Hack.lu 2026

The paradox is brutal. The very tools we build to defend against surveillance states are increasingly indistinguishable from the surveillance apparatus itself. Every behavioral analytics engine, every threat-hunting AI, every "zero trust" architecture that watches users as closely as it watches attackers, results in building a panopticon in the name of stopping the Panopticon.

Ten years ago, a warning like this would have sounded like science fiction. Today, it reads like Tuesday morning's breach report. Artificial intelligence has also industrialized cybersecurity for both attack and defense. But it has done so inside a mass surveillance environment that never sleeps, never forgets and increasingly never asks permission. We are living through what I now call "mass privacide” as the systematic, industrial-scale elimination of human agency and privacy as a condition of existence.

This talk is not about buying or making more tools. It is about changing the very geometry of cyber defense design approaches and using novel analog living systems and mathematical modeling to meet the global cyber battlefield challenge head-on, as the old playbook Is structurally losing and falling further and further behind.

The cybersecurity arms race is not new. Its velocity is. Real-world attacker-defender events show a sobering truth. When threat intelligence signals are siloed rather than cross-correlated across attack surfaces, the defender's per-surface effectiveness then collapses toward zero as the attack surface grows. And especially in an AI-enabled environment.

Yet a full signal correlation can neutralize the attacker's structural advantage from surface proliferation. This single design approach should reorganize how we think about the problem. Yet we keep developing and buying point solutions that optimize local detection while guaranteeing global blindness.

The old playbook assumed defense could win by being faster, smarter, or more numerous at individual choke points. The new reality is that attackers need only one path through while defenders must win everywhere, simultaneously, forever. That is not a contest we can win by incremental improvement. On the other hand, biological immune systems do not try to predict every possible pathogen. They build architectures that make unpredictability itself a defensive asset.

This talk focuses on proposing a new set of core design principles and approaches for consideration based on biological immunity and mathematical models that offer a blueprint for cyber defenses that does not require omniscience. The cyber immune system survives not because it knows every threat in advance, but because it is structured to learn, adapt, and coordinate without centralized command.

The intended outcome is to stop trying to predict the next attack vector or surface and start designing and then building cyber defense systems that make the attacker's unpredictability irrelevant through analog thinking, zero trust, and proposing design options through layered, redundant, adaptive architecture. And making the networked, societal body functionally impenetrable, resilient and continuously adaptable through context-dependent threat assessment, multi-signal activation that prevents false positives and long-term immunological memory.

These are not metaphors. They are engineering design specifications while also computing on secrets without revealing them through homomorphic encryption, secure multi-party computation and trusted execution environments as a new way to analyze threat data across boundaries without creating new surveillance honeypots.

The technical capability exists now to compute on encrypted data without decrypting it. The default institutional and community will does not. This is the privacy-preserving future of threat intelligence sharing through collaborative defense that does not require surrendering the very data we are trying to protect while never forgetting the human layer and rewarding honesty over punishing failure.

Every cybersecurity team knows the pattern. An incident occurs, someone reports it, and the organization's response is to punish the person who exposed the vulnerability. This creates a perverse incentive structure where hiding problems becomes rational behavior. The result? Vulnerabilities fester faster and faster until they become catastrophes and end up in the latest hacker news reports. Biological immune systems do not punish cells for signaling distress. They respond proportionally, learn from the encounter, and strengthen the system.

Our analog, human-layered security culture must do the same. It is the precondition for every freedom and liberty that follows. The task ahead is not invention. And it requires enough architectural humility to ensure that the cyber shields we build never quietly become part of the very surveillance apparatus we were trying to defend against. What a paradox. But so much is at stake.