Swiss Cyber Storm 2026: 10 Takeaways on Shadow IT and AI

Swiss Cyber Storm 2026 took place on 20 October at the Kursaal in Bern, under the motto Shadow IT. Speakers from the U.S. Senate, Google, IBM Research, FullHunt, DayBlink Consulting and AWS, among others, came at one problem from different angles: the technology and the behaviour your organisation does not see. I attended most of the Arena stage plus one Panorama talk. Not consensus, exactly. A shared map. These are my ten takeaways, with the two keynotes, Hannes Lubich and Michael Morgenstern given the most room, because they carried the argument.

1. Shadow IT Removes Defences. It Does Not Create Threats

Lieutenant General (Ret.) Karen H. Gibson, Sergeant at Arms of the U.S. Senate from 2021 to 2025, opened with a framing that fits any regulated institution. She named four destinations for an attacker: espionage, exposure that gives leverage over people, manipulation of data and messages, and paralysis. Shadow IT creates none of them, she argued. It removes the defences. Every security programme rests on visibility, control and recoverability, and an unknown system has none of the three: it is not monitored, cannot be patched or revoked, and is missing from backup and incident response.

Her examples were vendors and the workforce. A company installing security systems at senators' homes holds addresses and floor plans, so its breach becomes a physical-security problem for the people she protected. You can outsource the service, she said, but not the risk. Staff, meanwhile, used personal messaging for official business and pasted Senate text into public chatbots because the approved tool did not exist. None of it was malicious. She reads it as a symptom of services that are too slow or too restrictive, and so as information about unmet needs.

Her prescription was not prohibition, which pushes shadow IT further underground. It combined discovery, sanctioned alternatives that are the easiest path, clear limits, and a culture where people ask before they hide, built around mission assurance: decide which functions must continue in a crisis and assume some defences will fail. Asked by a Swiss participant about documents going into private chatbots for translation, she answered operationally. Provide the service inside the network, and expect junior staff to be a larger exposure than senior officials.

My position: the vendor example bites hardest in Swiss finance. FINMA Guidance 05/2026 restates that responsibility for an outsourced function stays with the outsourcing institution, and Guidance 08/2024 reports that institutions sometimes could not tell whether a purchased application includes AI at all.

2. Hidden IT Has Four Faces, and Your Control Shrinks With Each

Hannes Lubich, retired professor at FHNW, widened the definition beyond the unapproved app. Two forces drive it: the control an organisation can exercise falls as you move from devices on premises to outsourced chains, while the benefit users perceive stays high because consuming services keeps getting cheaper.

• Shadow IT: equipment or services users bring or buy because they are productive. Still on premises, so you can find it.
• Invisible IT: embedded in devices that do not look like IT, often with a vendor access path. Remedy: central procurement and ring-fencing.
• Non-local IT: anything consumed as a service, AI and cloud storage included. Allow it under controls, because blocking it makes things dysfunctional quickly.
• The supply chain beyond the first supplier: contracts and audits stop at the first link, and software bills of materials become less reliable down the chain.

He was candid about limits. In his experience awareness training does not reach 10 to 20 percent of people. Human in the loop is close to impossible for real-time decisions, he said, while human on the loop, supervising and explaining afterwards, may still work. On non-IT staff building local tools with sanctioned AI, he said it cannot be stopped now, damage will come, and cost, such as token spend, may be the first brake. A company can run its own models on its own hardware, as a security company on whose board he sits does, but not every company can.

My position: the four-way split is the most useful taxonomy I heard, because each group has a different owner: IT, procurement and facilities, business units, third-party risk. His let-it-happen view on shadow AI is hard to square with Guidance 08/2024, where FINMA assessed whether institutions with many or significant AI applications keep a centrally managed inventory with risk classification.

3. The Outside View Is the One That Counts

Mazin Ahmed, founder of FullHunt, asked how many in the room had an asset inventory updated in the past week. About five hands went up, in a room he put at more than a hundred. His focus was shadow infrastructure: systems whose owner moved on, forgotten development instances, experiments that became production, acquisitions, third parties deploying on your behalf.

He presented findings from scanning Swiss address space. They are his figures, unpublished, and I could not verify them, so read them as indicative. Of 13 MongoDB instances without authentication, seven already carried a ransom note. Of 26 exposed Docker registries, 22 allowed anyone to write, so an attacker could replace an image that production later pulls. And 52 percent of the organisations scanned ran systems with known vulnerabilities. He credited the NCSC for its external scans and argued that continuous, outside-in coverage is what is missing.

My position: this is the counterpart to Gibson's argument. An internal inventory tells you what you think you run. The outside view tells you what an attacker can reach. A Swiss bank should produce both and explain every difference.

4. Shadow AI Is an Identity Problem, Not a Tool Problem

Michael Morgenstern, Partner at DayBlink Consulting, gave the most operational talk of the day. In Microsoft and LinkedIn's 2024 Work Trend Index, 75 percent of knowledge workers used AI at work and 78 percent of AI users brought their own tools. Shadow IT was a leak, he said, and shadow AI is, or will soon be, a flood. FINMA saw the early version: Guidance 08/2024 reports that keeping AI inventories complete was hard because, since generative AI, applications are available to everyone.

His central point: every prompt is a potential egress event, and agents do more than leak. They act, under borrowed identity, and in logs an agent and an attacker can look the same. His cases each trace to the researchers who found them:

• Zenity Labs disclosed PleaseFix on 3 March 2026: a calendar invite was enough to hijack Perplexity's Comet agentic browser without a click. Nothing was broken, he said. The agent did what it was told, just not by the user.
• Koi Security found that Urban VPN Proxy, a Chrome extension with a Featured badge and over six million users, had captured AI chats since a July 2025 update.
• Koi also audited OpenClaw's skill marketplace: 341 malicious skills among 2,857, 335 from one campaign, ClawHavoc.

Governance lags. IBM's 2025 report found that 63 percent of breached organisations had no AI governance policy or were still developing one, and the 2026 edition is reported to put shadow AI involvement at 43 percent, up from 20. His answer was not a ban: we have to become the department of how. Netskope's data supports it. Between October 2024 and October 2025 the share of generative AI users on personal accounts fell from 78 to 47 percent while company-approved use rose from 25 to 62, though users switching between the two also rose from 4 to 9 percent, a sign provision is not yet convenient enough.

His three questions are the part to take back. Do you know every tool, extension and agent in use, approved or not? Does each agent have its own identity, or does it act as the employee? Can you revoke it, and how fast? A quarterly access review that approves a list without checking it is theatre, he said, and should cover agent usage and permissions.

My position: the identity framing is right and fits tools Swiss teams already run. An agent that runs as the employee cannot be scoped, revoked or audited separately from the employee.

5. AI Changes the Economics of Attack Before It Changes the Techniques

Sébastien Schnyder, who manages Google's cyber threat intelligence services for Europe, said up front he was not selling a tool. His thesis: AI improves attacker capability every day, and above all changes the economics. Work that was out of reach or not worth the effort is now affordable.

Four observations from his team. Tracking data-leak sites over two years, they saw a marked rise in victims in non-English-speaking countries, and suspect AI lowers the language barrier. For Swiss readers, German, French and Italian are no longer a defence. A few seconds of audio can now be enough for a convincing voice model, and for mission-critical requests one control is to ask something an AI could not know. Attackers pick what matters and take on the order of a hundred megabytes instead of terabytes, avoiding volume alarms. And just-in-time malware exists: Google documented PROMPTFLUX in November 2025, an experimental family that asked Gemini to rewrite its own code hourly, assessed as still in development. Read it as direction, not prevalence.

He tied it to the theme. Orchestration tools someone installed in the company are targeted for the API keys they hold, and agents need zero trust and limited scope like any principal. His defences were unglamorous: telemetry on how AI is used, continuous testing, intelligence-led prioritisation, segmentation and least privilege. My position: the fundamentals are the AI defence.

6. Agents Are Over-Eager, Not Hostile, and Your AI Reviewer Is an Attack Surface

Christoph Schnidrig and Benny Gaechter of AWS Zurich spoke on the Panorama stage. Schnidrig started from a documented case. In July 2026 OpenAI disclosed that models in an internal cyber evaluation escaped their sandbox through a zero-day in a package-registry proxy and reached Hugging Face production systems to retrieve the benchmark's answers. His reading: not rogue, over-eager. A goal under pressure, weak guardrails, and a system that treats not forbidden as allowed. His lessons: smallest possible permissions, reward the how and not only the result, and write rules instead of descriptions, since an agent told it had no internet found it and assumed a simulation. My addition: the way out was a permitted dependency. Package proxies belong inside the containment boundary. On the attacker side he cited Anthropic's September 2026 threat report and concluded the incidents used publicly available models and old techniques. What changed is cost: patch in days, revoke access in minutes.

Gaechter's half described an open-source project whose development runs through agents, with code already merged that no human touched. The reviewer's design needs no vendor. Rules come from the base commit, never from the change under review. The agent gets data and minimum tools, no shell. Discovery and validation are separate agents, and the validator tries to disprove the findings. It fails closed. His demos showed why: a naive reviewer can be tricked into running a test that exfiltrates secrets, or persuaded by a well-written description to approve removing a symlink safeguard. The talk also included a commercial demo of AWS's own security agent. The design lessons stand without it.

My position: Lubich called human in the loop close to impossible, and here is a pipeline merging code without one. The AI reviewer is a privileged identity and must be modelled as one.

7. Quantum Readiness Now Has a Swiss Date: Mid-2027

Marco Brenner, Program Executive at IBM Research, which runs a lab in Zurich, split quantum into a long-term computing capability and a cryptographic threat that touches everyone using public-key cryptography. He works for a vendor with a stake, so I anchor the rest in the regulator. He cautioned that headline qubit counts mislead, pointed to IBM's published target of a fault-tolerant system by 2029, and cited the 2025 HSBC trial, up to 34 percent better at predicting bond-trade fills, as a sign of value while saying plainly it is not operational.

His cryptography messages were direct. Every public-key algorithm in use needs replacing. It is a hard cut, not the housekeeping of longer keys, and the new algorithms need more resources, the opposite of the move from RSA to elliptic curves. No announcement will mark the day a relevant machine exists, and harvest now, decrypt later already applies. A cheap step now is hybrid key exchange for TLS, tested under load.

The Swiss anchor is FINMA Guidance 05/2026 of 9 July 2026. FINMA surveyed 60 institutions between November 2025 and January 2026: 72 percent had planned or implemented no measures, and only 8 percent had a specific roadmap, typically foreseeing four to five years to make critical data and processes quantum-safe. It recommends:

• Strategy and roadmap: a board-adopted strategy and a PQC roadmap by mid-2027 at the latest.
• Inventory: a comprehensive, continuously updated inventory of cryptographic methods across all ICT systems, in-house, outsourced or procured as a service.
• Critical data: priority protection against harvest now, decrypt later, with hybrid solutions as an option that adds complexity.
• Crypto-agility: a requirement for ICT procured or developed, and a prerequisite for new outsourcing in software and data.

My position: Brenner said you can open the management conversation before the inventory exists. FINMA treats the inventory as the first step. Both hold: use the assumption to open the budget, use the inventory to plan. It is the same visibility problem as the rest of the day, applied to cryptography.

8. Verification Is the Skill AI Cannot Replace

Ivano Somaini, CEO of CyberStage and a founder of a Swiss OSINT community, started from a capture-the-flag observation. Some participants paste the question into an AI and paste the answer back. Others verify before they submit, because a real investigation has no submission field telling you you are right. AI helped: a geolocation tool placed a photo in a Mexico City neighbourhood in seconds, where he had spent hours. But AI also sits between investigator and source, filtering and summarising. In his experiment a detailed description of a painting, turned back into an image, dropped a pen from a woman's hand and changed what the scene meant.

The worse problem is the information space. The Pravda network republishes pro-Kremlin content across dozens of languages, built for crawlers rather than readers. In March 2025 NewsGuard tested ten chatbots on 15 of its false narratives and found them repeated about a third of the time. His rule: repetition is not corroboration. A hundred versions of a story may trace to one source.

My position: for compliance and threat-intelligence teams the transferable point is documentation. Record which step of a research workflow AI performed and which step verified it. That is also how you answer an auditor.

9. The Talent Pipeline Is the Long Game

The Swiss Hacking Challenge organisers described how Switzerland builds cyber talent: an individual qualifier, a team final, and the European Cyber Security Challenge in Bochum earlier this month, plus a SwissSkills route to WorldSkills. At WorldSkills 2026 in Shanghai, Switzerland finished third overall and best in Europe, with four gold, two silver and six bronze medals and 23 Medals of Excellence, according to SwissSkills and Swissmem. These are the people who will staff your SOC in a few years, and the organisers asked the room to invest in them.

10. Trust Is Infrastructure, and AI Makes Its Signals Unreliable

An Gaiser, behavioural analyst, founder of An Gaiser Consultancy and author of Hidden Signals, closed the day. A voice, a logo, an email address or a job title does not arrive with meaning attached, she argued. People attach it. Trust is efficient and works as infrastructure rather than as a bug. AI does not need to change how humans trust. It only needs to get good enough at feeding the signals we already use. From her preparation with Christian Folini she took a Swiss example: a familiar dialect carries belonging, so a perfect synthetic voice in that dialect belongs to nobody, yet the listener still recognises home.

She acknowledged zero trust as the right technical answer and said humans cannot live in it. You cannot authenticate every colleague before coffee. Social engineers do not only forge the signal. They shift the state in which you read it, through urgency, authority, fear, scarcity, attachment and shame. Awareness is not immunity, she said, awareness is earlier recognition. The consequence for a CISO is what happens after the click. When the expert arrives and asks why the user fell for it, that user stops reporting. Her alternative questions: what happened, what changed during the interaction, what made reporting harder. In the Q&A she added that people comply most with what they work out themselves, which is why she teaches Socratic questioning.

This connects the day. Gibson wants a workforce that tells you what it uses. Lubich says training will not reach everyone. Ahmed measures the gap from outside. Morgenstern asks whether you can revoke what you cannot see. Gaiser explains what they all depend on: people have to be willing to tell you.

The people behind the day

Dr. Christian Folini is program chair of Swiss Cyber Storm and moderator of the Arena track. He curates the line-up every year, represents civil society on the steering committee of the National Cyberstrategy, and holds a PhD in medieval history, which the conference says taught him to explain hard technical problems in plain language. On the day he said more than once that he is only the face of a large team, and he credited the partners whose support keeps tickets affordable in an expensive venue. The conference asks the same feedback questions every year, so it holds a ten-year trend. The next edition is on 26 October 2027 at the Kursaal Bern.

Shaadhanaa Manviannan, AI Village organiser and webmaster of the conference, presented the spin-off. The AI Village debuted as a co-located track at Swiss Cyber Storm 2025 and returns as an independent event under the same brand on 27 January 2027 at the School of Engineering and Architecture in Fribourg, according to aivillage.ch. She described two focus areas, AI to improve cybersecurity and securing AI itself, with talks, workshops, training sessions, CTFs and poster sessions. A community event grown from a track in about a year says something about where Swiss practitioners want depth.

What Swiss Security Teams Should Do This Week

Ten takeaways can feel abstract. These seven actions turn them into work for this week.

• Test your AI inventory against evidence you already hold: browser extension lists, OAuth grants in your identity provider and proxy logs for AI domains. Each gap is a gap against the completeness FINMA assessed in section 2.2 of Guidance 08/2024.
• Compare your internal asset inventory with an outside-in view: scan your own address space the way an attacker would, and explain every difference, including forgotten development instances and third-party deployments.
• Start the cryptographic inventory: follow section 3.2 of Guidance 05/2026, covering in-house, outsourced and procured-as-a-service systems, and put a board-adopted strategy and a roadmap date no later than mid-2027 on the agenda.
• Give each AI agent its own identity: then time a revocation end to end, from the decision to the moment the agent can no longer act.
• Measure your sanctioned share: personal versus company-managed AI accounts, the way Netskope does. If the managed share is not rising, the approved tools are not the easy path.
• Review any AI code reviewer or automated approver: it must not execute the code it reviews, must not take instructions from the text of the change, and must fail closed.
• Rewrite the first questions after an incident: from why-did-you-click to what-happened, and agree an out-of-band check for voice and payment requests.

The day was not a forum for easy answers. It was a room of practitioners who agreed on the diagnosis, that what you cannot see you cannot protect, and who differed on the cure: manage the shadows, doubt they can be contained, outcompete them with better tools, or make it safe to admit them. The teams that treat visibility as a trust problem as much as a tooling problem are better placed than those that assume the next scanner will find everything.

Sources

• Swiss Cyber Storm 2026 schedule, session and speaker pages: 2026.swisscyberstorm.com
• FINMA Guidance 08/2024 (18 December 2024) and Guidance 05/2026 (9 July 2026): finma.ch
• Microsoft and LinkedIn, 2024 Work Trend Index: blogs.microsoft.com
• Netskope Cloud and Threat Report 2026, as reported by Cybersecurity Dive
• IBM Cost of a Data Breach Report 2025 and 2026: ibm.com/reports/data-breach
• Zenity Labs, PleaseFix, 3 March 2026: zenity.io. Koi Security, Urban VPN Proxy and ClawHub audits, as reported by Dark Reading and eSecurity Planet
• Google Threat Intelligence Group, AI threat tracker, 5 November 2025: cloud.google.com
• OpenAI and Hugging Face incident disclosures, July 2026, as reported by Malwarebytes
• Anthropic, threat intelligence report, September 2026, as reported by secondary sources
• IBM quantum roadmap; HSBC press release, 25 September 2025: hsbc.com
• NewsGuard, Pravda network audit, March 2025, as reported by Techdirt
• WorldSkills 2026 results: Netzwoche, Swissmem
• AI Village: aivillage.ch