Cyber security is evolving. How can organisations keep pace?

Earlier this month, Hicomply joined QBS Software at the Churchill War Rooms in London for The Next Era of Cyber Conflict, bringing together cybersecurity experts to discuss the changing threat landscape and what organisations need to prioritise next.

Alongside speakers from Huntress, Nord Security and Dropzone AI, the afternoon explored everything from emerging cyber threats and AI-assisted security operations to the role of governance in building stronger cyber resilience.

Across the day’s discussions, one theme became clear.

As cyber threats evolve, organisations need a more connected approach to managing security, risk and compliance.

How is the cyber threat landscape changing?

Cyber threats are becoming more sophisticated, but so are the technologies helping organisations identify, investigate and respond to them.

Throughout the day, discussions explored several areas shaping the next era of cyber security:

Evolving cyber threats: How the nature of cybercrime is changing, with increasingly sophisticated attacks and emerging vulnerabilities‍
Identity and exposure management: The role of AI-assisted threat hunting in identifying and responding to identity-based attacks
AI in security operations: How agentic AI can investigae security alerts, identify threats and escalate findings to human analysts
Threat intelligence: How greater visibility of company domains and online activity can help organisations identify potential vulnerabilities and exposure

The growing role of AI and automation in security operations was prominent, and balancing this with the continued importance of human oversight and decision-making was clear.

But technology alone isn't the answer for how organisations respond to evolving threats.

As new security capabilities are introduced, businesses also need to consider how those technologies connect to their wider approach to risk, governance and accountability.

A key lesson: Security is one thing, proving it is another.

I shared insights which focused on the other side of identifying and responding to cyber threats:

What does it cost a business when it can't easily demonstrate its security and compliance posture?

The impact extends well beyond the next audit.

For organisations managing multiple frameworks, growing customer requirements and regulatory obligations, this quickly reflects in 4 areas of business impact:

Commercial costs: Lost opportunities, prolonged procurement cycles and increased scrutiny from customers and stakeholders
Operational costs: Duplicated effort across frameworks and audits
Assurance gaps: Limited visibility of control effectiveness, compliance gaps and changing risks between assessments
Hidden costs: Time spent searching for evidence, chasing ownership and connecting information scattered across teams and systems

Having the right security controls in place is essential.

But organisations also need to demonstrate that those controls are operating effectively, responsibilities are clear and requirements are being met.

This is where compliance moves beyond certification and becomes a wider business priority.

What happens when governance is put to the test?

The panel conversation turned to whether traditional governance and compliance approaches are keeping pace with modern cyber threats.

The challenge isn't necessarily the frameworks themselves. It's how organisations put them into practice.

An organisation might have ISO 27001 certification, documented policies and a risk register. But when an incident occurs, can it demonstrate that those controls are working?

Does the business know who owns the response? Are responsibilities and escalation procedures clear? Can teams access the information they need to make decisions quickly?

There's a difference between demonstrating compliance at a point in time and maintaining the visibility and accountability needed to respond when something changes.

Effective governance needs to extend beyond documentation and periodic assessments.

It should support how organisations identify risks, respond to incidents, measure control effectiveness and make improvements across the business.

3 priorities for the next era of cyber security

The conversations throughout the day reinforced that organisations need to look beyond individual technologies, frameworks and audits.

As security threats, AI governance and regulatory expectations continue to evolve, three priorities stand out:

1. Connect security, governance and accountability. Bring risks, controls, evidence and ownership together to maintain a clearer view of security and compliance across the whole business.

2. Make existing work go further. As new frameworks and requirements emerge, build on existing controls and evidence rather than duplicating work with every new obligation.

3. Maintain assurance continuously. Move away from periodic audit preparation towards an approach where compliance posture is visible, measurable and maintained throughout the year.

AI and technology will play an increasingly important role in reducing manual effort and improving visibility. But risk decisions, accountability and oversight must remain with people.

Ultimately, audit-ready should become a state, not a project.

The organisations best prepared for what's next won't necessarily be those doing more compliance work. They'll be those making better use of the governance, controls and evidence they already have.

A huge thank you to QBS Software for bringing together such a valuable range of perspectives, and to the speakers from Huntress, Nord Security and Dropzone AI for sharing their insights.

We look forward to continuing these conversations and working alongside our partners to help organisations build stronger, more connected approaches as they prepare for change.