Cybersecurity Expert

This is Part 1 of a 2-part series on AI agents and control assurance.   Read Part 2: Controlling AI Agents: Why Detection Is Too Late The cybersecurity industry has spent years investing in visibility. Dashboards have improved, detection tooling has matured, and the volume of telemetry available to security teams has increased significantly. Most organisations can now see more of their environment than at any point in the past. However, one of the most important emerging risks is not hidden malware or an unknown vulnerability. It is the rapid introduction of AI agents operating across environments that organisations do not fully understand, cannot clearly inventory, and often cannot meaningfully govern. This is not simply another software category. It represents the introduction of autonomous digital actors interacting with identity systems, APIs, SaaS platforms, cloud environments, and business processes. These agents are not constrained by the same assumptions that underpin tr...

Last week I joined fellow security leaders at  CISO Inspire Summit North  for a panel discussion on  The Expanding Threat Surface: Adaptive Security Leadership for 2026 and Beyond . It was a timely discussion, because the challenge facing security leaders today is not simply more threats. It is more connections, more dependencies, and more complexity. Suppliers, SaaS, identities, automation and distributed ways of working have all expanded the attack surface in ways that traditional control models often struggle to keep pace with. One theme I returned to during the discussion was that many cyber risks are not new. They are often familiar control failures appearing at greater scale and speed. That matters, because it shifts the focus from chasing every emerging technology risk to strengthening fundamentals. Security fundamentals still matter most Identity, ownership, visibility and resilience remain foundational. As organisations scale, risk often hides where ownership is ...