Events & trade fairs · CloudFest Global 2027

CloudFest Global 2027: We’ll be there.
With VamiGRC and our agentic solutions at Europa-Park.

After the show is before the show: it-sa 2026 is behind us, and preparations for CloudFest Global 2027 are under way. From March 15 to 18, 2027, the international cloud and hosting industry meets at Europa-Park in Rust, Germany – and VamiSec will be there with its own booth. At the center: VamiGRC, our agentic integrated management system for NIS2, DORA, the Cyber Resilience Act and the EU AI Act.

March 15–18, 2027
Europa-Park, Rust (Germany)
Our own booth
Focus: VamiGRC

Book a meeting What we’ll show

See VamiGRC live
Talk to Valeri Milke and the team
Book ahead or drop by the booth

At a glance

VamiSec at CloudFest Global 2027

CloudFest Global 2027 takes place from March 15 to 18, 2027, at Europa-Park in Rust (Baden-Württemberg, Germany); the organizer is WHD Event GmbH, Cologne. VamiSec, the Bonn-based specialist for AI-driven IT security and GRC, will exhibit with its own booth. There we will show VamiGRC, the agentic integrated management system for NIS2, DORA, the Cyber Resilience Act and the EU AI Act, as well as the agentic solutions VamiAppSec, VamiThreat and VamiRedteam. Meetings with Valeri Milke and the team can be booked now. We will publish the hall and booth number here as soon as the floor plan is final.

Event: CloudFest Global 2027 – conference and exhibition of the cloud and internet infrastructure industry
Dates: Monday, March 15, to Thursday, March 18, 2027
Venue: Europa-Park, Europa-Park-Straße 2, 77977 Rust, Germany
Organizer: WHD Event GmbH, Cologne
VamiSec: Own booth – hall and booth number to follow
Focus: VamiGRC plus VamiAppSec, VamiThreat and VamiRedteam
2027 theme: “The Heart of the Cloud”
Meetings: Bookable now – at the booth or in advance via Microsoft Teams

After the show is before the show

From Nuremberg to Europa-Park

At it-sa 2026, we showed VamiGRC live for three days at the BITMi joint stand – in six demos and many conversations about NIS2, the Cyber Resilience Act, AI security and pentests. We are bringing this experience to CloudFest. Three questions are at the heart of it: How does compliance move from project to day-to-day operations? How do AI agents work transparently and under human control? And how do data and models stay sovereign?

RecapOctober 27–29, 2026it-sa 2026NürnbergMesse · Hall 7Read the recap
Next eventDecember 12, 2026VamiGRC Christmas BootcampSankt Augustin and liveTo the bootcamp
In preparationMarch 15–18, 2027CloudFest Global 2027Europa-Park · Rust

Why CloudFest

Where the cloud industry meets

Every March, CloudFest brings the international cloud and internet infrastructure industry together at Europa-Park – with a conference program, an exhibition and plenty of room for conversations. According to the organizer, 10,900 participants attended the 2026 edition.

The 2027 theme, “The Heart of the Cloud”, puts resilient, people-centered systems at the center – in an era increasingly defined by automation. This balance of automation and human control is exactly what shapes our agentic solutions.

For exactly these companies, compliance and security have become part of the business model: customers demand evidence, NIS2 explicitly covers cloud providers, data centers and managed service providers, and AI agents are changing operations. That is what we want to talk to you about.

participants in 2026: 10,900
speakers in 2026: 233
partners in 2026: 233
topic tracks in 2027: 5

2026 figures according to the organizer’s recap

Core audience according to the organizer

Cloud service providers
Hosting providers
Managed service providers
Enterprise IT
Web agencies
WordPress developers

The 2027 tracks

Five tracks – and where we connect

Alongside the main stage, CloudFest Global 2027 organizes its program into five topic tracks. For each of them, we bring practical answers to our booth.

Executing AI
AI strategies for the real world
What it is about
How companies put AI into operation purposefully and profitably – from the use case to measurable results.
What we bring
Agentic AI with clear approval rules: in VamiGRC, AI agents handle the routine work, and autonomy levels L0 to L3 determine what requires approval. You manage AI governance under ISO/IEC 42001 and the EU AI Act in the same system.
Learn moreAgentic AI security ISO/IEC 42001 EU AI Act
Build A Healthy Stack
Know your stack
What it is about
Optimizing every layer of the stack – from bare metal to the content management system.
What we bring
Security from the first commit: VamiAppSec combines SAST, SCA, SBOM, secrets, IaC and container scans as well as DAST with VamiDAST in your CI/CD – with an SBOM per release that is continuously monitored for actively exploited vulnerabilities.
Learn moreSecure SDLC VamiAppSec
Superhuman Cybersecurity
Security at AI speed
What it is about
The full security cycle from vulnerability discovery to recovery – faster thanks to AI, with humans in control.
What we bring
Speed with control: VamiThreat models threats using STRIDE and, for agentic AI, MAESTRO. VamiRedteam tests with three specialized AI agents exclusively within the authorized scope; every action is checked before execution and logged.
Learn moreThreat modeling VamiRedteam
Achieve Operational Fitness
Operational fitness
What it is about
Getting operating costs across infrastructure and staffing under control, based on current case studies.
What we bring
Less manual work in compliance: VamiGRC answers customer questionnaires with evidence for every response, assesses suppliers using OSINT, trust centers and questionnaires, and quantifies risks and measures in euros – including the return on security and compliance investment.
Learn moreSecurity questionnaire automation GRC as a Service
Mastering Compliance and Data Sovereignty
Compliance and data sovereignty
What it is about
Practical ways to meet data sovereignty and the compliance requirements of new legislation – with playbooks from policymakers and business leaders.
What we bring
One control set for many regulations: with the VamiGRC Framework Composer, you map NIS2, DORA, the CRA, ISO/IEC 27001 and other standards together. VamiGRC runs on T Cloud Public in German data centers, with a choice of language model up to bring your own LLM; on-premises is available as an add-on option.
Learn moreNIS2 DORA Cyber Resilience Act

The tracks and their program are designed by the organizer. At our booth, we show how the topics can be put into practice. All tracks on cloudfest.com

At the center: VamiGRC

Compliance as day-to-day operations – agentic and traceable

VamiGRC is an agentic integrated management system for manufacturers and operators: NIS2 for your organization and the CRA for your products in one system. ISMS, PIMS, AIMS, CSMS, and BCMS share the same assets, suppliers, risks, and evidence on one GRC graph; risks and measures are assessed in euros. AI agents handle the routine work according to your approval rules.

Free until go-live: one month of proof of value with demo data or your real data, followed by guided implementation – the license only starts at go-live. Every plan includes unlimited user accounts.

Discover VamiGRC Pricing and proof of value

VamiGRC on vamisec.com Agentic GRC engineering at Vami Research

What VamiGRC does

Five management systems in one IMS: ISMS, PIMS, AIMS, CSMS, and BCMS on the same GRC graph with a shared risk scale
VamiAI answers questions based on your IMS with source references, including in Microsoft Teams; autonomy levels L0–L3 determine what requires approval
Product Security Lifecycle for the CRA: release gates, threat modeling and TARA, plus an SBOM per release
Cyber risk in euros: assess risks and measures in monetary terms and calculate the return on security and compliance investment
Framework Composer and OSCAL: one control set for multiple standards, your own frameworks via import, through to the Statement of Applicability
Keep track of reporting deadlines under NIS2, GDPR, DORA, the CRA, and the AI Act: VamiAI drafts notifications that your team reviews and submits
Supplier Intelligence and questionnaires: assess suppliers using OSINT, trust centers, and questionnaires; answer customer questionnaires with evidence for every response

Operated sovereignly

T Cloud Public by Deutsche Telekom, exclusively German data centers
Choice of language model, bring your own LLM
On-premises as an add-on option
No AI training with customer data
VamiSec’s ISMS certified to ISO/IEC 27001

Agentic solutions

Beyond GRC: three more solutions at our booth

For us, agentic means: AI agents take on clearly defined tasks, people approve and stay in control. Besides VamiGRC, we will show three more solutions from our portfolio.

VamiAppSec

Secure SDLC & Product Security Compliance

VamiAppSec is VamiSec's LLM-assisted platform for the secure SDLC and product security compliance: seven scan types, including DAST with the fully integrated VamiDAST, run in the CI/CD pipeline you already use. All findings are mapped to OWASP and tracked in DefectDojo or your ticketing system, every shipped SBOM is monitored for actively exploited vulnerabilities, and every release produces evidence for regulations and standards such as the CRA, MDR, IEC 62443, or ISO/SAE 21434.

Learn moreSecure SDLC at VamiSec vamiappsec.com

VamiThreat

AI-Assisted Threat Modeling

VamiThreat is VamiSec's AI-assisted threat modeling platform: architecture descriptions, documents, and diagrams become an editable data flow diagram with trust boundaries, on which VamiThreat models threats using STRIDE and, for agentic AI systems, MAESTRO. For each threat, VamiThreat delivers the attack path, risk, and mitigation — the AI enriches and suggests.

Learn moreThreat modeling at VamiSec vamithreat.com

VamiRedteam

Multi-Agent Penetration Testing

VamiRedteam is VamiSec's agentic penetration testing platform: three specialized AI agents — Recon, Smart Crawler, and Pentester — test web applications, APIs, hosts, and networks exclusively within the authorized scope. Every action is checked before execution and logged, newly discovered targets are tested only after your approval, and every finding includes evidence, reproduction steps, and proof.

Learn moreVamiRedteam at VamiSec vamiredteam.com

We are happy to present further solutions such as VamiDAST, VamiReverse or VamiGuard in person. All Vami Solutions

Compliance timeline

The deadlines shaping the conversations

CloudFest Global 2027 falls in the middle of a dense regulatory phase for cloud providers, hosting providers, managed service providers and software manufacturers. An overview of the key dates, as of November 2026.

Simplified overview, not legal advice.

January 17, 2025DORA applies
Financial entities must manage their ICT service providers. The requirements reach cloud providers and managed service providers through contracts, audits and questionnaires.
Learn more
September 12, 2025Data Act applies
New rules for access to data and for switching between cloud and other data processing services.
December 6, 2025German NIS2 implementation act in force
In Germany, the NIS2 obligations are set out in the amended BSI Act. They cover cloud providers, data centers and managed service providers, among others; the legislator expects around 30,000 entities.
Learn more
August 2, 2026AI Act transparency obligations
People must be able to recognize that they are interacting with an AI, and AI-generated content must be labeled – this also affects chatbots and AI agents.
Learn more
September 11, 2026CRA reporting obligations apply
Manufacturers of products with digital elements, including software, report actively exploited vulnerabilities and severe incidents; the early warning is due within 24 hours.
Learn more
January 12, 2027Data Act: no more switching charges
Providers of cloud and data processing services may no longer charge their customers for switching – to another provider or to their own infrastructure.
March 15–18, 2027CloudFest Global 2027
We will be at Europa-Park with our booth.
December 2, 2027AI Act: high-risk obligations
For high-risk AI systems in the directly listed areas of use, the requirements apply from this date – as set by the Digital Omnibus on AI.
Learn more
December 11, 2027CRA fully applies
All obligations of the Cyber Resilience Act then apply, such as CE marking for products with digital elements.
Learn more

Valeri Milke, founder and managing director of VamiSec GmbH

Book a meeting

Meet us at CloudFest Global 2027

Want to see VamiGRC in detail or talk about your compliance roadmap? Book a meeting with Valeri Milke and the team now – at our booth at Europa-Park or in advance via Microsoft Teams.

“IT security and compliance without AI is a vulnerability.”

Valeri MilkeFounder & Managing Director · VamiSec GmbHISO/IEC 27001 & ISO/IEC 42001 Lead Auditor

Meeting at the booth

Tell us your preferred day and topic – we will reserve a time slot for you.

Request a meeting by email

In advance via Microsoft Teams

Book an initial call online and clarify your questions before the show.

Book an initial call

Stay up to date

We will publish the hall, booth number and our booth program here and on LinkedIn.

Follow VamiSec on LinkedIn

20years of GRC experience of the founder

ISO 27001VamiSec is certified itself

T Cloud Publicoperation in German data centers

5management systems in one IMS

FAQ

Frequently asked questions about CloudFest Global 2027

When and where does CloudFest Global 2027 take place?

CloudFest Global 2027 takes place from Monday, March 15, to Thursday, March 18, 2027, at Europa-Park in Rust, Germany (Europa-Park-Straße 2, 77977 Rust, Baden-Württemberg). The organizer is WHD Event GmbH, Cologne. The program opens on Monday with the CloudFest Open Web Summit.

Will VamiSec exhibit at CloudFest Global 2027?

Yes. VamiSec will be there with its own booth. We will publish the hall and booth number on this page and on LinkedIn as soon as the floor plan is final.

What will VamiSec show at the booth?

At the center is VamiGRC, our agentic integrated management system for NIS2, DORA, the Cyber Resilience Act and the EU AI Act. We will also show the agentic solutions VamiAppSec for the secure SDLC, VamiThreat for AI-assisted threat modeling and VamiRedteam for multi-agent penetration testing.

What is VamiGRC?

Who should talk to us at the booth?

Cloud service providers, hosting providers, data centers and managed service providers, software manufacturers and web agencies as well as enterprise IT – especially executives, CISOs, information security officers and compliance managers who want to implement NIS2, DORA, the CRA or the EU AI Act efficiently.

Which CloudFest tracks match VamiSec’s topics?

The closest are “Mastering Compliance and Data Sovereignty” and “Superhuman Cybersecurity”. Agentic AI with clear approval rules fits “Executing AI”, secure SDLC and SBOM fit “Build A Healthy Stack”, and automating questionnaires and evidence fits “Achieve Operational Fitness”. The tracks are designed by the organizer; at our booth, we show how the topics can be put into practice.

Can I book a meeting in advance?

Yes. Request a meeting at the booth by email to contact@vamisec.com, or book an initial call via Microsoft Teams online. You are also welcome to drop by the booth spontaneously.

Where is VamiGRC operated?

VamiGRC runs on T Cloud Public by Deutsche Telekom, exclusively in German data centers. The language model is selectable, bring your own LLM is possible, and on-premises is available as an add-on option. We do not use customer data to train AI models.

What does it cost to get started with VamiGRC?

VamiGRC is free until go-live: one month of proof of value with demo data or your real data is followed, after purchase, by a three-month implementation phase, also without license fees. The license only starts at go-live; every plan includes unlimited user accounts. Details are available at vamigrc.com.

Do I need a ticket to meet VamiSec at CloudFest?

Yes, CloudFest requires a ticket from the organizer. Ticket types and conditions are available at cloudfest.com.

Save the date

See you at Europa-Park.
March 15–18, 2027.

Until then, we will keep you posted – on this page, in our news and on LinkedIn.

Book a meeting Follow VamiSec on LinkedIn