A patient is admitted to a hospital in Nantes. A trade settles on Portugal’s financial markets. A Swiss company gets an early warning about a new threat. In Tallinn, the national CERT fields an incident report. Most people never think about the security behind moments like these, and that is the point. The seven cyber leaders below are responsible for keeping hospital care available, government services dependable, sensitive information protected, and financial institutions trustworthy, across seven European countries.
Cédric Cartau – CISO & DPO, CHU de Nantes and GHT 44
Six books, a magazine column, and 17 years running information systems security at a French university hospital. Cédric Cartau has led security at CHU de Nantes since 2009 and now serves as both CISO and data protection officer for the hospital and its territorial hospital group, GHT 44, protecting the patient information and systems behind care. In March 2026 he joined a DSIH webinar on preparing hospitals to recover when an attack takes systems offline. Before Nantes, he held IT roles at the university hospitals of Reims and Rennes, so nearly his entire career has been spent inside French hospitals. His six books on information systems are published by Presses de l’EHESP, where he has also taught, and he writes a column for DSIH Magazine.
Jorge Fernandes – CISO, DPO & Director of the Internal Control Office, CMVM
Three titles, one regulator. At Portugal’s securities supervisor, the CMVM, Jorge Fernandes serves at once as CISO, data protection officer, and director of the internal control office. It is a return to familiar ground. He joined the CMVM as a security and network engineer in 1998 and later served as its chief security officer, before working as senior information security officer at the European Securities and Markets Authority and CISO of the Council of Europe Development Bank. From 2022 to 2025 he represented the CMVM on the European Supervisory Authorities’ sub-committee on digital operational resilience, which helps the authorities carry out their mandates under DORA. A regular speaker, he presented “Lessons from a blackout” at the CISO 360 Global Congress in 2025 and returned to its speaker lineup in 2026.
Mai Kraft – Director of NCSC-EE & Deputy Director General for Cyber Security, Estonian Information System Authority
“Estonia’s success as a digital nation cannot rely on innovation alone,” Mai Kraft said when she took over the country’s National Cyber Security Centre in August 2026. “Trust, crisis preparedness and the ability to respond to rapidly evolving cyber threats are equally essential.” Selected through an open competition that drew 22 candidates, she now leads the national CERT and cybersecurity supervision under Estonia’s Cybersecurity Act, oversees development of the Estonian Information Security Standard, and works to strengthen the resilience of the state and critical infrastructure. Her stated priorities include modernizing critical digital infrastructure, preparing for the quantum era, and making secure behavior the natural choice for people. She comes from Elisa Estonia, where she started as a monitoring specialist in 2010 and served for nearly eight years as CISO, responsible for the company’s overall cybersecurity function.
Florian Schütz – Director, Swiss Federal Office for Cybersecurity
Florian Schütz built the office he now runs. Elected Federal Delegate for Cybersecurity in 2019, he established Switzerland’s National Cyber Security Centre and led it until it became the Federal Office for Cybersecurity, which he has directed since January 2024. He reports to the head of the Federal Department of Defence, Civil Protection and Sport, serves as the government’s contact on cybersecurity for policymakers, the media, and the public, and is responsible for the coordinated implementation of Switzerland’s National Cyber Strategy. He also chairs the OECD’s Working Party on Security in the Digital Economy and serves as a militia captain in the Swiss Armed Forces’ Cyber Defence Staff. His earlier career was in industry: he built Switzerland’s first cyber training center at RUAG in six months and led IT risk and security at Zalando.
Anssi Kärkkäinen – Deputy Director General & Head of the National Cyber Security Centre, Traficom
Before he took charge of Finland’s National Cyber Security Centre in March 2024, Anssi Kärkkäinen had already led the cyber division of the Finnish Defence Forces’ C4 Agency and served as CIO, CISO, and CSO of a commercial network company. He spent more than 17 years with the Finnish Defence Forces, finishing as chief military engineer, then five years at Finnish network company Cinia, where he directed its service and cyber security center before taking on its top technology and security roles, and later co-founded the startup CyberDo. Now head of NCSC-FI and deputy director general of Traficom, he leads a center whose work brings authorities and businesses together, including the TIETO26 exercise in September 2026, which developed their cyber preparedness in cooperation.
Félix A. Barrio – Director General, INCIBE
Félix A. Barrio joined Spain’s National Cybersecurity Institute in 2007. Since June 2022, he has run it. In between, he led INCIBE’s innovation and quality work, then its cybersecurity area, and later served as deputy director for cybersecurity for society and business, giving him an inside view of an institute that serves citizens, businesses, and the country’s strategic operators. Under his leadership, INCIBE launched an initial group of 15 endowed cybersecurity chairs at Spanish universities and more than 120 R&D projects with companies through innovative public procurement. His wider record includes coordinating the Spanish translation of the ISO 27000 standards series, serving on the board of the European Cyber Security Organisation, and directing the Cyber Security Hub at Tecnológico de Monterrey in Mexico City. He holds a PhD from the University of Salamanca and the CISM certification.
Serafino Sorrenti – CISO, Presidency of the Council of Ministers
Quantum technologies, submarine cables, and the systems at the center of Italy’s government all fall within Serafino Sorrenti’s remit. As CISO of the Presidency of the Council of Ministers since September 2024, he protects those government systems, and he is a permanent member of the National Cybersecurity Agency’s cybersecurity unit, which supports the prime minister on crisis prevention, preparedness, and alerts. He also heads the technical secretariat of the Undersecretary of State for Technological Innovation and Digital Transition. He coordinates the working group for Italy’s quantum strategy, represents Italy at European meetings on quantum technologies and the security of submarine cables, and is promoter and executive vice president of the Digital Commons EDIC, which builds shared European digital infrastructure. He began his career as a Unix systems engineer and teaches AI and cybersecurity at Università eCampus.
From Industry to Public Service
Three of the four leaders of national cyber agencies here came most recently from industry: Schütz from Zalando, Kraft from Elisa Estonia, and Kärkkäinen from Cinia and a startup of his own. The other four have built long careers inside public institutions, from French hospitals to Portugal’s market regulator, Spain’s cybersecurity institute, and the Italian government.
Discover more CISOs securing their organizations:
-
- Building the Profession: Europe’s Cyber Community Leaders to Watch
- Honored in 2026: Europe’s Award-Winning Cybersecurity Leaders to Watch
- Protecting the Services Canadians Rely On: The Cyber Leaders to Watch
- 10 ORBIE Award-Winning Cybersecurity Leaders to Watch in 2026
- 10 Cyber Leaders Bringing Local Experience to MS-ISAC’s Next Chapter
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.