analytical framework forcing teams to ask: What specific data assets are we protecting? What does access actually look like? Where are we relying on unverified assumptions?

Identity governance. Passwords remain ubiquitous. Legacy access privileges granted years ago are rarely audited or revoked. Employees routinely retain excessive permissions to unmapped systems. As Prabjot Singh put it: the most critical exposures are not the threats you cannot see they are the environments you stopped auditing.

Flavien Bau connected this directly to internal data governance: data hygiene and access control are the same challenge. You cannot successfully overlay a zero trust model onto an environment that has never been thoroughly mapped and cleaned.

Dismantling the Framework Trap

The panelists shared a pointed skepticism about the sheer volume of compliance frameworks flooding the market Zero Trust, PAM, DLP, RBAC, ISO 27001, NIST, NIS2. The trap for C-suite leaders is believing that acquiring more certifications equates to superior security.

✗ The Trap

Buying from a vendor catalog

Treating certifications and acronyms as a checklist. Accumulating frameworks without mapping them to your actual catastrophic failure points produces the appearance of security at real expense.

✓ The Alternative

Building around your operations

Identify your specific catastrophic failure points and design targeted controls to mitigate them. Frameworks are guides, never substitutes for localized understanding of your own risk.

✗ The Trap

Buying from a vendor catalog

Treating certifications and acronyms as a checklist. Accumulating frameworks without mapping them to your actual catastrophic failure points produces the appearance of security at real expense.

✓ The Alternative

Building around your operations

Identify your specific catastrophic failure points and design targeted controls to mitigate them. Frameworks are guides, never substitutes for localized understanding of your own risk.

Pascale Cornut introduced an uncomfortable operational truth: despite the sophistication of any enterprise security stack, human error is inevitable. The differentiator between resilient organizations and those that collapse is not total prevention it is speed of recovery. Resilient companies maintain comprehensive, tested backups and incident-response plans built for rapid continuity. Selling operational resilience internally is harder than purchasing a new platform, but it remains the only honest approach to risk

The gaps the panels described start with an audit.

Unmapped systems, dormant access privileges, and disorganized data are where exposure compounds. KIDAN helps Swiss organizations find them before an auditor or an attacker does.

Forward Risks: Quantum & AI Sandboxes

Prabjot Singh highlighted quantum cryptography as an emerging risk requiring immediate executive attention. Having tracked quantum advancements for more than two years, he warned that while the threat is not immediate, the runway for preparation is brief. Migrating cryptographic infrastructure takes years of planning leaders must understand the shifting landscape now to avoid rushed, high-risk migrations later.

On current AI risk, Julien Walker offered highly practical guidance. Employees are already inputting corporate data into external AI applications, regardless of policy. The true executive choice is not whether to permit AI it is whether to Julien Walker monitor it openly or force it underground into shadow IT.

Build a controlled sandbox for internal AI experimentation. It preserves oversight, stops errors from compounding, and establishes enough trust with teams that they no longer feel compelled to bypass IT governance.

Julien Walker

Group Head of Identity Security, Azqore

AI Governance: Accept Reality, Clean the Data

A simple show of hands revealed that almost every organization present had employees using unauthorized, personal AI tools for business tasks. AI governance is currently playing catch-up to employee behavior. Leaders must choose between auditing what is already running inside their networks or maintaining a false sense of security.

~100%

Rooms reporting shadow AI use

By show of hands across the panels

Years

Quantum migration runway

Plan now, not at the threshold

Data first

Prerequisite to AI at scale

Clean architecture before deployment

~100%

Rooms reporting shadow AI use

By show of hands across the panels

Years

Quantum migration runway

Plan now, not at the threshold

Data first

Prerequisite to AI at scale

Clean architecture before deployment

The consensus across both panels was grounded in pragmatism rather than marketing optimism. While end users feel immediate productivity gains, AI introduces profound risk for executives responsible for compliance, data privacy, and identity governance. Corporate data is migrating to unmanaged repositories, tool permissions are poorly defined, and undocumented automations are quietly becoming critical infrastructure.

Julien Walker
emphasized the gap between public marketing narratives and regulatory reality particularly in Swiss private banking. Many organizations simply are not operationally ready for responsible AI deployment, owing to unstructured data, neglected access rights, and vendor architectures that conflict with strict local compliance.

Deploying AI on top of a disorganized data architecture will only accelerate and compound existing corporate risk. Most environments suffer from ballooning data volumes, abandoned access permissions, and unmapped legacy systems. It is the perfect time to ask for budget and proceed with the unglamorous, essential work of data cleansing and categorization.

Pascale Cornut

CIO, Médecins Sans Frontières

Flavien Bau offered an execution-focused counterpoint. Drawing on decades directing technology for global banking networks, he cautioned against waiting for complete regulatory certainty before moving. His approach: make calculated, bold decisions with incomplete data and adjust dynamically. AI will not wait for flawless data governance leaders must accept a margin of error, deploy controlled initiatives, and build internal systems that detect and correct mistakes rapidly.

Operational Blueprints for AI Deployment

Christine Fahlberg outlined a structured methodology for sustainable AI integration: prioritize a distinct business process over the underlying technology. Rather than attempting AI across the entire enterprise, leaders should isolate a specific, time-consuming workflow with highly predictable outputs prove measurable value, then expand methodically. This avoids the common trap of funding fragmented experiments that never reach production.

Pascale Cornut: deploying AI on top of a disorganized data architecture will only accelerate and compound existing corporate risk. Most environments suffer from ballooning data volumes, abandoned access permissions, and unmapped legacy systems. The unglamorous, essential work of data cleansing and categorization must come before investment in advanced AI.

Digital Sovereignty & the Swiss Context

Lennig Pedron addressed Switzerland’s characteristically cautious approach to AI adoption. While deliberate pacing aligns with traditional Swiss risk management, it creates a real exposure: falling behind global competitors under the guise of prudence.

The challenges of digital sovereignty, data residency, and sudden geopolitical shifts affecting technology vendors are too large for any single company to solve alone. The Swiss organizations moving most effectively, Pedron argued, are those actively participating in public-private initiatives, sharing operational insights across sectors, and co-developing localized governance models.

The Path Forward for Swiss IT Leaders

The insights from KIDANVerse 2026 converge on four strategic imperatives for the C-suite.

The Four Imperatives

What the Eight Leaders Agreed On

Across two cities and two distinct sets of pressures, the conclusions pointed the same direction.

Security is an explicit organizational culture

Firewalls and automated tools mean nothing without an active, accountable security mindset embedded across every department.

AI adoption demands rigid data governance

Deploying AI without fixing your underlying data architecture creates an immediate corporate liability hidden behind a modern pitch.

Operational judgment beats compliance checklists

Rigid frameworks guide, but never substitute for a deep, localized understanding of your specific catastrophic business risks.

The cost of corporate inertia is rising

In both cybersecurity and AI, waiting for perfect information or a flawless plan is the highest-risk strategy available.

Converged conclusions, KIDANVerse 2026 Zurich & Lausanne panels.

Frequently Asked Questions

What was KIDANVerse 2026?

KIDANVerse 2026 was KIDAN’s inaugural executive forum, convening more than 120 Swiss IT leaders across Zurich and Lausanne in May 2026. Eight CIOs and CISOs, from banking, credit, humanitarian, marketplace, and public-sector organizations, anchored two panels focused on enterprise security and AI governance. The format deliberately avoided vendor presentations in favor of unfiltered peer discussion about what works and what fails in live environments.

What was the central security lesson from the panels?

Mindset outperforms toolsets. The panels agreed that effective risk management means treating security as an organizational discipline embedded across every department, not a technical perimeter problem solved by buying more tools. Continuous security awareness was described as the core defensive strategy, with spending anchored to genuine business criticality rather than framework checklists.

What did the leaders say about enterprise AI governance?

Accept the reality, then clean the data. A show of hands revealed nearly every organization present had employees using unauthorized AI tools. The advice: audit shadow AI openly rather than driving it underground, build a controlled sandbox for safe experimentation, and, critically, fix the underlying data architecture before scaling AI. Deploying AI on disorganized data only accelerates existing risk.

What is the single highest-risk strategy in cybersecurity and AI today?

Corporate inertia. Across both cybersecurity and AI integration, the panels agreed that waiting for perfect information or a flawless plan is the highest-risk strategy available. Threat actors do not pause for budget cycles, and AI adoption will not wait for complete governance, so leaders were urged to make calculated decisions with incomplete data and build systems that detect and correct mistakes quickly.

Why does identity governance keep coming up as the biggest gap?

Because it is where exposure quietly accumulates. Passwords remain ubiquitous, and access privileges granted years ago are rarely audited or revoked, leaving employees with excessive permissions to unmapped systems. As the panels framed it, the most dangerous exposures are not the threats you cannot see, they are the environments you stopped auditing. Zero trust only works once those environments are mapped and cleaned.

The Takeaway

The hard part was never the technology. It was the discipline to face operational reality.

Eight leaders, two cities, and one converging conclusion: resilient organizations treat security as culture, govern their data before they scale AI, and trust localized operational judgment over framework accumulation. Every one of those imperatives starts in the same unglamorous place knowing exactly what is running in your environment, who can access it, and what state your data is actually in. That is the audit KIDAN runs first.

maybe one key aspect is that all leaders understood change is required and evolution is what is one of the human’s best qualities that will help us navigate through this change with AI and that new threats are going to come and we need to be prepared to change our ways. Also, defense in depth is quite important. Blast radius was a concept mentioned in Zurich. Containing it is quite key

Written by

KIDAN Enterprise IT & Security Practice

A premier Swiss IT consulting firm trusted by 1,300+ enterprise organizations and a core member of the ENIXEN Group. KIDAN designs, secures, and optimizes unified enterprise IT ecosystems, and hosts KIDANVerse, the executive forum for Switzerland's IT and security leadership. Fluent in German, French, Italian, and English.

Latest Insights & Technology Trends

From cybersecurity to cloud and automation, explore content designed to help
businesses innovate and grow smarter.

As a Service

Partner Program

IAM

Cloud

UEM

MSP

Security

...........

Help Desk

Networks

.....

....

IT Analytics

AlarmsOne

ManageEngine

IAM

AD360

Access Manager Plus

ADManager Plus

ADSelfService Plus

Access Manager Plus

Key Manager Plus

Identity 360

PAM360

Password Manager Pro

Recovery Manager Plus

IAM

UEM

Security

Networks

Cloud

MSP

Help Desk

IT Analytics

ColorTokens

Cloudflare

SentinelOne

Microsoft

Horizon3

Zoho

Xink

Sangfor

390+

115+

1'300+