A Forrester Analyst on the Security Roles Coming Next — and What AI Makes Obsolete in Cybersecurity | A Conversation with Madelein van der Hout | On Location With Sean Martin And Marco Ciappelli — Infosecurity Europe 2026

About this episode

ON LOCATION | Sean Martin & Marco Ciappelli — Infosecurity Europe 2026

Two conferences, two moods: at RSA the drumbeat was resilience; at InfoSec, it's sovereignty. Sean and I close the week with Forrester analyst Madelein van der Hout — beaming in from the Netherlands — on why Europe makes a framework out of everything, what AI deployment is doing to the boardroom, and the security jobs that don't exist yet.

📺 Watch | 🎤 Listen | ITSPmagazine.com

There's a building across the Thames from the InfoSecurity press room — Millennium Mills, a derelict flour mill that looks precisely as haunted as it sounds. I kept glancing at it while Sean and I talked with Madelein van der Hout, who this year was a kind of friendly ghost herself: fully in the conversation, quick as ever, and across the North Sea in the Netherlands. She couldn't make it to London this year. FOMO, she told us, is real.

Which turned out to be the point. Madelein is a senior analyst at Forrester — she reads this industry for a living — so the first thing we did was compare notes on what the week actually felt like. Sean kept hearing one word on the show floor: sovereignty. A few weeks earlier at RSA in San Francisco, the drumbeat had been resilience. Same industry, two continents, two moods. Madelein said it better than I could: RSA is where her blood pumps with enthusiasm for everything technology can do, good and bad, and InfoSec is where she comes to get grounded in reality. Flashy versus pragmatic. The far edge of the possible versus the guardrails.

Europe, she said with affection, will make a framework out of anything — the cloud sovereignty package announced that week being the newest one. And under all the frameworks sits the thing no European conference can avoid: hybrid warfare, close enough to feel.

AI is moving from experimentation to deployment inside real organizations, and the moment it does, it stops being a demo and becomes a liability that lands on a boardroom. That, Madelein argued, is what you're feeling here — the weight of being responsible for something you've only just let inside the walls. Her research points somewhere specific: security is drifting toward becoming a "trust and assurance" function, and with it come jobs that don't exist yet. Trust engineers. Agentic workflow assurance engineers. People whose whole task is to confirm that an AI agent did what the business actually intended, not just what it was told.

Sean's read was sharp: almost nothing on the expo floor addresses any of that. They're architecting for now, Madelein agreed, not for what's coming. Which is the oldest story in technology — we shout about the future and keep building for the present.

Near the end we argued about metaphors, which is the kind of thing I live for. I reached for Frankenstein: all these tools and agents and smart-city systems stitched together into something we then have to teach to move as one. Madelein offered a better image. Don't build a Frankenstein, she said — become a jellyfish. There's a species that works as a neural network, and when two of them are injured and collide, they don't compete. They merge and swim on as a single organism. More than synergy, Sean said. Exactly.

We spend enormous energy bolting parts together and calling it integration. Madelein is describing fusion instead of assembly — one organism, not a monster made of seams.

She's already made her peace with what all this means for her own work. This job will be automated, she said, maybe most of it, and she cannot wait to help reinvent what an analyst even is. That was the healthiest thing I heard all week. Not "will AI take my job," but "what is this job becoming."

So I'm watching a ghost mill through the rain while a colleague beams in from another country, and the question under all the frameworks and the shiny new job titles is quieter than any of them.

When everything can be orchestrated, what still has to be human?

Let's keep thinking.

The full conversation is part of our On Location coverage of Infosecurity Europe 2026 at ITSPmagazine.com. For more of my writing, subscribe to the newsletter at marcociappelli.com.

— Marco (with my co-host, Sean Martin)

Co-Founder ITSPmagazine & Studio C60 | Creative Director | Branding & Marketing Advisor | Personal Branding Coach | Journalist | Writer | Podcast: An Analog Brain In A Digital Age ⚠️ Beware: Pigs May Fly | 🌎 LAX🛸FLR 🌍

More from our Infosecurity Europe 2026 coverage:
Infosecurity Europe 2026 event coverage
Technology and cybersecurity conference coverage

About the Hosts

Marco Ciappelli is Co-Founder & CMO of ITSPmagazine, Co-Founder & Creative Director of Studio C60, and host of An Analog Brain In A Digital Age. Born in Florence and based in Los Angeles, he explores the intersection of technology, society, storytelling, and creativity. 🌎 marcociappelli.com

Sean Martin is Co-Founder of ITSPmagazine and host of the Redefining CyberSecurity Podcast, where he examines how to think about and operationalize security in the context of business. Together, Marco and Sean produce On Location event coverage from cybersecurity conferences around the world. 🌎 seanmartin.com

About the Guest

Madelein van der Hout is a Senior Analyst on the Security & Risk team at Forrester, based in the Netherlands. She leads Forrester's research on security organizational structure and operating models, and covers European security strategy, resilience regulation (including DORA and the Cyber Resilience Act), digital sovereignty, and API security. She advises security leaders on building and maturing their programs, and is frequently asked to comment on technology by outlets including the BBC, the Financial Times, and CIO Magazine. Before Forrester she worked at the Dutch telecommunications company KPN across innovation, transformation, cybersecurity, and identity.

LinkedIn | Forrester biocxx

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.