Luxembourg Set To Host Cyber Event VulnOptiCON 2026

FIRST rebrands Vuln4Cast as VulnOptiCON 2026, a three-day Luxembourg conference on AI, vulnerability forecasting and exploit prediction, Sept 23-25.

Luxembourg will host VulnOptiCON 2026 from September 23 to 25, as FIRST expands its Vuln4Cast initiative into a full three-day colloquium on vulnerability management. Held in partnership with national CSIRT CIRCL, the event comes as Common Vulnerabilities and Exposures (CVE) disclosures pass 66,000 this year, raising fresh questions about AI’s role in both discovering and exploiting flaws.

Keynotes come from AISLE’s Jaya Baloo and forecasting expert Regina Joseph, alongside speakers from CISA, NCSC UK, ENISA and NVIDIA. Registration is open now at vulnopticon.org.

Silicon Luxembourg put a few questions to Jeroen van der Ham-de Vos, FIRST liaison member and associate professor of Cyber Security Vulnerability Management at the University of Twente.

Why rebrand Vuln4Cast into VulnOptiCON now, and what does the 3-day format add?

The name VulnOptiCON is used to show that we care about details of every vulnerability, not just forecasting. The initiative of Vuln4Cast started with the desire to experiment with forecasting, but we quickly discovered that for forecasting you need good data. So quality issues started to become more important, other things also naturally popped up as the implications of the forecasting result, etc. We discovered that the topic of vulnerabilities allowed for many interesting angles, so we chose a new name to reflect that.

What does “The A-Eyes See All” mean in practice — how is AI changing vulnerability discovery and exploitation?

We already see the effect of AI on vulnerability statistics. The number of CVEs was going up, due to AI it is now going up at an even faster rate. At the same time, AI systems also make it a lot easier to analyze all vulnerabilities and do trend analysis, forecasting or other creative interpretations on the data. So the theme this year is the combination of data and AI in the vulnerability space.

Why Luxembourg for 2026, and what does the CIRCL partnership bring to the local ecosystem?

VulnOptiCON (and the preceding Vuln4Cast) traveled through Europe and we look for interesting European venues each year. This year CIRCL offered to host, and we are grateful for their support in organising this year’s event.

With 66,000+ CVEs this year, what’s the biggest shift teams need to make from reactive to forecasting?

We imagine that every speaker at the conference will have a different insightful answer to that question. So your best bet is to come and see what they have to say.

What should attendees walk away with after the three days?

Vulnerabilities are the bread and butter of cybersecurity, but it is still an exciting and underexplored topic. Each year we find insightful new takes on vulnerability trends, history or other related new developments.