# Startup Summit Lisbon 2026 — strategy, materials, and the build list > Rendered from docs/briefs/summit__lisbon-2026-strategy.md in the repository. The text below is that file. > Source: https://riskmandate.ai/admin/briefs/summit__lisbon-2026-strategy/ · noindex · written by scripts/site/build-admin.mjs **Event:** 17–18 September 2026 · Beato Innovation District, Lisbon **Scale (organiser's figures):** 2,000+ founders · 300+ investors · 150+ speakers · 200+ booths · 3 stages · 40+ countries **Written:** 2026-09-09 — **eight days out** **Author:** @website-agent · **Companion:** `vaults__what-to-add-to-the-site.md` > **Partly superseded, 11 September.** The Agent Behaviour Policy is now a named, > published artefact with a checkout behind it, which changes what happens at the booth: > the conversation ends in a £10 purchase rather than a business card. **§1, §2, §3 and > §5 below are replaced by `summit__lisbon-2026-messaging.md`**, and the reason for the > change is in `direction__abp-at-the-centre.md`. §4 (the summit graph vault), §6 (the > two days) and §7 (after) stand as written. > I have worked from the public site. Check §5 against the actual exhibitor pack > you received — deadlines and asset specs there override anything here. --- ## 1. The one thing to get right: this is not our usual audience riskmandate.ai is written for a Head of Risk. Lisbon is **founders and investors**. If we run the site's messaging at the booth it will land as "enterprise GRC vendor" and founders will walk past. The product doesn't change. The **entry point** does. | | Site today | Booth in Lisbon | |---|---|---| | Opens with | "Make your agents insurable." | "Do you know what your AI agent can actually do?" | | Assumes | you already own risk | you already shipped an agent | | Proof | RAMM, the Index | the 5-minute game, then their own graph | "Make your agents insurable" is still the close — it is just not the opener. For this crowd the opener is a **question they cannot answer**, and the reveal does the selling. That is precisely the mechanic the scenarios page and the what-can-it-do game already use; Lisbon is where it gets used in person. ## 2. Three audiences, three scripts **Founders (the 2,000).** They have given an assistant access to a repo, a mailbox, a cloud account. They have never enumerated what it can reach. - Hook: *"Give me two minutes — do you know what your agent can actually do?"* - Reveal: it can do more than they authorised, and they already accepted that the moment it ran. No deny button. - Why they care *now*, commercially: their first serious enterprise customer will send a security questionnaire with agent questions on it, and their insurer and any acquirer will ask the same thing. **We turn a blocker in their sales cycle into a number they can show.** - Ask: run the Index on their estate. **Investors (the 300).** This is our most under-exploited angle and nobody else at that event will be running it. - Hook: *"How many of your portfolio companies could tell you what their agents can reach?"* - The pitch: agent exposure is an un-priced, un-diligenced liability sitting across their whole book. We make it a per-company number and a portfolio view. - This works both as a **sales conversation** (portfolio-wide Index) and as a **fundraising conversation** — it demonstrates category insight rather than claiming it. - Ask: a portfolio scan on three companies, free, as the diligence pilot. **Operators / enterprise buyers (the few who are our real ICP).** - Straight to the site's own argument: grant vs mandate, time-boxed acceptance, underwritten to the board. Show Licence to Operate. Book the call. ## 3. What to show — in strict order The booth needs **one self-serve magnet and one operator-driven wow**. 1. **The game — self-serve, always running.** `what-can-it-do.games.sgit.ai`. Five minutes, forty questions, no sign-up, and it scores them. It pulls people in without a human, qualifies them (they self-identify as agent users), and ends on *"Licence to Operate — the delta, priced."* Put it on the screen facing the aisle. 2. **Their own company, live — the wow.** *"Give me your URL."* We build their graph while they stand there (see §4). Under two minutes or it doesn't work as a booth move. 3. **Licence to Operate** (`posrhzp3`) — the close. An insurance policy for an agent, simulated: grant, mandate, and the delta nothing covers. 4. **The Insurability Index** — the number they leave with, and the reason to give us an email. Do **not** demo RAMM, the regulation graphs, or the standards atlases unless someone asks a compliance question. They are right for the site and wrong for a 90-second aisle conversation. ## 4. Build before the 17th ### 4.1 The summit-as-a-graph vault — **do this one** Your idea, and it is the strongest pre-event asset available. Convert the summit's public site — speakers, agenda, exhibitors, tracks, investors — into a queryable, filterable graph in a vault. It earns its place four times over: - **A working tool for the two days.** Filter the 300 investors by thesis, the 200 exhibitors by whether they ship agents, the 150 speakers by track. We arrive knowing who to find. Nobody else at that event will have this. - **The demo that explains the product without jargon.** "This is the conference you're standing in, as a graph, opened with a read key, no sign-up." Everyone in the room already knows the source data, so the transformation is the only thing they have to understand. - **A giveaway people actually want.** Hand over the read key. It is useful to *them*, it costs us nothing, and it demonstrates the sharing model in the act of sharing. - **It rehearses the §3.2 wow.** If the pipeline can do the summit site, it can do the visitor's site while they wait. Scope it tightly: public pages only; keep the source URL on every node; personal data limited to what the organiser already publishes (name, company, role, talk); no scraping behind logins; a visible "not affiliated with or endorsed by Startup Summit" line; and a documented takedown route if the organiser or a speaker objects. That restraint is *itself* on-message for us — and worth saying aloud at the booth. ### 4.2 The rest of the build list, in priority order | | What | Why | Owner | |---|---|---|---| | P0 | Ship the Seal mark everywhere (site, deck, print) | v0.13.0 has it; collateral must match | vault team + print | | P0 | Summit graph vault (§4.1) | booth centrepiece | us | | P0 | Roll-up banner, cards, one-pager to print | lead time — order by **Fri 11 Sept** | you | | P1 | Add Licence to Operate + the game to the site | the funnel currently dead-ends off-site | vault team | | P1 | The URL→graph pipeline, timed under 2 min | the wow only works if it's fast | us | | P2 | Portfolio-scan one-pager for investors | different ask, different leave-behind | you | | P2 | Fix the `demos.html` "leaves your device" wording | accuracy blocker, see companion brief | vault team | **Lead capture:** decide the mechanism now. A QR to the game, then the Index request as the email gate, is enough — but agree who follows up and within how many days *before* we go, or the leads rot. Two days at 200 booths generates more cards than anyone processes on the Monday. ## 5. Materials to submit — ready to paste Check field names and limits against the exhibitor pack; the copy below is written to the brand voice (mechanism-stated, no unsourced numbers, no certification claims). **Company name:** RiskMandate **One-liner (≤10 words):** The insurability layer for AI agents. **Short description (~50 words):** > RiskMandate makes autonomous systems insurable. We map every agent to what it > can actually reach, assign a named owner, and turn an open-ended grant into a > time-boxed acceptance a board can carry. The output is an Insurability Index — > a number your customers, insurers and investors can ask for. **Long description (~150 words):** > An AI agent's grant is not its mandate. The moment an agent runs, it holds > authority nobody scoped and nobody time-boxed — and that risk is already > accepted, whether or not anyone signed for it. > > RiskMandate makes that explicit. We map each agent to its blast radius, name > the owner, and convert the standing grant into an acceptance with a direction, > an owner and an expiry — underwritten upward to the board. There is no deny > button: a live risk cannot be refused, only accepted for an interval. > > The result is an Insurability Index: a computed score against a real > conformance standard, not a self-assessment. It answers the agent questions > now appearing in enterprise security reviews, insurance submissions and > investor diligence. > > Built on zero-knowledge encrypted vaults — your register stays yours, and can > be handed to an auditor with a single read key. **Category / tags:** AI governance · risk management · cybersecurity · GRC · developer tools **Website:** riskmandate.ai · **Live demos:** riskmandate.ai/demos.html **Try it in 5 minutes:** what-can-it-do.games.sgit.ai **Booth headline (for print — the big one):** > Do you know what your AI agent can actually do? **Booth sub-line:** > Most teams can't answer. The ones who can are the ones who get insured. **Card back / QR caption:** Five minutes. Forty questions. No sign-up. **Founder bio — needs your input:** > Dinis Cruz — [ROLE]. [X] years in application security; [speaking/OWASP > credentials]. Building the insurability layer for autonomous systems. *(I have deliberately not invented your credentials or years. Fill the brackets — and if there is a pitch-competition or speaker-submission form in the pack, send me the questions and I'll draft answers.)* ## 6. The two days - **Aisle line (first 5 seconds):** "Do you know what your AI agent can actually do?" — not "we do AI governance". A question outperforms a category. - **Qualify fast:** *do you run agents with real access?* → founder script. *do you back companies that do?* → investor script. Anything else, give a card and move on. At 2,000 attendees, time is the scarce resource. - **One ask per conversation.** Founders: run the Index. Investors: three portfolio companies. Never both. - **Log every lead against the graph vault the same evening** — which means the summit graph doubles as the CRM for the event. Day-two conversations should reference day-one ones. - **Speakers are targets too.** 150 speakers with stage credibility; use the graph to pick the ten worth finding, and go to their talks. ## 7. After Within 48 hours: publish the summit graph vault publicly with a short write-up of how it was built, and send every lead their own read key. The follow-up *is* the demo — nobody else who exhibits will send a working artefact instead of a deck. That, more than anything at the booth, is what makes us memorable after 200 other conversations. --- ## Open questions for you 1. Can I see the exhibitor pack? Deadlines, asset specs and any pitch-competition or speaker forms would let me finish §5 properly. 2. Booth size and what's supplied (screen? power? table?) — the roll-up and collateral in the brand canvas assume a standard 850×2000mm pull-up. 3. Who is going, and is anyone speaking or pitching? 4. Do we want the summit graph vault public, or read-key-on-request as a lead gate? I'd argue public — it's a better story and the read key is the pitch.