Category: News, Awards and Industry Recognition

By Nige Wilkinson, COO, Cyberfort

Recent high-profile cyber breaches have made uncomfortable reading for business leaders across every sector. Incidents in the last 12 months at Jaguar Land Rover and Marks & Spencer point to a widespread failure to treat the supply chain as a live attack surface.

Most organisations have invested heavily in their own cyber defences. But, the supply chain, by contrast doesn’t receive the attention it deserves with many organisations only completing a yearly questionnaire to pass a compliance audit and not taking real time actions to address potential vulnerabilities.

The attitude towards supply chain security needs to change if organisations are to move to becoming more secure and resilient both today and in the future. Supply chain security gaps can no longer be seen as minor oversights, they need to be treated as critical vulnerabilities.

According to the UK Government’s Cyber Security Breaches Survey 2025, just 14% of UK businesses reviewed the cyber risks posed by their immediate suppliers in the last 12 months. The number falls further still when you look beyond tier-one relationships into the wider supply ecosystem.

The real risk is not third parties. It is permanent access

The instinct is to frame supply chain security as a problem of third-party risk. But that framing misses something important. Organisations do not get breached simply because a supplier exists. They get breached because suppliers are over-trusted once they are onboarded, then quietly forgotten. Access is granted, rarely revisited, and almost never reduced.

What that creates is a population of accounts and access pathways that persist long after the justification for them has changed, or in some cases, disappeared entirely. When people leave a supplier organisation, those accounts do not always follow them out the door. When a supplier’s own controls weaken over time, nobody is checking. And when an adversary compromises a downstream supplier and begins traversing their way up the chain using perfectly legitimate credentials, the defences you have built around your own environment offer no meaningful resistance, because the attacker is coming in through an approved route.

The risk is not the third party. The risk is permanent access in a constantly changing environment.

You cannot manage what you cannot see

Suppliers accumulate in organisations without systematic oversight. Teams procure tools, services, and technical support independently. Contracts get signed and relationships begin without the knowledge of those responsible for managing supplier risk. By the time anyone attempts to map the full landscape, the picture is considerably more complex than the official supplier list suggests.

At an event last year, a CISO for a major airline described beginning a supply chain security programme not with assessment, but with mapping. He drew out the entire passenger journey and identified every third-party dependency at each stage. What emerged was a supply chain far broader than his organisation had previously recognised. You need to do the same: understand the full ecosystem, rank suppliers by criticality, and identify who has access to your systems. A one-person consultancy buried in tier three may carry more risk than a large, well-known provider, precisely because nobody is watching it.

Compliance is a baseline, not a guarantee

There is an understandable temptation to rely on certifications and questionnaires as a proxy for assurance. If a supplier holds ISO 27001 or has passed Cyber Essentials Plus, it is natural to assume that a meaningful level of control is in place.

The problem is that certifications confirm what an organisation looked like on a particular day. Cyber Essentials Plus is renewed annually, much like a car MOT. A supplier can be in excellent shape on the day of audit and in a significantly weaker position the following day if patching lapses, logs go unreviewed, or staff turnover leaves gaps in access management.

Sending a supplier a checklist asking whether policies exist and controls are in place provides something to point to if things go wrong, but it does not provide assurance that those controls are functioning. Active, independent assessment is a different exercise entirely, and for critical suppliers, it is the only approach that gives you genuine confidence.

What the regulatory landscape is telling you

It would be a mistake to view supply chain security purely through the lens of breach avoidance. NIS2, DORA, and the UK Cyber Resilience Act all place significant obligations on organisations to demonstrate active oversight of their supply chains, across financial services, regulated industries, and commercial supply chains alike. Organisations with documented criticality registers, evidence-based assessments, and clear remediation plans will be far better positioned to respond. Those still relying on periodic questionnaires will find themselves exposed, both operationally and in terms of regulatory standing.

Where to start

The priority is visibility. Map your supply chain before you attempt to manage it. Understand who is in your ecosystem, what access they hold, and what the impact would be if they were compromised or unavailable. Rank suppliers by criticality, not just by contract value or brand recognition.

From that foundation, build a management approach that is proportionate to the risk each supplier represents. Critical suppliers with system access require active, evidence-based assurance. Lower-risk suppliers require less intensive oversight. The approach should be calibrated, not uniform.

Supply chain security is no longer a background compliance task. For organisations that want to protect their operations, their customers, and their reputations, it is one of the most pressing operational priorities of the moment.

Read the article on IT In The Supply Chain here https://itsupplychain.com/your-supply-chain-is-not-a-peripheral-risk-it-is-your-greatest-vulnerability/

By Glen Williams, CEO, Cyberfort

What’s been your business high point of the last 12 months?

Without doubt, it’s the progress we’ve made in harnessing the power of AI across the business. While we’re still at a relatively early stage in that journey, what’s already clear is the significant impact it can have – from streamlining operations to enhancing how we deliver for clients. The potential we’re seeing gives us real confidence in where it can take us over the next few years and getting that foundation right has been a genuine highlight.

Name one thing your company is looking to achieve in 2026.

One of our key goals for 2026 is to firmly establish ourselves as the ‘Employer of Choice for Neurodiverse Employees’ and it’s something we’re genuinely passionate about. We’re actively working to build an environment where neurodivergent talent isn’t just welcomed, but truly valued and supported. We’ve already made significant progress in this area, from the way we recruit through to how we structure roles and support our people day-to-day. For us, this isn’t a box-ticking exercise – it’s about building a stronger, more diverse business that benefits everyone.

What keeps you awake at night as a partner leader?

Honestly, the question that sits with me most is: “How do you build an enduring company culture in a world of remote working?” It’s one of the defining challenges of modern leadership. Culture has always been the backbone of any successful business, but so much of it was built organically through shared spaces, chance conversations, and the everyday moments that happen when people are actually together. When your team is apart, you have to be far more intentional about creating that. Getting it right means people feel genuinely connected to the mission and to each other, regardless of where they’re logging in from. Get it wrong, and you risk ending up with a group of individuals rather than a team. It’s something I think about a lot.

Is AI being over-hyped?

In short, the answer is no. I genuinely believe AI is the most significant technology development of the past five years, and possibly much longer than that. Yes, there’s a lot of noise around it and not every claim lives up to scrutiny, but the underlying capability is real and it’s advancing fast. What we’re seeing isn’t a bubble – it’s a fundamental shift in how businesses operate, how problems get solved, and how value gets created. The organisations that treat it seriously now and invest in understanding how it applies to their world will be the ones with a real competitive edge. The hype may come and go, but the technology itself is here to stay.

What’s been your most successful internal AI project to date?

Our AI agent has genuinely been a gamechanger this year. We’ve deployed it across several areas of the business and the results have been really encouraging. Where it’s had the biggest impact is in reporting and data analysis – tasks that previously took considerable time and resource can now be done faster and with greater accuracy, which means our people can focus on the things that actually require human judgement. It’s also accelerated how quickly we can identify and implement process improvements, which in a fast-moving environment like ours makes a real difference. What makes it our most successful internal project is simple: it’s delivering tangible, visible results across the business, and we’re only scratching the surface of what it can do.

Can you share a surprising prediction about how UK IT channel partners or the UK IT channel will evolve over the next five years?

It may not be the most surprising prediction, but I think it’s one of the most important ones to pay attention to is that consolidation in the channel is going to continue and accelerate, particularly in the cyber partner space. The market is still quite fragmented, and as customer expectations rise, the complexity of what’s required to deliver genuine cyber security outcomes is increasing too. Smaller partners will find it harder to keep pace with the investment needed – in technology, in talent, and in compliance. That creates natural pressure toward consolidation, whether through acquisitions, mergers, or tighter partnerships. For those who get ahead of it and position themselves well, it represents a significant opportunity. For those who don’t, the next five years could be quite challenging.

Which tech gizmo could you not function without?

It has to be my iPhone. I know it’s probably the most common answer you’ll hear, but there’s a reason for that – it really has become indispensable. It’s not just a phone anymore, it’s essentially my mobile command centre. Whether I’m staying on top of emails on the move, jumping on a call, keeping across the news, or managing my day, it’s always in my hand. I genuinely think it’s changed the way we all work and not always in ways we notice until you imagine being without it. Take it away and I think most business leaders would feel the impact within the hour.

Which three famous people, dead or alive, would you invite to a dinner party?

Easy one for me – Ian Botham, Ben Stokes and Andrew Flintoff. Yes, I’m a cricket fan! But beyond the sport, what those three have in common is that they’re not just great cricketers – they’re genuine characters and winners. Each of them has that rare ability to change the mood of a room, lead from the front under real pressure, and carry people with them. I think the conversation would be anything but dull. You’d have Botham’s largerthan-life stories from a golden era, Flintoff’s humour and heart, and Stokes bringing that quiet intensity and modern leadership perspective. I think we’d have an incredible night and I’d share a beer or two with them.

If you had a warning label, what would it say?

Mine would probably read: “Warning: may deliver feedback with more directness than expected.” I’ve always believed that straight talking, done respectfully, is one of the most valuable things a leader can offer. People always know where they stand with me, and I think that builds trust over time even if it can catch people off guard initially.

Which tech figurehead has impressed you the most this year?

For me it has to be Mike Norris at Computacenter. What he’s achieved in building Computacenter into a FTSE 100 company is genuinely remarkable. This is a UK-founded, channel-focused technology business that has grown into one of the most respected names in the industry and that doesn’t happen by accident or overnight. It takes vision, consistency, and the ability to execute over a very long period of time.

Read the article on IT Channel Oxygen here https://giacom.com/it-channel-oxygen-partner-leaders-report/

By Glen Williams, CEO, Cyberfort

Cyber insurance has become one of the most heavily marketed business products of the last decade, and the reasons are easy to understand. Headlines are dominated by warnings of nation state actors, organised ransomware cartels and supply chain compromises that can bring entire sectors to a standstill.

Against this backdrop, boards across the world are under mounting pressure from brokers, regulators, and investors to purchase ever more comprehensive cover. Yet in an ironic twist, the most damaging security breach is rarely the one any insurance policy was designed to anticipate or cover.

The uncomfortable truth is that an intruder is far more likely to walk through the front door in a four pound high-vis jacket and a clipboard in hand than to tunnel through the firewall with a zero day exploit.

That is not a marketing line, it is an operational reality our consultants observe during physical and social engineering assessments. The person asking to read the meter, or holding the door while an employee swipes their pass, represents a far greater form of risk that no policy wording has yet managed to capture.

The pressure to insure against the wrong threat — Cyber insurance premiums have climbed steadily since 2021, and the questionnaires that accompany them have grown longer and more prescriptive with every renewal cycle.

Businesses are being asked to evidence multi factor authentication, endpoint detection, immutable backups, and further controls that stretch into dozens of line items. These are sensible measures and we would encourage any organisation to of course adopt them as standard practices.

The difficulty arises when leadership teams mistake the completion of an insurance schedule for a genuine programme of cyber resilience. A policy is a financial instrument that responds after an incident has occurred, and the payout, where it materialises at all, rarely covers reputational damage, regulatory consequence, or the loss of a customer who decides your organisation is no longer a safe pair of hands.

Treating insurance as the centre of strategy also distorts investment priorities, and we regularly see finance directors commit significant sums to premiums while the budget for staff awareness, access reviews, and physical security remains untouched from one year to the next.

Where risk actually lives

Risk does not reside exclusively in technology, and any assessment that treats it as such will miss the majority of the attack surface.

Risk lives in the new starter who has not been briefed on processes, in the third party supplier whose engineer has unsupervised access to your server room, in the printer that still holds a cached copy of last quarter’s board papers and in the leavers process that allows a departed contractor to retain working credentials for months after their engagement has ended.

The organisations that weather incidents most effectively are those that have mapped their genuine risk landscape across three dimensions, namely people, processes, and data. People covers the behaviours, training, and culture that determine how employees respond to the unexpected visitor or the unusual email. Processes covers everything from vendor management to visitor control and physical access through loading bays and back entrances.

Data addresses where information is held, who can reach it, and what would happen in commercial terms if it were exposed, altered, or held to ransom. When these dimensions are understood together, technology investment becomes far more effective because it is targeted at genuine exposure rather than at threats that happen to be fashionable.

Resilience is earned, not purchased

Cyber insurance has a legitimate role to play in any mature risk programme, and I am not suggesting for a moment that a responsible business should be without it. It should, however, be regarded as a backstop rather than a strategy, the equivalent of the business interruption cover that sits alongside a well run continuity plan rather than replacing it.

True resilience is earned through discipline, through honest assessment, and through a willingness to look beyond the firewall to the receptionist’s desk, the loading bay, and the coffee shop where a contractor is working on an unsecured network.

The £4 high-vis jacket will remain one of the most effective tools in an attacker’s inventory for as long as organisations spend more on insuring against the wrong threat than on understanding the one that is already walking, unchallenged, past the front desk.

Read the article on Business Quarter here https://businessquarter.co.uk/wp-content/uploads/2026/07/Business-Quarter-Issue-4-Q2-2026.pdf

By Glen Williams, CEO, Cyberfort

There is a phrase that should concern every board member and security leader operating in today’s threat landscape: “We’re covered.”

It sounds reassuring. It implies preparedness. In reality, it often signals the opposite.

Cyber-insurance has matured rapidly over the past decade into a legitimate and important component of organisational risk management. Policies now routinely cover business interruption losses, legal and regulatory costs, incident response support, ransom negotiations and reputational recovery. For organisations hit by a significant breach, that financial cushion can be genuinely significant.

But somewhere along the way, too many organisations began treating the policy as a proxy for the security strategy itself. Buying cyber-insurance cover became the endpoint rather than the backstop. And that confusion is now creating a dangerous gap between perceived protection and actual resilience.

Insurance covers the aftermath

A payout, however substantial, cannot restore trust with customers overnight. It cannot reverse reputational damage. It cannot undo the operational disruption of a manufacturing plant grinding to a halt, a logistics network going dark, or a hospital losing access to patient records. And it absolutely cannot stop an attacker who has already found their way in.

The financial mechanics of insurance have never been designed to do those things. They exist to absorb economic shock after an incident, not to reduce the likelihood of one occurring.

What drives likelihood is resilience. And resilience is something most insurance policies neither measure nor reward, at least not yet.

What insurers are actually asking for

The cyber-insurance market has changed significantly. A few years ago, insurance companies were issuing policies based on relatively lightweight questionnaires, broad assumptions about controls and limited scrutiny of what organisations had actually deployed. That era is closing.

Underwriters today want evidence. They want to see demonstrable incident response capability, not a document that has never been tested. They want visibility into backup maturity and recovery timelines. They want governance structures, identity and access management, third-party risk controls and, increasingly, proof of continuous monitoring and detection capability.

The question insurers are quietly beginning to ask is no longer simply “do you have controls in place?” It is “can you prove your environment is defensible and recoverable?” Those are meaningfully different questions, and many organisations are not yet equipped to answer the second one convincingly.

For businesses that cannot demonstrate genuine operational resilience, the implications are tangible; higher premiums, reduced coverage limits, more restrictive policy exclusions and in some cases, rejected claims where the insurer determines that basic controls were absent.

The compliance trap

Much of the problem stems from how organisations still approach cyber-security. The dominant mindset in many businesses remains compliance led. Have we achieved the relevant certifications? Have we filled in the annual questionnaire? Have we renewed the policy? Box ticked.

What that mindset consistently fails to ask is the more important operational question: could we continue functioning if we were attacked tomorrow?

Compliance and resilience are not the same thing. Passing an audit demonstrates that, at a point in time, documented controls existed. It says very little about whether those controls would hold under pressure, whether staff would know what to do in a crisis, or whether systems could be recovered at the speed the business actually requires.

The organisations that discover these gaps most painfully are those that find them during an incident rather than before.

The human layer remains the weakest point

One of the persistent realities of modern cyber-risk is that the most sophisticated technology stack in the world can be bypassed by remarkably simple means. Attackers do not always need advanced tooling. Sometimes they need someone to hold a door open, a member of staff to click a plausible-looking email, or a supplier with legitimate access and poor credential hygiene.

The human and operational layer of risk remains stubbornly underestimated. Tailgating, impersonation, social engineering, compromised third-party access, and weak verification processes. These are the vectors that continue to feature in significant incidents, not because they are new or sophisticated, but because they exploit trust, routine and the natural tendency of people to prioritise helpfulness over scepticism.

Insurance provides no meaningful protection against these vectors. Only operational rigour does.

Recovery is now a board-level question

The conversation in most boardrooms has shifted from whether a breach might happen to what would happen if it did. That shift in framing is healthy, but it demands a corresponding shift in investment and preparation.

Boards are now asking how quickly systems could be recovered, what a period of downtime would cost, which data and processes are genuinely critical and whether the business could continue trading through an incident. These are not questions that insurance answers. They are questions that resilience planning answers.

Cyber-resilience has become as much a business continuity issue as a technology issue. Recovery speed, containment capability, crisis communications, operational fallback: these capabilities need to be built, tested and embedded before an incident occurs, not assembled under pressure in the middle of one.

Confusing policies with protection

None of this is an argument against cyber-insurance. It remains an important layer of protection and a sensible component of any risk management programme. For businesses operating at scale, or in regulated sectors, it is increasingly non-negotiable.

But it should be understood clearly for what it is: a financial backstop, not a strategy. It is the last line of defence, not the first. It will solve some of your problems, but not all.

The organisations best positioned today are not those with the largest policies. They are the ones that have genuinely understood where their risk sits across people, processes and data; that have built demonstrable operational resilience; and that can show insurers, customers and regulators alike that they are materially harder to disrupt than their peers.

In a threat landscape where the question is no longer ‘if’ but ‘when’, the most dangerous words a business leader can say are still “We’re covered.”

Read the article on teiss here: https://www.teiss.co.uk/news/covered-but-not-protected

By Glen Williams, CEO, Cyberfort

Neurodiversity is no longer a niche workplace issue. It is part of the reality of modern teams, modern leadership and modern performance. For HR and business leaders, that presents a clear opportunity. Organisations that create environments where different thinking styles can do their best work, will have the ability to widen their talent pool, improve decision making and build more resilient teams. The outcome is not simply a more inclusive culture, but a more capable one.

The CIPD estimates that around one in five people are neurodivergent in some way. Many will never disclose a diagnosis to their employer. If hiring and management processes only work for people who fit a narrow, outdated definition of how a strong candidate should communicate, collaborate and perform under pressure, organisations risk missing exceptional talent. In a labour market where skills are scarce and competition is high, that becomes a commercial issue.

I lead a cybersecurity business, where complex problem solving, accuracy and judgement are critical. But this is not unique to technology or security. Any organisation that depends on analysis, creativity, sustained concentration or precision can benefit from neurodivergent talent, provided it designs work in a way that allows people to thrive. The focus should not be on labels. It should be on capability.

Understanding strengths without falling into stereotypes

It is important to approach neurodiversity carefully. It is not a single profile and it does not map neatly onto job roles. Even within the same diagnosis, there is huge variation. The aim is not to stereotype or assume strengths. The aim is to recognise that organisations perform better when they make room for different cognitive approaches rather than rewarding one narrow model of professionalism.

In high pressure and technical environments, certain strengths often emerge. Some people can sustain deep focus for extended periods when working on tasks that engage them. When supported properly, that can translate into exceptional output and consistency in complex work. Some individuals have outstanding attention to detail, which is invaluable in roles that depend on spotting patterns, anomalies or risks.

Another commonly overlooked strength is direct communication. Some neurodivergent individuals communicate literally and clearly. In the right environment, this can improve performance because ambiguity is reduced and assumptions are challenged early. What may be misinterpreted as bluntness is often precision. In organisations where unclear communication is a major cause of inefficiency, precision is an advantage.

Designing work for performance, not exceptions

Many organisations still approach neurodiversity through the lens of individual adjustment, making one off accommodations for a small group of people. While well intentioned, this can create friction. Managers can feel they are being asked to make special arrangements, and employees can feel singled out.

A more effective approach is to start with the workplace itself. Ask what great work requires and what gets in the way. Then design roles, expectations and workflows accordingly. This shifts the focus away from looking to “fix individuals” and towards creating an environment where different people can perform well.

For some roles, this means protecting time for deep work and reducing unnecessary interruptions. For others, it means clarity around priorities and outcomes. In some cases, it involves structuring work into defined packages with clear deliverables rather than expecting uniform output every day. Some people do their best work in intense periods of concentration followed by recovery time. If the only accepted model is steady daily output, high performers can be misjudged as inconsistent when the real issue is misaligned work design.

This is not indulgence. It is effective workforce planning. It also benefits everyone, not just neurodivergent employees.

Rethinking recruitment to avoid losing talent

Recruitment is one of the most common points at which organisations lose neurodivergent candidates, often without realising it. Exclusion is rarely intentional. More often, it happens through outdated hiring practices that prioritise performance in interviews over evidence of capability.

For example, interviews frequently reward confidence, speed and social cues. Those qualities are not reliable indicators of job performance. Small changes can significantly improve fairness and effectiveness. To make interview processes accessible for neurodivergent candidates  organisations should be explicit about what candidates can expect from the process, which can include sending interview questions to candidates in advance of any interview. Hiring managers should use clear, direct questions that invite evidence rather than hypothetical scenarios. The approach should be to treat interviews as structured conversations, not tests designed to catch people out.

Silence should be allowed. Some people need time to process and formulate strong responses. Eye contact and body language should not be treated as proxies for competence. Time should be used well. If a CV has already been reviewed, asking a candidate to repeat it adds little value.

Where possible, skills-based assessments should play a greater role. Practical exercises and work sample tests often provide a more accurate picture of capability and reduce the noise created by interview performance. They also tend to be fairer for all candidates, not just those who are neurodivergent.

Moving from disclosure to curiosity

One of the most powerful shifts organisations can make is moving away from disclosure led support towards curiosity led leadership. Rather than waiting for individuals to disclose a diagnosis, leaders should normalise asking a simple question such as: ‘how do you like to work at your best?’

This opens up conversations about communication preferences, working patterns, meeting styles and feedback without requiring labels. It also supports people who are undiagnosed, unsure or private. The result is a workplace that is better designed for everyone, not just those who feel able to speak up.

The cost of standing still

The business risk of failing to adapt is real. The National Autistic Society highlights that only around three in ten autistic adults are in work. That statistic points to a significant pool of untapped capability. It also highlights how much talent is filtered out by systems that were designed for a workforce of the past.

There is also a retention risk. As awareness grows, more people will articulate what they need to do their best work. If organisational culture treats reasonable adjustments as an inconvenience or advantage seeking, engagement will suffer and talent will leave. Often, leaders will never know what they lost, only that performance declined and hiring became harder.

Building workplaces that let different minds excel

Neurodiversity is often framed as a moral issue. It is that, but it is also a strategic one. Organisations that succeed in the coming years will be those that stop trying to standardise people and start designing work that allows different minds to excel.

This is not about policies or slogans. It is about building workplaces that think better, adapt faster and perform more consistently under pressure. For HR and business leaders, that is not a future aspiration. It is a present-day advantage.

Read the article on The HR Director here: https://www.thehrdirector.com/features/neurodiversity/neurodiversity-reshaping-attraction-retention/

Featuring Nige Wilkinson, COO, Cyberfort

Cybersecurity regulation is changing, driven by a need to be more robust in the face of increasingly sophisticated attacks. As 2026 kicks off, what are the key regulatory changes that will impact UK businesses?

Cyber Resilience Will Be Essential

One major legislation expected in the coming year is the Cyber Security and Resilience Bill, which brings with it a new set of resilience requirements. As the Bill enters Parliament, cyber resilience will “stop being a compliance checkbox “and “become a board-level operational performance test that recognises people, ways of working and the technology needed to succeed,” says Dan Jones, senior security advisor at Tanium.

“The UK government is making it clear that ‘reasonable steps’ and after-the-fact reporting won’t fly in a world where one weak supplier can knock out hospitals, councils or entire supply chains effecting the livelihoods of families and whole communities,” he says.

Over the next year, organisations that can’t prove continuous control of their environments will be “exposed to regulators, customers, and to reality,” he warns.

A key shift, which will not feature as one bill or regulation, is “the incorporation of demonstrable operational resilience into existing legal and regulatory frameworks,” adds Martin Davies, senior audit alliance manager at Drata. “Beyond having security policies in place, firms need systems and suppliers that can withstand disruption and recover within defined tolerances. This already exists as part of the Financial Services regulatory outlook (FCA’s Operational Resilience PS21/3) and is likely to become a facet of regulatory requirements in broader sectors.”

More Companies Will Find Themselves In Scope Of Key Regulation 

As the Cyber Security and Resilience Bill comes into force, it brings with it mandatory adoption of the Cyber Assessment Framework across critical sectors. The scope of regulation expands as the definition of Relevant Managed Service Providers (MSPs) is broadened, placing more of these firms “directly in the regulatory spotlight,” says Jamie Akhtar, CEO and co-founder of CyberSmart. “This change introduces new duties around incident reporting, baseline security controls and formal assurance, meaning that both service providers and their customers must operate with far greater transparency and discipline.”

Supply Chain Risk in The Spotlight

In 2026, regulation will put supply chain risk under the spotlight, experts predict. Supply chain risk has become “hard to ignore,” says Akhtar. High-profile interventions such as the FTSE 350 cyber letter and the latest CSM v4 requirements for defence suppliers have “pushed the issue into the mainstream,” he says.

Large organisations now expect their upstream suppliers, including SMEs, to show that they have implemented basic controls and can maintain resilience in a “consistent and certifiable way,” according to Akhtar. “The bottom line is that we will see the emergence of a market that values demonstrable, continuous cyber competence over declarations of intent.”

The Cyber Security and Resilience Bill will introduce “tougher scrutiny of supply-chain security,” adds Sam Peters, chief product officer at IO. “It will require organisations to standardise supplier due diligence, risk scoring and ongoing monitoring across departments to avoid fragmented processes. Businesses will also need to link supplier controls directly to the organisation’s risk register and resilience expectations, and maintain continuous assurance evidence for high-risk suppliers rather than relying on one-off questionnaires.”

In 2026, third and fourth-party cybersecurity will come under even greater scrutiny, says Mike Smith, partner – security at TXP. “Companies that fail to meet required security levels risk losing business over the coming months as the risk for their customers is simply too high.”

Security initiatives, such as red teaming and penetration testing, and developing robust processes around reporting, “will be crucial for suppliers, ensuring their security standards stand up to external scrutiny,” he adds.

Accountability Requirements Put CISOs “In The Firing Line”

In 2026, legislation such as the UK’s Cyber Security and Resilience Bill will “radically reshape accountability for cyber breaches,” by expanding the definition of critical infrastructure and introducing mandatory 24-hour breach reporting, with escalating fines for non-compliance, says Mark Jow, technical evangelist EMEA at Gigamon.

This legal shift puts CISOs “directly in the firing line,” says Jow.

Ultimately, the legislation moves cyber resilience “decisively into the boardroom,” says Nigel Wilkinson, COO at Cyberfort. “It will no longer be credible for senior leaders to say cyber is ‘owned by IT.’ Regulators will expect clear accountability, informed oversight and proof that cyber resilience is treated like any other critical business risk.”

High-Profile Attacks Will Give The Cyber Security And Resilience Bill A Political Boost

The attacks of 2025 — and the downtime as a result — will inevitably make the Cyber Security and Resilience Bill a key focus in 2026, says Mike Upton, director of partnerships and ecosystem, e2e-assure. “Historically the attitude among critical organisations has been to hold back budget and deal with issues post-breach, with little understanding of how harmful or expensive an approach that can be.”

The Bill promises to change this by making critical organisations implement risk management and improve their cyber posture, he says. “While there’s still aspects of to be finalised, the requirements as they currently stand could still see some stakeholders baulk at the spend required to ensure compliance. If that happens, there will inevitably be a few sacrificial scapegoats to encourage other entities to fall into line.”

UK Government Could Introduce Regulatory Sandboxes for AI

In 2026, it is likely there will be developments in the UK government’s plans to introduce regulatory sandboxes for AI, says Kate Densiton, tech regulation lawyer at Bird & Bird. “In its consultation document on the sandboxes, it said evidence from pilots could lead to regulatory reforms, enabling UK businesses to adopt trusted AI. Having launched a consultation in late 2025, some legislation will be needed over the coming year to give the mandate, budget and scope for the conduct of the AI sandboxes.”

In the UK, it is still unclear what specific regulation will be implemented by the government covering AI. With so many aspects unresolved, there’s “a clear risk that AI usage by UK industry will be impacted by uncertainty,” says Densiton.

In-house lawyers must keep up to date on developments and decide how best to advise the business within the current environment, she says. “We expect the UK government to implement an incremental, narrow regulatory framework for AI in the UK, but clarity might not come until late 2026.”

Read the article on SC Media UK here: https://insight.scmagazineuk.com/regulation-predictions-key-uk-legislation-changes-coming-in-2026

By Nige Wilkinson, COO, Cyberfort

For many board directors in financial services, cyber security confidence is built on certificates, audit reports and regulatory tick boxes. The problem is that none of these things, on their own, actually prove an organisation is secure.

In recent years, regulation has pushed firms to demonstrate compliance at pace. In response, many institutions have invested heavily in frameworks, accreditations and assurance programmes that look reassuring on paper. But too often, this has created an illusion of control rather than genuine operational resilience. The result is what many security leaders now describe as ‘paper security’.

Compliance is not the same as capability

Frameworks such as ISO 27001, SOC reporting and sector specific regulatory requirements have an important role. They create common language, minimum standards and accountability. But they were never designed to prove that a business can withstand a real-world cyber attack.

Firms collect certificates, pass audits and reassure boards that security is under control, even when fundamental weaknesses remain. Accreditations are frequently delivered through narrowly scoped assessments that focus on documentation rather than behaviour, process effectiveness or real technical capability.

This is compounded by the growth of providers offering compliance led security services without the depth of expertise needed to deliver operational defence. In some cases, organisations receive assurance from firms that are not equipped to detect, respond to or recover from advanced attacks. The paperwork is correct, but the protection is thin.

Recent regulation has unintentionally reinforced this behaviour. The introduction of initiatives such as the Digital Operational Resilience Act and evolving FCA expectations around operational resilience have increased pressure on firms to demonstrate compliance quickly. The risk is that boards see regulatory alignment as the end goal, rather than a baseline from which real security maturity must be built.

The real cyber challenges financial services now face

As we move through 2026, the threat landscape facing financial services is becoming more complex, not less. Attackers are increasingly patient, well-funded and focused on exploiting operational weaknesses rather than technical flaws alone.

Supply chain compromise remains one of the biggest risks. Financial institutions are deeply interconnected with technology providers, outsourcers and partners. A single weak link can provide attackers with privileged access that bypasses traditional controls. Regulation has highlighted this risk, but many organisations still rely on questionnaires and contractual assurances rather than active oversight.

Ransomware continues to evolve, with attackers shifting focus from encryption to data theft and extortion. This puts regulatory, reputational and legal pressure on organisations simultaneously. At the same time, identity based attacks are rising, exploiting gaps in access management and user behaviour rather than software vulnerabilities.

One widely cited industry study shows that the majority of successful breaches now involve compromised credentials rather than technical exploits. This reinforces the point that documentation and policy alone do not stop attacks. Day to day operational discipline does.

Moving from paper security to operational maturity

The answer is not less regulation. It is a better interpretation of what regulation is trying to achieve. Boards need to move beyond asking whether the organisation is compliant and start asking whether it is genuinely prepared.

Operational maturity is about evidence, not paperwork. Can the organisation detect an attack quickly? Can it contain damage? Can it recover critical services under pressure. These questions cannot be answered by an audit report alone. They require testing, rehearsal and continuous improvement.

This shift also requires clarity about the role of security partners. Firms should be wary of providers that lead with certificates rather than capability. Effective security comes from teams that understand the threat landscape, can operate in real time and are accountable for outcomes, not just assessments.

Encouragingly, there is growing recognition across the sector that security must be treated as a business resilience issue rather than a compliance exercise. Regulators are increasingly focused on outcomes, not intent. That creates an opportunity for boards to reset the conversation and invest in security that works when it matters most.

Security That Works When It Matters

Compliance will always be part of financial services security. But when it becomes the primary measure of success, it creates dangerous blind spots. Paper security may satisfy auditors, but it does not stop attackers.

As regulation continues to evolve, boards have a choice. They can use compliance as a comfort blanket, or as a foundation on which to build real operational resilience. In 2026, the difference between the two will be felt most clearly when things go wrong.

Read the article on Finance Derivative here: https://www.financederivative.com/when-compliance-becomes-a-blind-spot-why-boards-are-being-misled-on-cyber-security/

By Glen Williams, Cyberfort CEO

When technology looks the same, the real differentiation comes from honesty and long-term relationships

Today, in every corner of the channel, a race is taking place. Businesses are scrambling to attach themselves to the latest technology breakthrough, the newest AI model, or the most eye-catching automation platform. There is a belief that technological novelty alone will secure the next wave of business growth.

But in truth, technology is no longer the great differentiator it once was. AI is becoming accessible to everyone. Automation is no longer a luxury but a standard expectation. The more these innovations level the playing field, the more the real advantage shifts somewhere perhaps less glamorous and far more human: trust.

Trust over technology

Trust needs to become the channel’s ultimate currency. In the noise of competing messages, escalating product complexity, and a market full of solutions that all claim to be good enough, customers are tired. They are overwhelmed by choice, confused by jargon, and increasingly sceptical that a vendor has their best interests at heart.

What they are now seeking, and what they will increasingly value, are partners who act with integrity, who guide rather than simply sell, and who view the relationship as more important than a transaction.

As a channel leader, I have watched the shift happen in real time. The organisations that continue to grow are the ones that understand that trust is not a soft value or a marketing slogan. It is the most strategic asset any partner can build.

Integrity shows up not in what a partner sells, but in how they sell it. Customers can sense the difference between someone pushing a product to hit targets and someone giving clear, expert advice, even when that advice means recommending a different solution or admitting that their own services are not the right fit. The partners who are willing to take short-term losses for long-term honesty almost always build stronger, more profitable relationships over time.

Across the channel, this gap in trust is growing. Nowhere is it more visible than in cybersecurity. Too many companies are being sold inexpensive certifications or basic tools that tick compliance boxes but offer little real protection. It creates a dangerous illusion of safety, one that leaves organisations exposed to threats capable of bringing their operations to a halt.

Many businesses may not fully understand what they are buying or what specific risks they need to defend against. When vendors oversell lightweight solutions or fail to explain their limitations, they widen the divide between perceived security and actual resilience. If the channel is not truthful about what genuinely protects a business, we will never meaningfully secure the systems, data, and assets companies depend on.

This is where the best channel partners stand apart. They are the ones willing to say, “This will not keep you safe, and here is why.” They are transparent about risks, realistic about solutions, and confident enough in their expertise to risk losing a sale to protect a customer. In an industry drowning in noise, honesty becomes a refreshing and memorable differentiator.

Integrity is the new value driver

There is no denying the impact of AI on the channel. Much like cloud computing before it, it is transforming service delivery, accelerating product development, and reshaping how partners support customers. But it is also making many offerings look increasingly similar. When technology becomes commoditised, value shifts from what you provide to how you provide it.

AI can solve many real problems for businesses. But over the last 24 months, the market has been flooded with products hastily rebranded as AI to capitalise on the hype. Too often, the technology underneath has not meaningfully changed at all. Partners and customers are left wondering whether these tools genuinely deliver intelligent capability or whether the label has been added simply to accelerate sales. This opportunistic branding only adds to the noise and deepens the trust issues already growing in the channel.

This is why the partners who will thrive in the next decade are those who weave integrity into every part of their business. They create cultures where honesty is rewarded, not penalised. They train teams not only in product knowledge but in ethical decision-making and long-term thinking. They make transparency part of their everyday language, whether discussing pricing, capability limitations, risks, or alternatives. They invest in deep expertise, certifications, systems and processes so their recommendations genuinely protect customers rather than simply helping them pass an audit.

When trust becomes central to a company’s identity, everything changes. Conversations become more open. Loyalty strengthens. Customers begin to see partners not as suppliers but as advisors, people who act in their interest, provide clarity in complexity, and anchor decisions in truth rather than trends.

The channel’s future will not be defined by who adopts the most AI, automates the fastest, or sells the most security certifications. Those things matter, but they are no longer enough. The real competitive edge now lies in relationships built on transparency, ethics, and consistency. Partners who embrace this shift will find themselves winning not because of the flashiness of their offering but because customers believe in them.

Trust may not seem glamorous, but in a landscape crowded with identical claims and interchangeable technologies, it is the most powerful strategy we have.

Read the article on IT Pro here: https://www.itpro.com/business/business-strategy/why-trust-not-tech-will-decide-the-channels-future

By Glen Williams, Cyberfort CEO

For years, cybersecurity has been filed under the responsibility of the IT department, as if resilience could be achieved through technical controls alone. Yet the greatest weakness facing UK enterprises today is not a new strain of malware but persistent overconfidence in the boardroom. Far too many senior leaders believe their organisations are fully protected, while the operational reality tells a different story. This disconnect leaves businesses exposed in ways they often discover only after an attack.

The challenge is not a lack of technology. It is the misconception at the top that cybersecurity is in hand, when credentials, processes and controls are often outdated or incomplete. This happens not because IT teams are careless, but because they are expected to deliver enterprise-grade protection with limited budgets and little involvement from the wider business. The result is a dangerous mismatch between executive confidence and actual resilience.

Why board confidence rarely reflects reality

Boards usually receive cybersecurity updates in heavily distilled form heat maps, compliance reports or certificate renewals. This creates an illusion of protection. If the business passed its annual assessment, leaders assume the organisation is secure. If an auditor issued a certificate, they believe it represents ongoing protection. Yet certificates do not stop attacks, and they are meaningless if the underlying controls are not actively maintained.

A certificate reflects a moment in time, not the evolving risk position of a complex organisation. Attackers operate continuously while many businesses validate their defences annually. This mismatch leaves leadership teams with a confidence that is rarely justified. They equate compliance with protection, despite the two being very different measures.

Within IT departments, the picture is more complicated. Teams manage legacy systems, incomplete identity controls and cloud environments that have grown faster than governance. They know where vulnerabilities sit, but without adequate investment and cross-functional alignment they cannot address them. Executives assume infrastructure is protected, but those responsible for that protection are often aware of gaps they lack the bandwidth or budget to close.

Minding the communication gaps

A recurring issue is the lack of a shared language between technical teams and business leadership. CIOs and CISOs may outline risks clearly, but by the time those risks reach the board, they are simplified in ways that remove critical nuance. This turns cybersecurity into a tick-box exercise rather than a strategic dialogue.

Another misconception is that having an IT department inherently makes the organisation safe. Cybersecurity relies on every employee, supplier, process and system being aligned to the same standards. Yet many leaders behave as if they have “purchased” safety in the way they might purchase insurance. If you cut the budget, you cut the protection.

Communication gaps worsen the problem. IT teams know when infrastructure is too old to patch or privileged accounts have proliferated, but unless leadership treats this as business-critical intelligence, the issues remain. Without a culture that values transparency, teams stop escalating concerns because they no longer expect change to follow.

Creating a culture of accountability

Resilience begins when leaders recognise cybersecurity as a shared responsibility. Technology alone will not save a business. What matters is governance, ownership and culture. Senior leaders must move cybersecurity to the top of the agenda and empower their CTOs, CISOs and IT teams to implement the processes needed to protect the organisation.

This means aligning budgets to risk, not convenience. It means embedding cyber considerations into every strategic decision, just as financial or legal risks are considered today. It also requires ensuring the technical truth reaches the board without being diluted into a reassuring summary.

The wider workforce also plays a critical role. Employees need clear guidance, practical training and consistent reinforcement. Cybersecurity cannot be left to a single team; it must be lived across the organisation.

Why the Cyber Security and Resilience Bill matters

The government’s Cyber Security and Resilience Bill is a reminder that the UK must raise its defensive posture. The Bill aims to set minimum resilience standards and strengthen supply chain protections. Supply chains remain one of the weakest entry points for attackers. Organisations can invest heavily internally only to be breached through a trusted supplier with inadequate controls.

If boards better understood what the Bill entails and what is missing from their current plans, they would be more able to empower their technical leaders. Understanding regulatory direction allows organisations to invest proactively and promotes accountability across suppliers, lifting standards across the entire ecosystem.

A call to the boardroom

Cybersecurity will only improve when overconfidence is replaced with informed responsibility. Leaders cannot assume they are protected because they have an IT team, a certificate or a budget line. Resilience demands engagement, investment and continuous dialogue. It requires CEOs and boards to treat cybersecurity as a business imperative, not a technical afterthought. Only then will UK organisations be prepared to defend themselves against the threats that evolve around them every day.

Read the article on Networking Plus here: https://networkingplus.co.uk/news-details?itemid=9364&post=the-cybersecurity-blind-spot-at-the-top-915204