War does not begin with a shot, but with a disruption

Pieter Cobelens at Cybersec Netherlands 2026

It is Monday morning. Containers are no longer leaving the Port of Rotterdam, part of the payment system is down and several hospitals switch to emergency procedures. There are no explosions, no tanks at the border and no fighter jets in the air. Yet the Netherlands has been attacked.

This scenario is no longer science fiction. Cyberattacks on critical infrastructure, disinformation campaigns and digital sabotage have become fixed components of geopolitical power. The question is no longer whether digital conflicts are taking place, but how well countries and organisations are prepared for them. That is also the central theme of the keynote that retired Major General Pieter Cobelens will deliver during Cybersec Netherlands 2026 on 9 and 10 September at Jaarbeurs Utrecht.

Critical digital infrastructure

Anyone who still thinks cybersecurity is purely an IT issue is already behind the curve, according to Cobelens. Cybersecurity has become a strategic issue in which technology, economics, defence and geopolitics converge. The digital infrastructure that governments, businesses and citizens rely on every day has become just as critical as the physical infrastructure of roads, ports and energy systems.

The Netherlands is particularly vulnerable in this regard. The country is one of the most digitised economies in the world. Internet exchanges, hyperscale data centres, logistics chains, financial services and cloud platforms together form the digital foundation of the Dutch economy. That position brings economic advantages, but at the same time makes the Netherlands an attractive target for state actors, cybercriminals and other malicious parties.

Advanced attack techniques

The war in Ukraine has also made clear how quickly the nature of conflict is changing. Where military power was once almost exclusively reserved for states with enormous defence budgets, relatively inexpensive drones now allow smaller actors to cause significant damage. According to Cobelens, the same democratisation is taking place in the cyber domain. Advanced attack techniques are becoming more accessible, while artificial intelligence is lowering the threshold even further.

AI is fundamentally changing the playing field. Where attackers once needed highly specialised knowledge to develop convincing phishing campaigns or malware, generative AI can now automate large parts of that process. Deepfakes are becoming more realistic, attacks more scalable and disinformation more convincing. As a result, the boundaries between cyberwarfare, information warfare and psychological influence are becoming increasingly blurred.

AI detects and neutralises

That does not mean defenders are powerless. AI is also becoming increasingly important on the defensive side. Modern security platforms analyse millions of events per second and detect anomalies that remain invisible to human analysts. According to Cobelens, the consequence is that cybersecurity is becoming less a battle between people and increasingly a battle between algorithms. In the coming years, a permanent technological arms race will emerge in which AI develops attacks and AI detects and neutralises those same attacks.

And the development does not stop there. The next technological revolution is already appearing on the horizon: quantum computing. Quantum computers promise major breakthroughs in simulations, logistics, materials research and defence. At the same time, they pose a direct threat to the encryption on which almost all digital communication is based.

Post-quantum security

This creates a strategic risk of which relatively few organisations are currently aware. States are already collecting large volumes of encrypted data today, not because they can read it now, but because they expect future quantum computers to be able to do so. This strategy, known as Harvest Now, Decrypt Later, means that information that appears secure today could still become exposed in ten or fifteen years. Organisations working with sensitive data will therefore need to move to post-quantum security much sooner than expected.

Alongside technological developments, Cobelens also questions the dependence on foreign digital infrastructure. Digital sovereignty, in his view, is not about protectionism, but about control. When critical data, cloud platforms and communication channels fall entirely outside a country’s own jurisdiction, that country inevitably gives up part of its strategic autonomy. The debate about a national cloud or other forms of digital control therefore affects not only the IT sector, but also the economy, governance and national security.

The core of modern deterrence

The most important conclusion may be that resilience is no longer solely the responsibility of defence organisations. Critical infrastructure is largely in the hands of private companies. An attack on a logistics provider can affect food supply. A disruption at a cloud provider can hit hundreds of organisations at once. A cyber incident at a hospital can escalate into a national crisis. Digital resilience is therefore a shared responsibility between government, business and society.

According to Cobelens, this is ultimately also the core of modern deterrence. During the Cold War, deterrence revolved around military power. In the digital age, credible deterrence is determined by a combination of cyber capability, economic strength, technological innovation and societal resilience. An adversary must be convinced that an attack will yield too little and cost too much.

Digital war has already begun

This strategic view of cybersecurity forms the common thread of Pieter Cobelens’ keynote, which will open the second day of Cybersec Netherlands 2026. Not to outline a future scenario, but to make clear that digital war has already begun. Investing in resilience may therefore be the most important form of defence the Netherlands can organise today.