No CISO can guarantee that enterprise infrastructure is truly secure and safe from bad actors, especially in the threatening age of AI, but technical teams must communicate the exact risk to boardroom executives to radically address how they measure, fund, and manage the modern threat landscape.
As Connected Britain, we heard a panel consisting of Darktrace’s Nicole Wong, Virgin Media O2’s Stuart Seymour, Cyberhash’s Manoj Bhatt, and BT’s Colin Bannon, which mapped out how we put cyber risk and security on the boardroom agenda.
All the panellists agreed that cybersecurity must be treated as an exercise in business risk appetite, enterprise valuation, and operational continuity.
BT, the UK’s largest telecom operator, spans over 100 exabytes of data, 250 million kilometers of smart meters, and 60% of national network traffic and this creates a big attack surface, said BT CTO, Colin Bannon.
Threat actors have moved towards a “malicious-centric” targeting strategy focused on identity. Bad actors are aggressively exploiting email authentication systems alongside both human and non-human identities, including API keys, service accounts, and automated bots. To limit the potential compromises, perhaps private networks wrapped in strict Zero Trust controls will get back into “vogue”, one panellist said.
AI dates back to 1943
While machine learning models in cybersecurity date back to concepts from 1943, modern artificial intelligence has drastically altered the threat dynamic by lowering the barrier to entry for cybercrime. And now, low-skilled adversaries can utilise AI to automate phishing campaigns, accelerate identity exploitation, and speed up data exfiltration and ransomware delivery.
AI is being weaponised in geopolitical debates, and lowering the point of entry to create vulnerabilities. Meanwhile, CISOs face internal pressure as boards demand the rollout of generative AI tools to workforces, leaving security teams tasked with scaling these technologies safely without exposing proprietary IP or introducing unmanaged software vulnerabilities.
Practical Resilience
We must build resilient enterprises by navigating a fragmented regulatory landscape, all agreed. Friction exists between some regulators pushing for agile, consumerised business models with security measures driving up operational costs, and those making long-term capital investments to protect critical infrastructure.
The industry must prioritise cross-sector data sharing and interoperability to suppress collective risk levels. Operational resilience requires a pragmatic admission that attacks will breach defences, but true resilience is not preventing every incident, but designing systems where non-critical network segments can be isolated or taken down post-attack without taking mission-critical assets offline, said Nicole Wong, Operational Technology Product Manager, Darktrace.
How can organisations enhance real-time fraud intelligence-sharing between banks, telcos, and platforms? Find out at Identity Week Europe 2027.
