GOhack26: AI, trust and the power of connection

On 29 and 30 October 2026, the Swiss cybersecurity community gathered at the FFHS Gleisarena in Zurich for the fourth edition of GOhack. The programme combined talks and workshops with a symposium on strategic cyber risks and a Live Bug Bounty Challenge, where ethical hackers searched for vulnerabilities in real-world systems.

What makes GOhack special is the diversity of people and perspectives it brings together. While ethical hackers searched for vulnerabilities in one room, CISOs and business leaders discussed cyber risks and governance next door. Students met experienced security professionals, and technical experts exchanged ideas with business decision-makers. After all, many of today's cybersecurity challenges cannot be solved through technical or organisational measures alone.

The enemy within: When trust becomes an attack surface

Thursday evening's symposium explored the theme "The Enemy Within: Supply Chains, Insiders, AI". At its heart was the question of how organisations can manage risks that emerge in places where trust is usually taken for granted.

Roman Hüssy from the Swiss National Cyber Security Centre (NCSC) provided a national perspective on emerging threats. One notable observation: as of the symposium, no attacks involving autonomous AI agents had been reported to the NCSC. That does not necessarily mean such attacks have not occurred.

Silvan Schellenberg from UBS used a real-life insider attack to illustrate the devastating consequences of misused access privileges. The perpetrator didn't need to find a security vulnerability because his position within the organisation already gave him the access he needed. Although the incident took place around 25 years ago, the underlying issue is more relevant than ever.

AI agents are now creating a new form of insider risk. Dr. Sina Wulfmeyer from Unique AI explored how these agents are increasingly taking on tasks autonomously, gaining access to sensitive data and systems in the process. Who oversees their decisions? And who is responsible when something goes wrong?

Software supply chains were another key focus. Dr. Stefan Lüders from CERN highlighted how difficult it can be to maintain visibility over all the software components an organisation uses and their dependencies.

Despite the different perspectives, a common message emerged: Trust is essential, but it is no substitute for oversight. Organisations need to understand their dependencies, scrutinise access privileges and remain accountable, even when tasks are delegated to third parties or AI systems.

AI everywhere. But people still matter.

Artificial intelligence was one of the dominant topics not only at the symposium but also throughout the EDU programme. Discussions explored both the opportunities and risks of AI, from autonomous security agents and AI-assisted penetration testing to threat analysis and software supply chain security.

AI is already transforming the work of security teams. It can automate repetitive tasks, analyse large volumes of data and open up new possibilities for detecting vulnerabilities. At the same time, it introduces new attack surfaces, while cybercriminals are using AI to make their attacks increasingly convincing.

Yet discussions at GOhack26 also highlighted the limitations. AI-generated results need to be verified, decisions assessed and risks evaluated within their specific business context. Not everything labelled AI automatically delivers real value.

The more tasks we delegate to AI, the more important human judgement, critical thinking and clear accountability become. This applies just as much to the daily work of security teams as it does to strategic decisions at management level.

From the hacker mindset to crisis management: Learning by doing

Alongside the strategic discussions, the two-day EDU programme offered plenty of opportunities to deepen knowledge and develop new skills.

The parallel Business and Tech Tracks covered topics including cyber resilience, digital identities, social engineering, cryptography and current attack techniques. Real-world examples highlighted the challenges organisations face and approaches that can help address them.

Hands-on learning was also an important part of the programme. In the Hack The Box workshop, participants put their technical skills to the test. Meanwhile, the interactive Security Poker workshop with BDO Digital challenged participants to make security decisions under time pressure and weigh competing cyber risks.

SWITCH offered a different perspective with its "Piece of Cake" role-playing game, allowing participants to experience how trust and human behaviour can be exploited through social engineering.

This combination of theory, practical exercises and playful learning is an integral part of GOhack. After all, cybersecurity isn't something you learn by listening alone. It also takes experimentation and shared experiences.

Live bug bounty: Putting theory into practice

While cyber risks and security measures were being discussed in the conference rooms, ethical hackers were putting their skills to work.

During the approximately 30-hour Live Bug Bounty Challenge, they searched for security vulnerabilities in the real-world systems of ten participating organisations. Beyond the competition and the bounties on offer, the main objective was to identify weaknesses before cybercriminals could exploit them.

Hack for Good was also part of GOhack once again. This year's initiative supported the Swiss Cancer League, combining ethical hacking with a charitable cause.

We'll cover the results of the Live Bug Bounty Challenge and Hack for Good in separate articles.

Two days, many connections, one shared goal

What are the key takeaways from two intensive days at GOhack26? Fresh insights into current cyber risks, practical ideas to take back to work and thought-provoking discussions about the future of cybersecurity. Above all, though, countless personal encounters and new connections within the community.

Cybersecurity depends on sharing knowledge and bringing together people with different perspectives to find better solutions. That's exactly what we aim to foster through GOhack.

A big thank you to all our speakers, workshop leaders, ethical hackers, participants, partners and volunteers who made GOhack26 possible. Special thanks go to our longstanding platinum partners, FFHS and BDO Digital.

We're delighted to have brought the community together in Zurich once again this year.

Link: GOhack26 photo gallery