The new cyber security topography: Sovereign risk, AI readiness & the evolving cyber landscape

With growing AI threats, sprawling hybrid estates, outsourced functions, and mounting regulatory pressures, organisations are grappling with a cyber landscape shifting at uncomfortable speed. 

So how can security leaders and teams retain visibility and control while modernising at pace and preparing for AI-enabled threats? 

Fresh from a national briefing on the topic, Peter Soulsby, Brennan’s Director of Cyber Security, tackles the question, offers visibility on the solutions, and reveals how peers are grappling with a cyber landscape undergoing big shifts. 

The key themes discussed were: 

• Accountability doesn’t change just because AI is involved.​Organisations remain responsible for outputs delivered to customers/users. For example, even if AI chatbots give incorrect information, regulators and customers will still treat it as the organisation’s statement. 
• AI expands the attack surface and accelerates attacks ("machine-speed").​A recurring concern was automated discovery/exploitation (e.g., scanning many endpoints quickly, finding weak/no-auth endpoints, then extracting large datasets and prompts).
• "Getting the basics right" becomes even more critical.​ Before chasing futuristic controls, the group repeatedly returned to fundamentals: identity and access management, authentication, credential/secret management, data security and governance, and reducing exposed public endpoints. 
• Data governance is the central issue: where data goes, how it’s used, and who can access it.​Questions included: Where is our data stored? Is it used to train models? What do the enterprise agreements say? What telemetry/content is retained? What happens when tools want broad access (e.g., SharePoint/Teams/enterprise repositories)? 
• Third-party/vendor risk and "AI-washing"​. People noted a flood of vendors/start-ups offering AI capabilities and seeking to ingest organisational data. Risks raised included weak security maturity, unclear contracts, and even cases where "AI" was actually humans processing data manually offshore. This was linked to shadow IT and the simple ease of adding third-party vendor apps/services via simple credit-card procurement. 
• Balancing enablement vs protection (moving from ‘no’ to guardrails).​ A strong theme was avoiding being the constant blocker by creating a structured intake: standard questions/checklists, fast-track approvals for low-risk use, and clear rules for what is never acceptable.
• Emergence of ‘AI for governance’ patterns(triage agents, policy assistants, safe sandboxes). 
• AI is being embedded everywhere.​ Often by default. Concerns were raised about software vendors bundling AI into products, reducing the organisation’s ability to opt out and increasing the need to understand embedded data flows and guardrails. This is a troubling trend for those with real-world output accountability, esp. in construction and health, where incorrect output can potentially lead to human harm. 
• Human factors remain decisive:​ training, behaviour, and incentives. Several comments highlighted that policy alone won’t stop people; you need education, sanctioned tools, and ongoing enablement. 
• Risk isn’t only cyber:​safety, ethics, and regulatory pressure. Beyond data breaches, participants raised risks of incorrect guidance in safety-critical contexts.
• Workforce and skills shifts:​expertise still needed to validate outputs and handle edge cases. While AI can reduce routine work (drafting, reporting, initial analysis), the discussion stressed the need for experienced people who can validate outcomes, handle the "2%" complex cases, and maintain institutional knowledge as automation increases.

​