Exploitable, Not Just Vulnerable: Security Under CRA and NIS2
Every scanner can hand you a list of vulnerabilities. Far fewer teams can say which of them an attacker could actually use.
With the Cyber Resilience Act’s reporting duties already running and NIS2 now part of Portuguese law, that gap matters more than it used to. Regulators and customers want evidence that you test regularly, fix what matters, and can prove it.
Critical Ventures is bringing together security leaders, engineers, founders and compliance people in Lisbon to talk about what this looks like in practice. We’ll cover how to separate real exposure from background noise, how continuous testing fits with what CRA and NIS2 expect, and what lean teams can do without hiring a red team.
Expect short talks, honest conversation and time to meet others dealing with the same questions.
Agenda
09:30 Welcome, with Heitor Benfeito (Critical Ventures)
10:00 CRA in practice: what changes for teams building products with digital elements, with Anamta Khan (Cyber Security Engineer at Critical Software)
10:20 Thousands of vulnerabilities, a handful of real attack paths: making autonomous red teaming trustworthy, with Harold de Vries (CEO/Co-Founder of Hackurity)
10:50 Continuous Security Testing, with Robin Attinkara (Information Security & Compliance Manager at Flip AI)
11:20 Alstom, with Eddy Thesee (VP Cybersecurity at Alstom)
11:40 Compliance in an age of AI vulnerability discovery, with Bob Lyle (CRO at RunSafe Security)
12:00 Networking with complementary food and drinks
Who it’s for: CISOs, heads of security and IT, product security and engineering leads, and founders building connected products or serving regulated customers.
Date: 11 November 2026, 9:30 am to 1 pm
Location: Critical Software, Lisbon