e-crime & cybersecurity Mid Year

A realistic MVP of tech and teams Cybersecurity is entering a period of hard trade-offs. Most organisations have become structurally dependent on digital technology faster than they have become structurally capable of securing it. And most organisations will never have enough people, budget or specialist expertise to secure every system, supplier, identity, application and data flow to the level they would like. Nor can they build every capability in-house: cloud security engineering, identity architecture, incident response, threat intelligence, third-party assurance, application security, OT security, Al governance, resilience testing and regulatory evidence production are all competing for limited capacity. The next phase of cyber maturity will therefore depend increasingly on making better decisions under permanent constraint. Security leaders must decide: • What must we own internally? • What can we safely outsource? • What should be automated? • What should be escalated to the board as an accepted business risk? • What must we stop doing because it consumes capacity without materially reducing risk? • How do we prove resilience/security without creating a compliance bureaucracy? • Which suppliers are genuinely part of our resilience model, and which are themselves a source of risk? At the same time as these concrete operational issues around resources and CISO capacity, security teams are also being dragged into the wider problem of European and UK technology dependency­ — a much bigger challenge than patching, tooling and compliance. They are now central to decisions about cloud concentration, Al adoption, supplier resilience, operational continuity, data control and institutional trust. DORA, NIS2, the Cyber Resilience Act and the UK's own cyber resilience agenda are all symptoms of the same shift: governments and regulators no longer regard cyber as a technical risk owned by security teams. They increasingly view it as a systemic resilience issue affecting financial stability, healthcare delivery, energy security, public services and democratic confidence. Add all of this together and it's clear that CISOs and their security teams face an impossible capacity gap. So, what does a practical ASO capacity framework look like? What tooling and teams does it imply? What genuinely matters? What must security own directly and have in­-house? What does a strategic outsourcing strategy look like? How can capacity be freed up through complexity reduction, automation, and third-party tools? And can teams honestly document unresolved capacity gaps to make them formally accepted business risks — rather than silently absorbing impossible expectations? The e-Crime & Cybersecurity Congress Mid-Year Summit is designed around that gap. It will examine how CISOs can prioritise under constraint: what to own, what to outsource, what to automate, what to escalate, what to stop doing, and how to make a credible investment case for the security capabilities on which organisational and national resilience now depend. Key Themes: AI and Quantum Identity, authority, and control for non-human actors CISOs must rethink core identity and governance frameworks, including the adoption of robust agent identity models (spanning machine, service, and workload identities). and clearly defined delegation structures that determine what authority an agent holds and who grants it. What technologies can help them maintain visibility and control? Data protection and leakage risks What does "insider threat" mean when the actor is non-human? For CISOs, the focus shifts to monitoring the behaviour of agents as well as users, developing capabilities to detect anomalous machine activity, and establishing effective controls that balance guardrails, detection, and containment. Do you need Al defences to do that? Al anti-phishing and social engineering defences Al is shifting defence from static filtering to behavioural detection at scale, flagging anomalies that rules/ signatures miss. It can also enable pre-emptive defence against social engineering, identifying manipulation cues. The result is a move from reactive blocking to adaptive defence reducing both successful attacks and analyst workload. Can you help? Who needs to be quantum-ready? Anyone responsible for long-lived sensitive data or critical infrastructure has a quantum problem. That means banks, governments, telecoms, energy, healthcare whose datasets need to last decades. If your encryption protects value over time, you need crypto-agility and a migration path now, not when quantum arrives. How does this work in the real world? Integrity and the Al-enabled supply chain Al-native operating models imply dependence on a complex supply chain of foundation models, internal systems, and external APls and orchestration layers that collectively produce legal work. Imagine the consequences of hacking such a system. So how do CISOs stop that happening? Intelligent Threat Detectio