What happens if we’re wrong? Scenario analysis and the future of cyber security services

Cyber security conversations often rely on confident forecasts, shaped by market analysts, vendors, and organisational decision-makers: market growth numbers, technology roadmaps, and predictions about which tools or providers will dominate next. Several of these predictions age poorly. The cyber security ecosystem is shaped by rapid technological change, geopolitical shocks, and shifting social expectations, all of which interact in ways that are difficult to model or predict with confidence.

This presentation starts from a simple premise: being wrong about the future of cyber security is normal. The real question is how buyers, vendors, policymakers (and attackers) prepare for that uncertainty.

Building on my presentation from last year on cyber security market strategies and competitive advantage, in this session I will shift focus. Rather than analysing market structures and consolidation, I will use scenario analysis to explore how cyber security service delivery could evolve over the next 5–10 years; and what those changes would mean in practice if our current assumptions no longer hold.

The talk begins by looking back. Drawing on the past decade of cyber security services, it reviews how different capabilities have evolved: which ones commoditised, which resisted automation, and where human expertise remained essential despite technological progress. This historical context is used not to predict the future, but to ground my scenarios in observable patterns.

From there, the presentation introduces 3 structural drivers that sit outside the control of any single organisation: first, advances in AI and automation; second, geopolitical tension and conflict; and third, broader societal trends (trust, regulation, and digital dependence). Importantly, the session makes its assumptions explicit, clarifying which factors are held constant across scenarios and where uncertainty is deliberately explored.

Using this framework, a full set of cyber security services is outlined before focusing in depth on four representative services:

1. Security monitoring, detection and early warning; 
2. Incident response and crisis management; 
3. Recovery, resilience and post-incident support;
4. GRC. For each selected service, three scenarios are examined: two extreme but plausible futures and one more balanced, "in-between" outcome. These are not predictions, but stress tests designed to explore how different operating environments could shape service delivery.

Each scenario is analysed from the perspective of four key stakeholder groups: buyers, vendors, policymakers, and attackers, with attackers treated as rational economic actors responding to incentives and constraints. The analysis then looks beyond markets to examine concrete organisational impacts across business decision-making, operations, workforce and skills, and financial risk and cost.

The session concludes by drawing out common patterns across services and scenarios. This presentation aims to give the audience a practical way of thinking about uncertainty, highlighting where flexibility, resilience, and preparedness matter more than accurate prediction in the future of cyber security services.