+49 155 609 62044contact@vamisec.comCyber incident?24/7csirt@vamisec.com
Book an Appointment
VamiGRC Christmas Bootcamp · 12 Dec 2026

Agentic GRC engineering
ready to unwrap

Seven doors, one morning: how agentic AI turns governance, risk and compliance into an engineering discipline – live in the system, not on slides. With Valeri Milke and the VamiSec team.

10:00–14:00 CETSankt Augustin · LinkedIn Live · YouTube Live

Register for free View the programme
Lunch & drinks on site Swag bag for every registered participant
NIS2CRAAI ActTPRMPQC & CBOM
12 Dec 2026Saturday · 10:00–14:00 CET
Sankt AugustinVamiSec & softScheck office near Bonn
LinkedIn & YouTubeLive stream for all remote participants
Knowledge. Impact. Christmas.

GRC is becoming an engineering discipline – agents make it scale

NIS2, the CRA and the AI Act do not ask for more stacks of documents. They ask for reliable connections: which processes, products, suppliers and AI systems depend on what – and who is accountable? In the bootcamp we show live how agentic GRC engineering answers these questions: with a GRC graph instead of spreadsheet silos, with AI agents under human approval and with evidence that stands up to an audit.

7doors – compact live sessions
4 hrsincluding a lunch break
2 wayson site or via live stream
€0free of charge
The programme

Two levels. Seven doors. One Christmas special.

The topics come from our live demo programme at it-sa 2026 – condensed into one morning and extended by a topic nobody should postpone into 2027.

All times CET. Sessions are held in German; questions in English are welcome.

CORE

The agentic GRC foundation

Architecture, connections and accountability

  1. Door 1

    Mastering NIS2, the CRA and the AI Act with an agentic integrated management system

    One control, several frameworks: how an integrated management system implements requirements once and evidences them many times – and where agents take over the legwork.

  2. Door 2

    Business processes, AI use cases, assets, suppliers, risks and controls: the GRC graph reveals the connections

    Spreadsheets hide connections, a graph reveals them: see the impact of a supplier outage or a new requirement at a glance instead of after weeks of alignment.

  3. Door 3

    From AI use cases to agents to risks: AI governance and ultimate accountability

    AI agents need an identity, clear boundaries and an accountable person. We show how the AI Act, ISO/IEC 42001 and human-in-the-loop work together in day-to-day operations.

PROFESSIONAL

GRC engineering in operation

Products, supply chains and risks in euros

  1. Door 4

    The CRA reporting obligation is live – what now? From the product to the SBOM to the product security lifecycle

    The CRA reporting obligations have applied since 11 September 2026. We walk the path from the product via the SBOM to the report – and show what remains to be done before full application in December 2027.

  2. Door 5

    Third-party risk management beyond questionnaires: OSINT, trust centers and automated assessments

    Assess suppliers without drowning in questionnaire ping-pong: OSINT signals, trust centers and automated assessments – while the criticality rating stays with you.

  3. Door 6

    Quantitative risk management: cyber risks in euros and how to calculate your ROSI

    Traffic lights convince no board. We translate cyber risks into euro ranges and show how to derive the return on security investment in a traceable way.

CHRISTMAS SPECIAL
Mastering post-quantum cryptography: creating visibility with the CBOM
More about the special
The schedule

Saturday, 12 December 2026

  1. Arrival with coffee, punch and Christmas cookiesOn site
  2. Welcome and unwrapping the swag bags togetherOn site & remote
  3. Keynote by Valeri Milke: 20 years of GRC – and why now is the time for agentic GRC engineeringKeynote
  4. CORE: doors 1 to 3Level 1
  5. Lunch and drinks on site · break in the live streamBreak
  6. PROFESSIONAL: doors 4 to 6Level 2
  7. Christmas special, door 7: mastering post-quantum cryptography with the CBOMSpecial
  8. Your questions, takeaways and an outlook on 2027Q&A
  9. End of the bootcamp
Save your seat
Christmas special · door 7

Mastering post-quantum cryptography: make it visible first, then migrate

Encrypted data harvested today can be decrypted by future quantum computers. The EU member states intend to start the transition to post-quantum cryptography by the end of 2026. Yet hardly any organisation knows exactly where which cryptography is used. This is exactly where the CBOM comes in – the cryptography bill of materials.

  • Harvest now, decrypt later: which data is already at risk today and how to set priorities with Mosca’s theorem
  • Visibility with the CBOM: inventory algorithms, keys, certificates and protocols in the open CycloneDX standard
  • From inventory to roadmap: crypto agility, hybrid schemes and the NIST standards ML-KEM and ML-DSA
  • Crypto assets in the GRC graph: linked to systems, suppliers, risks and controls – so PQC does not become an isolated project
Request the white paper PQC consulting
Hybrid

On site in Sankt Augustin or live from anywhere

On site

VamiSec & softScheck office
  • Limited seats, personal confirmation after registration
  • Lunch, drinks and Christmas snacks included
  • Swag bag waiting at your seat
  • Questions directly at the system and networking during the break
AddressBonner Straße 108, 53757 Sankt Augustin
Plan your route

Remote

LinkedIn Live & YouTube Live
  • Live stream on LinkedIn and YouTube in parallel
  • Questions live via chat
  • Swag bag by post – register by 29 November and it usually arrives before the bootcamp
  • Recording available afterwards
VamiSec on LinkedIn VamiSec on YouTube
VamiGRC swag bag

A gift for everyone who joins

Every registered participant receives a VamiGRC swag bag – with useful things for everyday GRC work and a touch of Christmas. At 10:00 we unwrap together: on site and in front of the screens.

On siteYour swag bag is waiting at your seat.
RemoteWe send it by post. Register by the first Sunday of Advent (29 November) and it usually arrives before the bootcamp.
Unwrap togetherAt the start at 10:00 – the first item on the agenda.

Shipping to addresses within the EU. For later registrations we ship after the bootcamp while stocks last. For addresses outside the EU we will get in touch personally.

Valeri Milke, founder and managing director of VamiSec GmbH
Your host

“IT security and compliance without AI is a vulnerability.”

Valeri Milke brings 20 years of experience in governance, risk & compliance, security testing and audit – from the first ISMS projects to the agentic GRC platform VamiGRC. In his keynote he shares what has proven itself over two decades, what has not – and how GRC teams move from documenting to engineering in 2027.

Valeri MilkeFounder & CEO · VamiSec GmbHManaging Director · softScheck GmbHISO/IEC 27001 & ISO/IEC 42001 Lead Auditor · CISSP · CISM · OSCP
Register now
20years of GRC experience
7doors live in the system
VamiGRCAgentic GRC Platform
ISO 27001certified company
Who is it for?

For everyone who wants to build GRC, not just administer it

CISO & ISOGRC & complianceGRC engineersProduct security & PSIRTRisk managementProcurement & TPRMAI officersAudit & consultingIT management
Registration

Save your seat now – on site or remote

Participation is free of charge. When you register, you receive the calendar invitation, the stream links in good time before the event and your VamiGRC swag bag.

  1. 1
    Choose your format

    On site in Sankt Augustin or remote via live stream.

  2. 2
    Get your confirmation

    Remote instantly by email, on site after personal seat confirmation.

  3. 3
    Unwrap together

    We kick off on 12 December at 10:00 CET.

Questions in advance? contact@vamisec.com

Free registrationVamiGRC Christmas Bootcamp · 12 Dec 2026

Required fields are marked with *. Please do not enter confidential information.

How will you join? *

Your registration goes to the VamiSec team at contact@vamisec.com.

Good to know

Questions about the bootcamp

How much does it cost?

Nothing. The bootcamp is free of charge on site and remote – including lunch and drinks on site and the VamiGRC swag bag for everyone who registers.

Do I need to register for the live stream?

You can watch on LinkedIn or YouTube without registering. If you register, you receive the stream links by email, a reminder and your swag bag by post.

How many seats are available on site?

Seats at the office in Sankt Augustin are limited. We confirm every on-site registration personally. If all seats are taken, we put you on the waiting list – and you can always join remotely.

When do I need to register for the swag bag to arrive in time?

Remote participants should register by the first Sunday of Advent, 29 November 2026. The swag bag then usually arrives before the bootcamp. For later registrations we ship after the bootcamp while stocks last. We ship within the EU.

Will the bootcamp be recorded?

Yes. The live stream remains available as a recording on LinkedIn and YouTube afterwards. On site there are seats outside the camera area.

In which language is the bootcamp held?

The sessions are held in German. You are welcome to ask questions in English – on site and in the chat.

Do I need prior knowledge?

Basic knowledge of information security or compliance helps. The CORE level lays the foundation, the PROFESSIONAL level goes into practice. Remote participants can also follow individual doors.

Will I receive a certificate of attendance?

Yes. On request, all registered participants receive a digital certificate of attendance after the bootcamp.

How do I get to the office in Sankt Augustin?

The VamiSec and softScheck office is located at Bonner Straße 108, 53757 Sankt Augustin, a few kilometres east of Bonn. Use “Plan your route” to open directions in Google Maps.

VamiGRC Christmas Bootcamp · 12 Dec 2026

Seven doors.
One morning’s head start for 2027.

On site in Sankt Augustin or live on LinkedIn and YouTube – free of charge, with lunch and a swag bag.

Register now contact@vamisec.com