The Security Chapter UK

Who Controls Your Technology?

As cloud adoption accelerates and reliance on a small number of global technology providers deepens, a harder question sits underneath the convenience: when something goes wrong, whose decision is it, and how much of that decision is actually ours?

Ownership, control and resilience have moved from operational detail to strategic priority, not because organisations have lost interest in managing them, but because so much of the infrastructure we depend on now sits outside our direct control by design. This discussion explores how security leaders are managing vendor concentration, data sovereignty, supply chain risk and digital resilience, and what "control" realistically looks like when so much of the stack belongs to someone else.

Key discussion areas:

• Vendor concentration risk and single points of failure
• Data sovereignty and jurisdiction
• Supply chain and third-party resilience
• Contractual and regulatory levers for control we don't own outright
• Building agility and exit options into vendor relationships

The Expanding Attack Surface: Securing Cloud, SaaS & Digital Ecosystems

The modern enterprise is built on interconnected digital ecosystems. Cloud platforms, SaaS applications, APIs and third-party integrations create enormous opportunities, and with them, a footprint that's growing faster than most organisations anticipated even a few years ago.

This discussion explores how organisations are keeping visibility and protection moving at the same pace as that growth, and what "securing the ecosystem" really looks like when the ecosystem itself never stops expanding.

Key discussion areas:

• SaaS security challenges as adoption accelerates
• Cloud misconfiguration risks
• API security in a landscape of constant growth
• Third-party exposure and shared accountability
• Securing interconnected ecosystems as they continue to expand

Who Will Defend the Future?

With the cyber talent landscape ever changing, but have we actually adjusted how we hire, train and structure teams to match, or are we still building tomorrow's defence with yesterday's org chart?

As AI reshapes both attacks and defence, we're left with a genuinely uncomfortable question: are the skills, structures and leadership capabilities we're investing in today actually the ones that will matter in three years, or are we preparing people for a version of this job that's already disappearing?

This discussion explores how organisations are preparing their people, not just their technology, for the future of security, and asks whether "upskilling" is really happening, or whether it's a line in a strategy deck that hasn't yet reached the training budget.

Key discussion areas:

• What skills actually matter now: technical depth, or judgement and adaptability?
• Restructuring teams around AI-augmented workflows, not just adding AI tools to old structures
• Building leadership capability for a discipline that changes faster than most leadership pipelines
• Attracting and retaining talent in a market that's evolving faster than job descriptions
• Whether "human plus AI" teams need a genuinely different operating model, not just new tools bolted onto old roles

The Identity Revolution

The traditional security perimeter has disappeared, but has our approach to identity kept pace, or are we still managing it like an afterthought bolted onto infrastructure?

With cloud adoption, SaaS expansion, remote work and machine-to-machine communication, identity has become the foundation of enterprise security. But for every human identity we're managing carefully, how many machine identities, service accounts, API keys and AI agents are we provisioning faster than we can ever hope to decommission them? And when attackers increasingly go after credentials, privileged access and trusted relationships rather than infrastructure, is that because it's the easiest way in, or because we've simply made it easy?

This discussion explores how organisations are evolving identity strategies for a borderless enterprise, and asks whether the hardest problem left is no longer the humans logging in, but the machines and agents that never log out.

Key discussion areas:

• Moving beyond passwords and MFA: has this actually happened, or are we still promising it?
• Privileged and machine identity protection, and the unmanaged growth of non-human identities
• Identity-first Zero Trust strategies: stated versus operationalised
• Third-party access management
• Detecting identity compromise

Securing the Autonomous Enterprise: Governing AI at Scale

AI adoption is outpacing security frameworks, policies and headcount across the industry, and most security leaders are living this tension right now. From enterprise copilots to autonomous agents, organisations are introducing new capabilities weekly, each creating a new attack surface, a new data flow and a new decision-maker inside the business.

Manual governance cannot scale at this speed. Spreadsheet-based risk registers and quarterly audits were built for predictable software rollouts, not a world where an AI agent can be spun up in minutes. How do we establish governance, visibility and controls without slowing innovation? Increasingly, the answer lies in using AI itself to monitor, discover and govern AI at the same pace it's being deployed.

This discussion explores how organisations are building secure AI operating models that scale with adoption, and the business case for getting governance right early.

Key discussion areas:

• AI asset discovery and risk management, including AI-driven tools to continuously find and classify shadow AI
• Securing AI agents and autonomous workflows as a new class of identity with its own permissions and risk profile
• Prompt injection and model manipulation, and automated monitoring to catch anomalous model behaviour
• Preventing sensitive data exposure across AI tools, models and third-party providers
• Creating practical, automatable AI governance frameworks that scale with adoption

The Synthetic Threat Era: Fighting AI Deception with AI Defence

Deception, fraud and social engineering are not new to anyone in technology or cyber security. What's changed is scale, speed and sophistication.

AI hasn't invented these threats; it has industrialised them. Deepfakes, synthetic identities, AI-generated phishing and automated social engineering now let attackers operate with a precision and volume that was previously out of reach, turning yesterday's scam into today's real-time, highly convincing attack.

Attackers are no longer only targeting technology. They are targeting human judgement, relationships and trust, at a pace organisations have never had to defend against before. 

The response can't be purely human. If AI is accelerating the offence, security leaders must deploy AI to accelerate the defence, fighting fire with fire. This discussion explores how organisations are protecting the human perimeter, strengthening identity verification, and building AI-powered defences to match AI-powered deception. 

Key discussion areas:

• How AI has scaled and accelerated existing fraud, social engineering and impersonation tactics
• Deepfake-enabled fraud and executive impersonation
• Synthetic identities and AI-augmented social engineering
• Using AI defensively: detection, authentication and verification at machine speed
• Protecting employees against AI-powered manipulation
• Building organisational trust resilience in an AI-vs-AI threat landscape