Flavia Santoro specializes in the development of international platforms for business, innovation, and knowledge exchange. She is currently part of Fira de Barcelona as director of the Barcelona Cybersecurity Congress (BCC) and deputy director of Construmat. Her leadership in this type of Barcelona event helps bring together companies, institutions, and sector experts to address key challenges in digital transformation, cybersecurity, and sustainable construction in emblematic spaces. Her tasks focus on creating opportunities for collaboration, internationalization, and growth through the construction of ecosystems that foster innovation, knowledge exchange, and the development of new businesses. She receives The New Barcelona Post to talk about the next edition of the BCC, the perspectives of the business future in the face of technological advances, and the importance of digital security in companies, both multinationals and SMEs.
—The seventh edition of the Barcelona Cybersecurity Congress comes at a time when cyber incidents in Catalonia have almost doubled in one year, from 3,372 to 6,544. What explains this jump: more attacks, better detection, or both?
—Probably, both. We are exposing ourselves more to risk because we increasingly have more connected systems, more digitized services, and more technological dependence. And, at the same time, detection, monitoring, and response tools are far superior to those of a few years ago.
However, reality is stubborn. And the figures indicate that the threat is real and growing. As you point out, the Cybersecurity Agency of Catalonia managed 6,544 unique cyber incidents in 2025 and detected more than 9,100 million attack attempts, more than 7,000 million of which were automatically and immediately blocked. And, in Spain as a whole, INCIBE registered 122,223 cybersecurity incidents in 2025, 26% more than the previous year. Therefore, we are not just talking about a matter of perception or better detection. We are facing a real and growing threat.
—Should cybersecurity be a country strategy? Should private companies, but also public administration, collaborate to build a joint cybersecurity strategy?
—That's right. Cybersecurity can no longer be addressed in isolation. A vulnerability in one company can affect its suppliers, its customers, or even critical infrastructures. That's why we must think in terms of ecosystem and collective resilience. And that's why an event like the Barcelona Cybersecurity Congress is useful, because a meeting point is needed between administrations, companies, infrastructure operators, universities, research centers, and specialists to share knowledge and find solutions jointly.
"A vulnerability in one company can affect its suppliers, its customers, or even critical infrastructures"
—AI appears as one of the main threats. What is the specific risk that worries you most today, and which one do you think is most overrated?
—Perhaps, the most worrying thing is AI's ability to cause attacks more quickly and effectively. In this sense, I believe we are overestimating the risks rather than also the benefits of AI. Because we should not forget that AI is also a defense tool. I believe AI is transforming the cybersecurity landscape on both fronts. Thus, for attackers, it can help them generate more convincing phishing messages in various languages, personalize social engineering techniques, automate certain phases of attacks, and create more credible impersonations of executives or business partners, in addition to reducing some of the entry barriers and allowing criminals to operate more quickly and on a larger scale. But, as I said before, AI is a very powerful defensive tool, as security teams can use it to analyze large volumes of data, identify unusual behaviors, prioritize alerts, investigate incidents, and accelerate the detection and response to threats.
And we also have to recognize a new category of risks, which are the AI systems themselves. In this case, companies must protect the data they introduce, control access to AI agents, and address vulnerabilities in models, applications, and connected systems. I believe the challenge lies in using AI responsibly with adequate security controls, human supervision, and clearly defined responsibilities. And I think that, in the age of AI, organizations that combine intelligent automation with solid governance, qualified professionals, and robust security foundations will have an advantage.
—Since the first edition, what has changed most, both in terms of topics and audience type?
—I think that cybersecurity has ceased to be a concern exclusively for experts and is now a strategic issue for administrations, companies, industry, or for any of us given the degree of expansion and exposure in an increasingly interconnected world. And this fact also explains the evolution of our audience. We still need technical profiles that, on the other hand, have evolved, as is the case of the CISO, because the regulations on the matter have made cybersecurity escalate to the boards of directors of companies. For this reason, the CISO's role is much more strategic. As well as other decision-making profiles such as CEOs, CTOs, and CIOs who understand the importance of cybersecurity at all levels. The program of this seventh edition mainly addresses cybersecurity as a strategic business and reputational factor.
—The congress coincides with Smart City Expo and other fairs. How can a cybersecurity visitor take advantage of this, and what synergies are there with smart cities and mobility?
—It is one of the great differential values of this year's edition. We can no longer talk about smart cities, connected mobility, energy, or urban infrastructures without simultaneously talking about cybersecurity. The more connected a city is, the more important it is to guarantee the security and resilience of the systems that make it work. The simultaneous celebration of these events will allow a cybersecurity professional to leave their immediate field and come into contact with the sectors where the technologies they will have to protect are being deployed.
"This year we have 111 exhibiting companies, 34 sponsors, and more than 150 international speakers"
—You talk about moving from theory to practice. How is this reflected in the program, and which session would you recommend to someone who can only dedicate one day to it?
—When we talk about moving from theory to practice, we mean putting real problems on the table and connecting the organizations that have them with the knowledge and solutions that can address them. This year we have 111 exhibiting companies, 34 sponsors, and more than 150 international speakers. However, if I could only choose one area, I would especially recommend following the session on cyber resilience in the industrial supply chain. It is an extraordinarily practical problem because today the security of an organization also depends on that of its manufacturers and technological suppliers.
—What role do Barcelona and Catalonia play in this map of European cybersecurity, compared to other hubs like Finland or Portugal, which send representatives?
—Organized jointly by Fira de Barcelona and the Cybersecurity Agency of Catalonia, BCC puts Barcelona on the map as a connection point for the cybersecurity ecosystem, especially between innovation, industry, institutions, and the market. And this is evident in the congress program, which features world-renowned cybersecurity experts such as
Pekka Jokinen, Deputy Director General of the National Cybersecurity Centre of Finland, and Lino Santos, Head of the National Cybersecurity Centre of Portugal, as well as experts from international companies and institutions. This allows not only to explain what is done here, but also to compare models, share learnings, and build European alliances.
—What specific alliances or projects have emerged in previous editions thanks to the congress?
—I cannot give specific names for prudence and confidentiality. What I can say is that BCC is conceived as a space to generate business opportunities and promote alliances between public institutions, research centers, technology companies, and digital security managers. In this regard, I would like to highlight a round table that, led by David Esteban, CISO of the Barcelona City Council, will bring together CISOs from cities, large companies, and critical infrastructures.
—Many SMEs think they are not targets of attacks. How do you reach these companies? Is there a budget in SMEs to invest in cybersecurity?
—The most important and the first thing we must combat is precisely this perception because an SME is no less interesting to an attacker just because it is small. It is also on the radar of cybercriminals because it can have valuable data, or become a gateway to a larger client or supply chain.
In this case, I believe the issue is not what an SME spends but what it saves if it applies a cybersecurity strategy adapted to its scale and business model. An SME does not need to start with the most expensive cybersecurity technologies, but it should prioritize five measures such as activating multi-factor authentication, especially for email, remote access, and cloud services; keeping operating systems updated; having reliable backups; offering practical training to employees to help them recognize attacks such as phishing attempts, identity impersonations, or payment requests; and restricting access to sensitive systems.
"We want to contribute to building a cybersecurity culture in the business and industrial sectors"
Companies must also ensure that external IT service providers apply security practices and, if they cannot rely on their own team, hire security services from external specialists. At BCC, an SME can find specialized knowledge and solution providers. Because, with 111 exhibitors such as EY, Fortinet, Cisco, SoSafe, Mastercard, Sophos, Trend Micro, or ThreatLocker, among others, an SME will be able to find someone to help them in this area.
—The CISO Leadership Awards —which will be presented during the BCC— have received 65 nominations. What does the jury look for in a good cybersecurity leader, beyond technical skills?
—The awards recognize an important reality, which is that cybersecurity is no longer solely a technical responsibility. It is a strategic priority that requires leadership, investment, and collaboration from the entire organization. Our 22 finalists are professionals who are making a difference in areas such as innovation in cyber defense, the protection of critical infrastructures, or public sector security. Our goal is for the awards to help strengthen the role of CISOs on boards of directors and encourage business leaders to integrate cybersecurity into strategic decision-making, in addition to giving visibility to examples of good practices. What we want is to contribute to building a culture of cybersecurity in the business and industrial sectors.