Insights

One of today's greatest challenges is legislating and understanding the implications of AI on the security sector.

DCAF’s annual initiative, Young Faces, brings together dynamic, forward-thinking young people aspiring to improve their knowledge in a particular area of security.

Over the course of six months, participants from across the Central and Eastern European region learn from international experts, share experiences with their peers and play an active role in cybersecurity research by producing policy papers under expert mentorship.

We asked Mejreme Asllani, who took part in the programme once before and returned for a second time in 2026, to share her experience.

Why did you apply for the ‘Young Face’ programme?

I was completing my master’s programme with a concentration in technology and society, and wanted to expand my knowledge beyond the academic curriculum. 

Cybersecurity was moving from a technical concern into a governance question, involving legislation, oversight and institutional coordination and I wanted to engage with that shift instead of just watching it from the sidelines. 

Young Faces offered something you don’t often get: structured access to practitioners working on exactly these issues, with the focus of the Western Balkans and a space where young people were expected to actually contribute rather than simply listen.

Why have you decided to apply one more time?

The first experience gave me more than I expected, and the subject has not stood still.

New questions have emerged around cyberspace, disinformation, hybrid threats and the accountability of state capabilities, especially in this region and I wanted to keep pushing my own thinking against people who work on this every day. 

Programmes like this matter more if you stay engaged over time rather than treating them as a single event, and I wanted to keep being part of that.
 

Mejreme Asllani during her participation in the Young Faces programme.

How has this had an impact on your life or your work?

It shaped the direction of my work. The paper I wrote during the programme led me further into cybersecurity governance, data privacy and from there into research on disinformation, the role of AI in security and hybrid threats. 

Beyond that, it changed how I approach analysis: I am much more likely now to ask how a problem is being handled elsewhere before assuming it needs a brand-new solution.  

Did you have an assumption about work in cybersecurity that changed after the programme or after you started working in the field?

I assumed cybersecurity was basically a technical field and that meaningful contribution required a computer science background. That assumption kept me at a distance from it for a while.

What changed my view was seeing how much of the actual work happens elsewhere: in legislation, institutional coordination, oversight, public awareness and international cooperation.

The most persistent problems I encountered were not about detecting an attack, even the best cybersecurity protection cannot prevent every breach, but about the right strategy, the ability to keep pace with the new developments, figuring out who’s responsible afterward, whether the legal framework is actually applied and whether institutions can communicate and respond quickly when something goes wrong.

Technical literacy still matters; you need to know basics to translate technical aspect into policy and action. However, I no longer see it as the entry requirement I once thought it was.

Participants in the Young Face programme in 2025 during a training session.  Photo: Damir Hasanović. 

How do you think young people should get involved in cybersecurity and its geopolitical aspect? 

My main piece of advice is that you do not need a technical degree to contribute.

The field needs people who have a broader understanding of what is going on, who understand governance, law and international politics that can be related to cybersecurity and those perspectives are currently underrepresented. 

The most practical way is through programmes like DCAF's Young Faces and similar initiatives from other international organizations. They are built for exactly this, to bring young people into these discussions through training, fellowships and policy forums. 

What makes them worth is the networking as much as the content. They put you in the room with practitioners and researchers and a lot what shapes a career comes out of those conversations, not only the formal sessions. 

What role do you see cybersecurity playing in the coming years?

I think cybersecurity in the Western Balkans and beyond has already become a question of governance and national resilience rather than just a technical one. 

As regulations expand, countries in the region will need to align more closely with EU cybersecurity and digital frameworks, including GDPR, ENISA standards, DSA, DMA, the EU AI Act. At the same time, as energy, healthcare, communications, public services and financial systems become interdependent, cyber disruption can quickly turn into a national security issue with real consequences for people and states.

This raises questions of oversight and accountability too. Cyber capabilities, including intrusion, cyberattacks, data breaches and surveillance tools, are becoming available to a wider range of actors, while legal frameworks to respond remain uneven. Parliamentary and independent oversight need to grow alongside these operational capabilities. By the time a law is drafted, consulted on and adopted, the problem it was meant to address has often already changed shape. That is not anyone’s fault, it is structural, and it demands more adaptive ways of regulating than we currently have.

The broader shift will be moving from prevention to building resilience, accountability and preparedness. For the Western Balkans, that’s both a challenge and an opportunity. 

What are your next plans/steps for your career?

My next step is to keep working at the intersection of AI, cybersecurity and geopolitics, with a broader European and transatlantic lens. While the Western Balkans and Kosova specifically remain an important anchor for me, these issues don’t really stop at national borders anymore.

My broader goal is to keep building expertise that connects technology, governance and geopolitical analysis, and to contribute to strategies that help institutions anticipate risks, adapt quickly and respond effectively to a rapidly changing security environment.

_____________________________________

To learn more on the programme, visit DCAF.ch or read the policy papiers from the 2025/2026 edition:

•  Marigone Vrajolli Enhancing Kosovo’s cyber resilience: Aligning NATO strategies and cyber diplomacy

•  Aleksandar Vanchoski Cybersecurity governance under constraint: How NATO Member States balance norms, law, and capacity in cyberspace – The cases of Albania, Montenegro and North Macedonia

•  Sara Dumani Kosovo’s cybersecurity strategy: Objectives 2 & 4 on the path to EU integration