Cyberattacks make no distinction between the private and public sectors. Companies, suppliers and institutions belong to the same ecosystem, and a vulnerability at a single point can have effects far beyond the targeted organization. Artificial intelligence speeds up attacks, supply chains open new entry points, and compliance or a passed audit offers no guarantee that an organization will withstand a real incident. DefCamp brings together the people who make decisions, the people who build defenses, and the experts who see these threats every day. At the same time, with support from DNSC, we offer free access to DefCamp to more than 100 representatives of public institutions, so they can connect directly with local and international experts, exchange experience, and better understand how to prepare for cyberattacks and hybrid threats. Resilience grows through collaboration: the next attack may start in a company, at a supplier or in a public institution, but its effects can reach all of us.
Debates for business leaders, from the Cyber Resilience Act and AI to cybersecurity budgets
On the stage dedicated to debates, DefCamp 2026 will host six panels on the security decisions that belong to company leadership. One of them, organized in partnership with ANIS (the Employers’ Association of the Software and Services Industry), will examine how prepared Romanian companies are for the Cyber Resilience Act, the European regulation that sets mandatory security requirements for products with digital components, and what costs and opportunities the new rules bring to the local industry.
The other debates will address company budgets and risks directly. Specialists will discuss why organizations with completed audits and up-to-date certifications still get compromised, which security measures actually stop an attacker, and who takes responsibility when a breach happens. Security directors will talk about budgets that receive approval only after an incident and about how they justify this spending to the board. The agenda also covers the risks that arise when a company’s operations depend on software suppliers, cloud platforms, external services and AI agents, as well as the way artificial intelligence changes the balance between attack and defense and pushes organizations to rethink how they anticipate, assess and manage cyber risk.
Cyber threats evolve quickly, and organizations need to move from reaction to anticipation. Through Recorded Future, the Mastercard company specialized in threat intelligence, we provide actionable, real-time intelligence that helps identify and prioritize risks before they affect a company’s operations. DefCamp is an important forum for this conversation because it brings together the technical expertise and the business perspective needed to anticipate risks and make better-informed decisions.
Technical investigations into threats targeting companies, hospitals, power grids and everyday devices
Across the conference’s four stages, Romanian and international researchers and specialists will present the results of their own investigations into critical infrastructure. The schedule includes vulnerabilities discovered in smart thermostats, fuel dispensing systems and surveillance cameras, attack scenarios against hospitals (from ransomware to the manipulation of medical equipment), and methods for testing power grid security without risking a blackout.
The agenda also covers the human side of attacks. Incident response specialists will show how attackers combine fake pages, messaging apps, phone calls and AI-generated content to win their victims’ trust, while other sessions will analyze deepfake fraud that uses public figures.
The full list of speakers and the conference agenda are available on the DefCamp website.
Hacking Village reaches a record 19 competitions, from drone hacking to attack and defense simulations, with prizes worth over €35,000
Hacking Village expands to 19 competitions this year, the highest number in DefCamp’s history.
Every competition starts from scenarios inspired by real incidents: participants will investigate malware attacks on financial institutions, hunt for vulnerabilities in AI agents, attack and defend space systems, analyze threats to applications, and test their physical security skills in the well-known Lockpicking Village.
The best ethical hackers will receive prizes worth over €35,000 in total, awarded live on the DefCamp stage.
Trace Labs returns to DefCamp 2026 with the OSINT Search Party CTF, a competition in which teams of one to four members search for information on missing persons in real cases. Competitors work exclusively with public sources and have no contact with the people involved or their families, and all the information they uncover during the competition goes into a report sent to the authorities handling each case.
Strategy, speed and adrenaline in the D-CTF final
With more than a decade of history, DefCamp Capture the Flag (D-CTF) is DefCamp’s signature competition and one of the event’s central moments. This year’s final, once again organized with The Few Chosen, one of Romania’s strongest CTF teams, brings to Bucharest the top 18 teams from eight countries (across Europe, Asia and North America), five of them from Romania.
The final will feature three competition formats. In the Jeopardy challenges, teams will solve problems from different areas of cybersecurity, each with its own score. In the King of the Hill format, they will try to take control of a target system and hold it against their opponents for as long as possible. Then, the attack and defense simulations will require them to protect their own infrastructure while exploiting the other teams’ vulnerabilities. It is a technical contest in which strategy, reaction speed and the ability to anticipate the next move can make the difference.
Drone races at the Palace of the Parliament
The DefCamp 2026 schedule also includes a drone show, in which two experienced pilots will race seven micro-drones on a circuit.
Organisers and partners
DefCamp 2026 is organized by the Romanian Association for Information Security Research (CCSIR), powered by Orange Business. The conference is supported by Recorded Future | Mastercard as Platinum partner, Syncnode, Bit Sentinel and Sophos as Gold partners, and Booking Holdings, Adobe, IGEL, StealthMole and Expleo as Silver partners.
