The Great Cybersecurity Reset
16th October 2025 • Park Plaza Victoria, London
If cybersecurity is a national priority, then everything changes. So, what happens when security is truly taken seriously?
New skills, new tech, new paradigm
Even if the Spanish power outage was not a cyber-attack, it made it clear how much a targeted attack on CNI would cause. Attacks on other parts of the public sector and a continuous stream of serious breaches in businesses large and small are a constant reminder of the ongoing costs to the economy and society of digital insecurity. And the rapid convergence of physical and digital infrastructure is amplifying the challenge.
But it has taken the resumption of, effectively, a new cold war to fully wake western governments up to the true scale of the threat. The initial responses, in terms of budget and regulation, are just the beginning.
In trying to secure their own critical functions, governments will learn that software developers and the manufacturers of connected devices will have to be regulated and forced to build secure products.
They will learn that their security actually depends on a host of insecure third parties who will have to be persuaded that their own individual security – with its particular P&L implications and ROIs – is insignificant versus the need for collective security. Weak links and selfish thinking will have to be replaced by rigorous standards that allow states to understand the national security posture.
Most importantly, they will learn just how little progress has been made so far. And it will shock them.
They will see how senior management has skimped on security while talking the talk. They will be surprised by the lack of cybersecurity expertise at Board level. They will want to know why security leaders are not more senior within corporate hierarchies and why security staff are so often contractors, or newly-hired and unstandardised.
And they are already dissatisfied with the levels of transparency and accountability in security, particularly when it comes to incident management.
Businesses, public sector organisations, providers of digital and phygital infrastructure and security vendors themselves all need to get in front of all this – and fast. What does this mean?
- We need to develop the current reactive security model towards prevention
- We must develop holistic security in the face of digital/physical convergence
- We must accept that ‘when not if’ breach arguments demand resilience more than security
- We need a truthful discussion around the critical under-funding of security at most organisations
- We need a new paradigm for CISOs and security staff with standardisation of roles, proper team staffing, better skillsets to cope with AI and automation
- We need more and better regulation to ensure collective security: the third-party problem (and indeed most of the traditional cybersecurity issues) is mitigated if everyone is forced to maintain a proper basic level of security.
- We need to look at firms who must be secure (in defence for example) and ask whether we should look again at Cloud and SaaS
- We need full regulation of monopolistic private sector firms upon whom CNI is critically dependent. They will become as regulated as those who depend on them otherwise resilience is an empty concept.
In other words, we need a radical re-engineering of security as it is currently managed but based on truths we have all known for years. Yes, we also need new technology and better security stacks. But much of what needs to be done is simply taking security seriously as a material business risk and treating it just as we do other risks under the GRC umbrella.
