Inside IBM’s 2026 z/Resilience Conference: What Mainframers Should Know 

In this first-person piece, Robi Singh shares what he learned in Rome about the changing demands of mainframe resilience—from regulation and cyber recovery to GDPS, AI, and quantum-safe security.

The z/Resilience Conference is known for bringing together mainframe experts to examine how operational resilience is changing in response to cyber threats, regulation, AI, and new recovery requirements.

For quite some time, I have wanted to attend the z/Resilience Conference. At the bank where I previously worked as a contractor for some years, their practice was to send a delegation of people from DB2, z/Platform owners, and Managers. They always returned excited and motivated, and shared the technical details they learned.

I joined Vertali over a year ago as a Mainframe Architect, and this was my first request and number one request: to attend this conference in 2026.

Armed with a budget, I booked a low-cost flight direct from Edinburgh to Rome, and an Airbnb apartment in Fiumicino, close to the conference centre but also close to the beach – not a coincidence.

Tip 1: Don’t Miss the Start

My first conference tip: some conferences offer an early-registration option, with the extra night’s stay before the event begins costing more. It may be tempting to arrive a little later and skip the opening sessions, but that’s a mistake.

The Resilience Conference is not a collection of randomly assembled presentations. The conference has a flow and structure. If you miss the start, you may miss the whole point. Or at least be playing catch-up for the next 2 days.

To explain, the keynote speech introduced the conference purpose, the number, and the background of the delegates. It explained the conference outline and what big things to look out for.

The next session outlined the threats, problems, and experiences IBM has gathered from customers in the last 12 months, and the costs this has incurred.

The following session covered regulatory changes, why this is a developing space, and how IBM is repositioning its strategy to meet demand.

The point is that the problems, the regulations, and the challenges define the conference mission. Customers need to understand these points to realise what the later presented solutions are for. 

For example, when Anne Leslie says in Regulation Ready Resilience, “The favourite questions of the regulator are, ‘If you get hit by a ransomware attack tomorrow – how will you know?”’

Michael Frankenburg answers in IBM Storage Update that, “IBM’s Flash Core Module 4 (FCM4) and Ransomware Threat Detection (RTD) is integrated into the disk hardware.”

So don’t miss the first few sessions on the first morning.

Tip 2: Your Memory Will Fail

My next tip is to take notes. Do not rely on, “I will look at the slides later”. This is the smaller part of the story. The bigger takeaway is that most presenters don’t read the text off the slides.

They talk about what is important and why; they give practical suggestions and sometimes say things which IBM would not allow to be on the slides yet. Such as future intentions.

All these nuggets of gold are lost if you don’t write them down at the time.

Tip 3: Stay the Whole Time

My third piece of advice is: don’t leave early to catch the flight home. Some of the best things are at the end.

In this case, the last 3 sessions were excellent.

What follows are short summaries of the sessions I attended over my few days in Rome.

Keynote Introduction – from Andrea Corbelli, IBM Italy

About 130 delegates attended this conference, mostly from EMEA and the USA. This is the 4th WW z/Resilience conference. It was first held in Munich, and the previous two were in Amsterdam.

The z/Resilience landscape is changing rapidly in different directions, from Business Continuity to Operational Resilience; 24 x 7 operations are a business requirement in today’s world. Services are at risk of disruption from natural disasters, wars, and cyber-attacks. 

Prevention measures are no longer enough. Organisations must identify critical processes and have resilience and tested plans for recovery in place.

Business Continuity from Leon Manten, WW Sales Leader

The regulators are introducing stringent policies for Business Continuity, resilience, and disaster recovery. Operational resilience and risk management are regulators’ top priorities. IBM sees the same regulatory requirements now coming from different bodies. They are copying each other.

In Figure 1, each small dot represents an IBM-known resiliency failure, and the larger dots represent selected significant catastrophic events. Natural catastrophes cost the industry $320 billion in 2024. There is a clear need to be able to move the datacentre to somewhere else distant from the impacted disaster area. 

It is not enough to have prevention tactics; prevention plus the ability to react and resume services is the requirement- all at the same time. Macro threats such as a tornado make the headlines, but many disruptions come from other causes. 

Human error or malpractice causes the most problems. In another example, a combination of almost unrelated events causes the problem. Who would have imagined that a power outage could be caused by a cyberattack on the service provider, leading to the generator running for a long period of time, but the real failure is the lack of a guaranteed fuel contract? Supplies may be constrained by a war on the other side of the world, yet the impact is local. Today we can see that scenario could be real.

Turning to the subject of Cyber Attack. The average data breach costs $4.4 million; focusing only on security prevention is wrong. Business Continuity = prevention plus recovery. This translates into high-availability infrastructure plus Cyber Security, plus Disaster Recovery, plus Cyber Resilience, and Cyber Recovery.

If customers stay current with software levels, then it is easier to maintain Business Continuity as all the new features are there. Multi-site Sysplex automated failover for both mainframe and distributed platforms is the strategic goal. IBM offers a professional services evaluation of any customer situation.

Regulation Ready Resilience – from Anne Leslie, Head of Cloud Risk EMEA

Regulatory expectations have reset. DORA and NIS2 are EU directives for medium-to-large entities in critical or important sectors, such as banking, transport, health services, energy, digital services, and food supply. 

The simple question asked is, “Can we rely on you during an incident?” In other words, can your business survive and NOT impact others? DORA is a copy of NIS2 and is about financial stability, for example, for those entities or banks that participate in a payments system such as SEPA (Single Euro Payments Area). Only a few countries have managed to get an opt-out.

Compliance comes from proving resilience through regular testing. The regulations stipulate an outcome and do not care how it is done (i.e. cheap is OK). Regulators care about design decisions, alert thresholds, and test coverage choices, but the regulations focus on outcomes, not the control process.

Anne suggests some things that organisations need to look at.

• Beware of a tangled system of dependencies.
• Don’t be surprised by events.
• Have confidence grounded in tested reality and not optimism.

It is important to identify what is really critical because not everything is. One thing that is missing today is the people who can identify what is important (and what isn’t). 

These are “the storytellers” that grew up with the applications and infrastructure and understand the journey. Organisations have to be able to have a break and recover and demonstrate that they can have a break and recover.

The favourite questions of the regulator are, “If you get hit by a ransomware attack tomorrow – how will you know?” and, “Do you have a plan for who calls who?” This is all about making things manageable and demonstrating that there is a structure in place and it is not improvised. 

Organisations should be clear on which systems must not fail and think about how to test and prove this resilience. This requires continuous assurance and investment.

It is better to tell the regulators that you know where the gaps are, which can only be said when you know where the gaps are. In this, the technical architect has 3 new roles:

• Serves as the custodian of the truth
• Translates the mission to high availability and recoverable systems 
•  Designs explainable (to non-technical audience) resilience

Resilience and compliance are about never being surprised.

A Client Journey to Next Level Mainframe Resilience – From Mike Hrencein, IBM; Oriol Gonzalez Banco Sabadell, Director of Production Operations; and Carles Aris, CaixaBank– IT Architect

This was a joint presentation from IBM and two  Spanish Banks.

Banco de Sabadell, S.A. is a Spanish multinational financial services company headquartered in Sabadell, Catalonia. It is the 4th-largest Spanish banking group. It includes several banks, brands, subsidiaries, and associated banks.

CaixaBank, S.A., formerly Criteria CaixaCorp, is a Spanish multinational financial services company. CaixaBank is based in Valencia, with operational offices in Barcelona and Madrid. It is Spain’s third-largest lender by market value, after Banco Santander and BBVA.

Oriol started by explaining that Banco de Sabadell was traditionally based around Barcelona, where both Data Centres were located. Two factors drove a project to improve resilience.

1. The existing 2 Data Centres were worn out and needed to be replaced.
2. Under DORA regulations, the existing 2 DCs were only a short distance apart, in a metro mirror across Barcelona. This did not meet regulations.

The Bank assessed that a radical change and update were needed to meet regulations, which unlocked the project budget.

The Spanish regulatory authority carried out a review and identified 14 applications as essential services, which Sabadell had to ensure continuous availability and resilience. This presented the technical team at Sabadell with the biggest challenge: understanding and identifying the Recovery Point Objective (RPO). This caused a lot of debate (and arguments) between the teams. 

Why is this so important? Because defining the RPO then drives the Recovery Time Objective (RTO) to meet the RPO. Sabadell decided RPO was no data loss, and the requirement was to be able to move location without disruption.

Oriol then described the new environment. There are two new sites less than 40 kms apart, which is the distance of a z/OS Sysplex campus. There are two DC in each location. As shown in Figure 2, the production Sysplex and non-production Sysplex span both locations.

They can move workloads from one side to the other without disrupting transactions. It takes about two seconds to relocate the Coupling Facility. Normal operation is dual-leg with Hyperswap. The actual data can be in either location. A fourth copy of the data is taken to the cloud using flash copy. On a daily basis, 4 SFG copies are made with limited validation (Phase 1 and Phase 2 only).

Banco de Sabadell is now thinking about a 4th DC 600 kms away, co-located with other Banks to share costs. They are also looking at doing better validation with the Cyber Vault SFG copies.

Carles then presented a similar story for Caixa Bank. In this case, the Bank had DCs located too close together in Madrid. They started by having an external assessment of the Bank’s critical infrastructure. 

This was also motivated by DORA regulations and ECB (European Central Bank) ‘stress test’, where the regulator wants to see a process of ongoing improvements. This assessment is now being done every year on what has been identified as critical applications.

In both cases, the Bank worked with the IBM High Availability Centre of Competency (HACoC) using their experience in these types of projects to deliver resilient industry-standard solutions.

IBM Concert – from Fabio Riva, IBM AO Ops Technical Sales

At this conference, IBM announced IBM Concert for z: AI-powered mainframe resilience. 

Concert can make predictions, create solutions, and make decisions. It dynamically detects the system topology, gathering inputs from SMF data, the SYSLOG, and system alerts, and uses gathered insights from AI Watson Assistant to optimise system performance. 

It can automatically open tickets in ServiceNow. It can read SMP data and link directly to DIALIBM using TADz to identify PTFs that the system requires.

IBM offered a 4-hour hands-on guided workshop. See this link for an overview: IBM Concert for Z

GDPS 4.9 Update – from David Petersen, IBM Distinguished Engineer

Some enhancements to Metro Mirror operation include: 

• A new REST API based GUI interface.
• Role-based security.
• Consistent flash copy with no brief delay.
• A supported and documented way to reconfigure LPAR capacity and weight.
• New dual control security process to protect against bad actors.

Some enhancements to Global Mirror operation include: –

• A new ability to check state validation.
• Cascade can now be simultaneous instead of A to B to C.
• New dual control security process for some things. 

GDPS Lifeline Advisor also has a new GUI interface. The GDPS Logical Corruption Protection Manager protects against cyber-attacks by assisting in the creation and management of SFG (Safe Guarded Copies) and the forensic validation of these copies. This is fully integrated with IBM Cyber Vault.

David also described how some clients are doing stage 3 validation of SFG copies by comparing VSAM files with DB2 data.

IBM’s integrated Threat Detection for z/OS analyzes access and reports anomalies; this will be the focus of future enhancements. It is an AI-enabled knowledge agent. IBM intends to deliver anti-malware detection for z/OS with policy-driven actions in production environments.

Also, GDPS 4.9 delivers 4-site Metro Mirror symmetric resiliency.

For many clients, DB2 Expert Recovery Pro is an important part of the picture because it uses SFG copies with roll-forward recovery to point in time.

IBM Project Polaris is an initiative to modernize and simplify the IBM z/OS mainframe experience. By combining agentic AI, YAML-based configuration-as-code, and industry-standard tools (like VS Code and Git), it aims to reduce the time it takes for early-tenure system programmers to reach full proficiency from years down to just months.

IBM Z and LinuxONE Security Strategy Update – from Pradeep Parameshwaran, CTO, IBM Z and LinuxONE Security, IBM Master Inventor

These days 63% of cyber-attacks are driven by AI. This means vulnerabilities will keep rising. 

In a recent example, it took a client 276 days to identify and fully contain cyberattack damage across many and various types of environments. Using stolen or compromised credentials and phishing attacks is still the main access point. 

Pradeep gave an example of how an AI bot contacted a client employee; the AI then took over and researched LinkedIn, Facebook, and other posts to build rapport and trust with the employee. Using this information, it was able to steal the employee’s credentials and gain access. Customers MUST use MFA to protect against unauthorized access to credentials.

 On z and LinuxOne, the hardware is the root of trust; the tools are the Vault, Threat Detection, Cryptographic support, Guardium, Key Orchestration, and zMFA. Clients must:

• Identify threats. 
• Protect environments.
• Detect and report breaches.
• Respond to attacks.
• Recover the data and the services.

The new products and features are aligning into ‘frameworks’ to meet NIST.

These are z Secure Access, z Secure Compliance, and z Secure Detection. The direction is to move away from point products and toward these three aligned frameworks, with integrated tools that work together and are smarter with AI. Consolidating to the latest versions of these is recommended.

Another new thing is the IBM Z Secure Secret Manager to streamline certificate management. This bridges IBM z/OS with modern, centralized enterprise secrets platforms like IBM Vault Self-Managed for Z and LinuxONE. It reduces the risk of service outages from expired certificates by automating lifecycle renewal across z/OS and the broader enterprise IT estate. The new standard is to renew certificates every 47 days or less. It is also recommended to have the certificate Vault on z.

There was then some discussion about the MGM hack. Some details are found here: An Overview of the MGM Cyber Attack | Netwrix

An Update on TS7780 Virtual Tape Manager and Enabling Long Term Recovery – from Joe Swingler, IBM

This requires a new code level of R8.61.0.60 for TS7780 and TS7770, which has been available since 25Q4. With the additional frames, it handles data up to 7.8 petabytes. It has isolated network ports that can be connected to the tape Grid or cloud at the same time.

IBM Deep Storage Archive adds an additional 61 petabytes of storage for cheaper and accessible long-term tape retention that sits inside a processor called Diamond Back. 

It joins the tape grid and is accessible from anywhere. It is IP-connected and can be 1000 kms away. Clients should use it for logical WORM, storing copies of Cyber Vault-validated golden copies and flash copies of other verified SGC.

Cyber Vault Update – from David Petersen, IBM Distinguished Engineer, IBM Z / IBM Infrastructure

These days 2 out of every 3 successful cyber-attacks have come from insiders or compromised insider credentials. In other words, protection is no longer enough as it has become more a question of when it happens than what you can do about it.

IBM Cyber Vault has now been around for ‘about 10 years’ and is the industry standard solution for clients on z. For some customers, the driver is meeting regulations; in reality, this is about the survival of the client. 

Logical Corruption Protection (LCP Manager) helps with SGC security and recovery. The focus now is better automation and evaluation. For Type 2, validation software can be available at 99% discount. There is also a Type 2 data validation lab tool available.

New use cases are developing against aggressive hacking and so-called ‘missile attacks’ where the data is simply destroyed. It is hoped that 90% of all recovery scenarios are surgical recovery of a single or a limited number of objects for a single service. Catastrophic data loss is possible. The goal for catastrophic recovery of all objects is 1–2 hours. To do this, DB2 recovery logs should go to WORM, and a good practise for production DB2 systems is to switch logs every 4 – 8 minutes. Combined with DB2 V13 and DB2 Recovery Expert Pro, to achieve recovery with SGC + DB2 log forward recovery to Point-in-time just before the disaster is now possible.

The Journey to Quantum Safe – from Andrea Corbelli, IBM Z WW Technical Sales Leader IBM Quantum Senior Ambassador

The most recent IBM assessment on Quantum Computing from IBM in 2025 is that by 2029 IBM Quantum Nighthawk will be able to break most current cryptographic codes. Today’s classical security protocols will be obsolete tomorrow.

Shor’s algorithm (1994) shows a quantum computer can factor large numbers—at least 2048 bits long (that’s 617 decimal digits). For comparison, on a classical computer, this would take millions of years. On a cryptographically relevant quantum computer, this would take a few hours. 

Shor’s algorithm breaks RSA and other public-key cryptosystems whose security relies on the difficulty of mathematical trapdoor functions (factoring large numbers or taking discrete logarithms). Grover’s algorithm (1996) theoretically affects AES. Current guidance is to continue using AES 256, which is believed to be quantum-safe.

Major cryptographic protocols, such as TLS and IPSec, need to be adapted in order to use quantum-safe algorithms.

This affects the entire IT world, and the whole cryptographic foundations will have to change. IBM is developing things to help. There is a new Crypto Express 8S HSM. All data inside z is already AES 256 encrypted.

The migration to quantum-safe cryptography affects the entire IT estate: 

• Software development 
• Vendor products 
• Software as a service 
• Infrastructure, network, devices, etc. and needs new capabilities such as cryptographic discovery & cryptographic agility.

Boardrooms around the world are waking up to the fact that migration is mandatory.