Over the past few months, we have written several times about how AI may affect cyber security. In our previous blog post Infinite Zero Day Machine, so what?, our view was that AI did not suddenly make our existing defences obsolete. In Patching Faster Than Your Shadow?, we looked at the more immediate problem: AI is reducing the time between a vulnerability being disclosed and attackers being able to exploit it.

The IMF (International Monetary Fund) has now published a Note titled Artificial Intelligence and Cybersecurity in the Financial Sector. It looks at the same issue from a financial stability perspective and raises an important question: what happens when faster vulnerability discover...
>>[READ MORE]

NOTE: In this series of posts, we revisit recent presentations delivered at MU.SCL and provide additional context around the slide decks shared here. While a written post cannot fully reproduce the depth, examples, and discussion of a live session, it should help readers better understand the topic, the key messages, and the practical points behind the slides.

Cyber security does not fail because organisations lack frameworks, standards or good advice. In fact, the opposite is often true. There are more frameworks, control catalogues, maturity models, vendor recommendations, regulatory expectations and best-practice documents than most organisations can realistically absorb. The real problem is not the lack of guidance. The problem is deciding what matters most, in the context of a real organisation, with real constraints. ...
>>[READ MORE]

Last month, on the 13th May, I had the opportunity to take part in a panel discussion at the Security First Cyber Security Conference 2026 in Mauritius.
The event brought together practitioners, technology providers and business leaders around a timely theme: how cyber resilience needs to evolve in the human-AI era.

The wider conference covered several important topics, including AI-driven threats, identity, critical infrastructure, third-party risk, AI in the SOC, quantum resilience and the changing role of people in cybersecurity.

A recurring message was clear: AI is changing both sides of the equation.

It gives defenders new capabilities for detection, automation and analysis, but it also increases the speed, scale and sophistication available to attackers.

My contribution to one of the panel was focused on a more operational question: what really happens when an organisation faces its first serious cyber incident, and how can companies be b...
>>[READ MORE]

There was a time when "seeing is believing" was still a reasonable assumption.
That assumption is collapsing rapidly.

Over the last year, the quality of AI-generated identities, voices and videos has improved at a pace that many organisations underestimated. What was once easy to spot as "fake" is now becoming increasingly difficult to distinguish from reality, even for trained professionals.

One recent example that circulated online involved an AI-generated French woman presenting what appeared to be a legitimate French identity card in a video generated by Grok. The rendering quality, facial movements, document reflections and overall realism were sufficient to fool many viewers at first glance.
At the same time, threat actors are increasingly using live deepfake technologies during video calls, interviews and social engineering attacks. Security researchers and law enforcement agencies have already documented cases where attackers used AI-generated voi...
>>[READ MORE]

NOTE: In this series of posts, we revisit recent presentations delivered at MU.SCL and provide additional context around the slide decks shared here. While a written post cannot fully reproduce the depth, examples, and discussion of a live session, it should help readers better understand the topic, the key messages, and the practical points behind the slides.

Ransomware is no longer just malware. It is now a criminal business model, supported by developers, affiliates, brokers, negotiators, laundering services, help desks, data leak sites and a clear operating process. That was the main message behind our recent MU.SCL presentation, "Ransomware 2026: Inside the Criminal Enterprise", which looked at how the ransomware economy works, why victims still pay, and what organisations can do to reduce both the risk and the impact of an attack.

The first point to understand is scale. Chainalysis estimates that ransomware p...
>>[READ MORE]

NOTE: In this series of posts, we revisit recent presentations delivered at MU.SCL and provide additional context around the slide decks shared here. While a written post cannot fully reproduce the depth, examples, and discussion of a live session, it should help readers better understand the topic, the key messages, and the practical points behind the slides.

Most organisations still think of a cyber attack as something that starts when an attacker touches their systems. A phishing email arrives, a VPN login fails, a scanner appears in the firewall logs, or an endpoint alert is triggered. At that point, security teams start investigating and everyone agrees that something has begun.

But in many cases, the attack started earlier.

Not in a way that generated logs or triggered an alert, but in the attacker's preparation. Before the first malicious packet reaches the perimeter, the attacker may already know...
>>[READ MORE]

There is a conversation happening right now in boardrooms, leadership teams, and strategy sessions across almost every industry.
A conversation that has been recurring each time a new technology makes news head lines and is transformative: : "We need to adopt (insert technology name here). We need to move fast. Security, please stop being a blocker."
Of course, at the moment that technology is AI.
A few weeks ago I wrote about why organisations are rushing into AI and the risks that come with it. That post dealt with the pace of adoption and the absence of governance frameworks. This one is about something different: the internal cultural dynamic that the rush creates, and one specific damaging idea that keeps surfacing inside organisations under pressure.
The idea that being risk averse is the enemy of innovation (possibly) and that being security-aware (or conscious) is the same as being risk averse.
It is not. And t...
>>[READ MORE]