Part 2: What Is One Piece Of Cybersecurity Advice Every Business Should Follow? Experts Weigh In

Cybersecurity Awareness Month lands at a time when AI fuels both sides of the digital divide, pushing the cybersecurity balance past previous industry projections.

In June, the UK’s NCSC and its Five Eyes partners warned that AI is shortening the time between a weakness being found and being exploited, while lowering the skill needed to carry out attacks.

Phishing remained the most common attack type in the Cyber Security Breaches Survey 2025 to 2026, reported by 38% of businesses, with AI helping less skilled attackers produce more convincing campaigns. Meanwhile, the same report indicates that one-third of domestic businesses engage with AI, but only 24% enforce governance for associated risks.

As national policy pushes the country to become a frontrunner in G7 AI adoption, advanced capabilities flow into workplaces faster than protective measures can be implemented.

 

Switched On First, Secured Later

 

This scenario plays out constantly in early-stage ventures. A productivity tool integrates with corporate email or cloud storage for speed, an outside freelancer joins the workflow without restricted permissions, and questions regarding data access rights take a back seat until vulnerabilities emerge.

Those connections create a second problem alongside faster attacks. An AI tool with access to inboxes, shared files and payment systems becomes a target in its own right, and a hijacked or manipulated assistant can reach everything it has been connected to.

Some large organisations are responding on the governance side, with HSBC appointing its first chief AI officer, but most smaller businesses don’t have a role like that to hand.

We put one question to CISOs, security consultants, technology leaders and founders: what’s the one piece of cybersecurity advice every business should follow this Cybersecurity Awareness Month, and why?

 

 

Our Experts

 

• Michael Adams, Chief Information Security Officer, Docusign
• Ajay Bhardwaj, Managing Director, Orange Cyberdefense UK
• Arsela (Istrefi) Rama, Enterprise Security Team Lead, Sygnia
• Edwin Weijdema, Field CTO EMEA, Strategy and Cybersecurity Lead, Veeam
• Mike Zachman, Chief Security Officer, Zebra Technologies
• Pieter Danhieux, CEO and Co-founder, Secure Code Warrior
• Tobias Ander, Information Security Leader and Founder, Securebyme
• Ravi Soin, CIO and CISO, Smartsheet
• Ram Mohan, Chief Strategy Officer, Identity Digital
• Phil Swain, CISO and VP of Information Security, Extreme Networks
• Sergey Novikov, Director of Cybersecurity Content, CyberProof
• Chris Millington, Senior Global Technical Lead, Cyber Resilience, Hitachi Vantata
• Richard Cassidy, EMEA CISO, Rubrik
• Fiona Boyd, Vice President UK&I Security Consulting Practice Lead, Kyndryl
• Nick Benson, CEO, CREST

 

Michael Adams, Chief Information Security Officer, Docusign

 

 

“AI agents create a new identity governance challenge, the current most underappreciated enterprise risk. Unlike traditional IT services, they can act autonomously across systems and change what they need access to mid-task. Now, governance has to operate at machine speed. Organisations need clear visibility of every non-human identity, its owner, purpose and permissions, alongside least privilege and controls that can respond in real time.

“Identity is now a critical control layer and a growing attack surface, with AI making phishing, deepfakes and social engineering more convincing. Additionally, stolen credentials or session tokens can give attackers access to increasingly automated workflows.

“CISOs must cover themselves. Continuous verification and intent are key. Authentication at the point of entry is no longer enough when agents’ behaviour evolves. Organisations need to monitor whether actions remain consistent with the purpose for which access was granted. It goes beyond an IT security issue. Now, identity increasingly underpins digital trust, operational resilience and business risk, making governance a board-level responsibility. In Europe, the wider direction towards trusted digital identity frameworks reinforces the need for stronger accountability around who – or what – is acting within digital systems. This is what CISOs must be crystal clear on.”

 

Ajay Bhardwaj, Managing Director, Orange Cyberdefense UK

 

 

“Cybersecurity Awareness Month is both a time for reflection and planning. And this year it feels more important than ever to be looking ahead.
“Regulatory developments are underway, altering what it means to be secure and compliant in the UK and internationally. The Cyber Security and Resilience Bill, for instance, will move into the implementation phase any day now, and this raises serious questions about how many businesses are genuinely prepared for stricter compliance.

“At the same time, organisations need to prepare to confront an evolving threat landscape. Whether that’s attacks powered by AI or identity vulnerabilities, attackers are executing threats faster, and at far greater volumes, than traditional modern defences can handle. Preparing for these challenges is no solo effort, and no CISO or IT department can shoulder the burden alone. True defence relies on awareness and alignment across the entire business, from the Board, all the way to the daily habits of every employee.

“This Cybersecurity Awareness Month, I encourage all organisations to commit to a people-centred approach to cybersecurity and empower their workforce to become an active, effective first line of defence.”

 

Arsela (Istrefi) Rama, Enterprise Security Team Lead, Sygnia

 

 

“My advice to founders is simple: before connecting an AI assistant to the business, decide exactly what it should be allowed to read, change and send.

“Start with one tool the team already uses. Open its integration settings, and check which inboxes, folders and business applications it can access. Remove connections it does not need and restrict the rest to the minimum required. An assistant drafting sales emails should not need access to payroll or permission to send messages autonomously (most of the time). Require human approval for consequential actions, such as sending customer communications, changing payment details or deleting records. Enforce these boundaries through application permissions and workflow settings.

“This matters because an attacker can place malicious instructions inside a document or email an AI assistant reads, potentially steering it into unintended actions. The more access and authority it has, the greater the potential damage.

“I would prioritise this over another general awareness reminder because it creates a concrete limit on what an AI agent’s mistake or manipulated response can affect. A small team can start with its most sensitive integration, and expand from there. Assign someone responsibility for that connection, including knowing how to revoke its access quickly if something goes wrong.”

 

Edwin Weijdema, Field CTO EMEA, Strategy and Cybersecurity Lead, Veeam

 

 

“Last Cybersecurity Awareness Month, I argued that we’d moved beyond awareness and that instead organisations needed to focus on preparedness. But in the intervening year, a lot has changed. AI stopped being an abstract tool and became part of organisations’ infrastructure, with non-human identities now outnumbering human employees 109:1.

“But what hasn’t changed? The way organisations measure their security. Too many still rely on outdated snapshot metrics, like compliance status, to reassure themselves of their resilience. But in an environment where overprivileged AI agents are constantly accessing data and acting at machine speed, these metrics are outdated from the very second they are measured.

“This year, I believe organisations need to shift back to awareness, so they can understand just how fundamentally AI has changed the structure of their digital estate. Only then will they be able to redefine how they measure their security and resilience and introduce new, continuously measured metrics. In this agentic era, it’s no longer just about whether you are compliant or protected, but about whether you can prove it, not just at predetermined yearly or quarterly assessments, but at the very second that an agent makes an error.”

 

Mike Zachman, Chief Security Officer, Zebra Technologies

 

 

“The emergence of AI-accelerated and AI agent attack paths means that solutions and devices must be designed for security at every layer and from the silicon up, not as something bolted on at the end. The potential attack surface has expanded beyond traditional IT and cloud environments into frontline operations and connected edge devices in warehouses, hospitals and retail floors. And AI is shrinking response windows from weeks or months to hours.

“It’s the combination of people, process and technology that will keep companies safe. This is why organisations must create cultures where cybersecurity is a team sport with shared accountability. A company’s reputation can be damaged more by a slow or non-transparent response than by the incident itself. Employees should feel safe to quickly admit mistakes without being blamed, flag vulnerabilities and suggest improvements. And employers can reduce the risk of shadow AI by supplying secure, enterprise-grade devices and providing approved, safe AI alternatives to satisfy staff productivity demands.”

 

Pieter Danhieux, CEO and Co-founder, Secure Code Warrior

 

 

“We’re in the midst of a new era of cross-functional AI adoption – AI is no longer confined to the traditional engineering cohort: we’re rapidly seeing non-developer employees building applications with no-code and vibe coding tools, largely contributing to an organisation’s risk profile. If you’re still asking whether employees across departments are using AI (they are), you’re focused on the wrong question. Focus instead on whether they’re using it safely. Organisations must ensure that the proper education, verifiable, hands-on training and resources are available to enable users to mitigate risk as they leverage AI on a daily basis.

“It is equally critical for security leaders to understand what security risks developers themselves are inheriting, and whether those risks vary by model, by framework or by their interaction. It’s widely believed that AI-generated code security risk is random, or at least extremely difficult to trace. However, every AI model has a distinct security fingerprint that can be identified to help organisations understand how AI-generated code behaves, identify where risk is introduced and enable developers to produce more secure code from the outset.

“Now more than ever, security leadership must prioritise following a practical framework to measure, reduce and govern risk while demonstrating progress in securing the Software Development Lifecycle (SDLC) as it transitions to the more relevant Agentic Development Lifecycle (ADLC).”

 

Tobias Ander, Information Security Leader and Founder, Securebyme

 

 

“The one thing I would ask every business to do this Cybersecurity Awareness Month is to find one security rule people regularly work around and ask why.

“A recurring workaround tells you something about the gap between the rule and the way work is actually done. If employees know what is expected but still avoid the approved route, the problem may not be awareness. The tool may be difficult to use, an approval may take too long or pressure to deliver may make the shortcut feel like the practical option.

“This matters particularly in smaller businesses where people often have broad roles and need to make decisions quickly.

“Pick one security requirement that causes problems and talk to the people who use it. If they do not understand the risk, training may be the answer. If they understand the rule but still struggle to follow it in practice, look at what is getting in the way.
“The aim is not to make security optional. It is to make the secure way of working practical enough to use when the business is busy.

“Awareness Month is a good time to check whether people know the rules. It is also a good time to check whether those rules actually work in everyday life.”

 

Ravi Soin, CIO and CISO, Smartsheet

 

 

“If a manager gave a new hire standing access to your customer database, financial systems and half your internal tools – and never reviewed their judgment once – you’d fire that manager. Yet that’s exactly how most organisations are managing AI agents right now, and no one’s being held accountable for it.

“AI agents make thousands of judgment calls a day: what data to pull, what to send where, almost none of it reviewed. The gap isn’t that adoption is moving fast. It’s that we deploy agents like software and expect them to behave like employees, without the system that catches them when they don’t.

“Three failure modes hide in plain sight: scope creep (an agent quietly picks up access nobody approved, one integration at a time), drift (outputs stay technically fine while diverging from intent, unnoticed without a regular check-in) and dead weight (agents outliving the project that justified them, because retiring one isn’t anyone’s job).

“The fix isn’t new tooling. It’s the same discipline security frameworks have championed for decades: defined scope, an auditable record, a scheduled review and a named owner. When something’s off, agents deserve the same process employees get: a formal Performance Improvement Plan (PIP), which would mean a narrowed scope, a remediation window and a decision point before an all-or-nothing shutdown. Termination should be just as procedural: access revoked, credentials killed, the shutdown logged and confirmed.

“None of this is exotic. It’s the same discipline we already apply to people, aimed at a newer kind of worker. The organisations that get ahead of AI risk this year won’t be the ones that adopted the most tools. They’ll be the ones who can name, for every agent running in their environment, exactly who’s managing its performance, and what happens when it isn’t good enough.”

 

Ram Mohan, Chief Strategy Officer, Identity Digital

 

 

“Generative AI has fundamentally changed the economics of online scams. Phishing emails used to be easy to spot. They were full of bad grammar, broken formatting and awkward phrasing. Today, AI generates flawless text in seconds, which means visual polish is no longer an indicator of legitimacy.

“I always tell people to look past how a message appears and check where it actually leads. I call this the three-second domain check. Before you click any link, especially one asking for credentials, personal data or money, stop and look at the actual registered domain name in the address, not just the brand logo or any familiar name that appears earlier in the address.

“That three-second pause is on the user. But it only works because the domain industry itself is building tools to catch typosquatting and lookalikes before most people ever see them. Neither half does the job alone.”

 

Phil Swain, CISO and VP of Information Security, Extreme Networks

 

 

“As AI agents become more common across the enterprise, today’s security teams need to consider more than what those agents can access. Agents communicate with applications, data, devices, other agents and infrastructure, making it critical to have a complete picture of those relationships and what typical behaviour looks like across the organisation’s environment.

“The network is where many of those relationships become visible. Network telemetry can show which systems an agent is interacting with, where traffic is moving and when behaviour begins to deviate from what is expected. An individual action may appear legitimate, while the pattern of interactions around it tells a different story.

“That changes the security question from simply ‘was this agent allowed to do this?’ to ‘does what this agent is doing make sense in the context of everything else happening across the environment?’ As agents operate with greater autonomy, that context will be critical to understanding their behaviour, spotting activity that access controls alone may not reveal and effectively managing risk in today’s enterprise.”

 

Sergey Novikov, Director of Cybersecurity Content, CyberProof

 

 

“As organisations observe Cybersecurity Awareness Month, the focus must shift from spotting obvious malicious activity to a far more complex challenge: the exploitation of trusted access and legitimate devices and applications. Traditionally, security awareness has centred on identifying red flags, such as suspicious links, malicious attachments or weak passwords. These still remain very important, but today’s threat landscape requires a broader perspective, because adversaries no longer need to rely on overtly malicious tools to compromise a network.

“Today, attackers increasingly weaponise the very assets that businesses rely on every day. A compromised employee account, a trusted Windows component or an authorised application can all be used for malicious purposes while appearing perfectly normal on the surface. The same challenge is emerging with AI: as businesses give AI tools and agents access to sensitive data and the ability to take actions, those permissions can become another route for exploitation.

“This evolution means that the foundational question of security awareness is dramatically changing. This is why businesses need to move beyond simply asking, ‘Does this look suspicious?’ and instead critically evaluate, ‘Should I trust this?’. That means monitoring behaviour as well as identities, limiting access to what is genuinely necessary and regularly reviewing what both people and automated systems are allowed to do.

“My advice to every business this Cybersecurity Awareness Month is simple: never assume that something is safe just because it is legitimate or has been authorised. Verify behaviour, not just identity.”

 

Chris Millington, Senior Global Technical Lead, Cyber Resilience, Hitachi Vantata

 

 

“This Cybersecurity Awareness Month, the most useful thing a business can do is understand its data – where it is, how it’s protected and who’s responsible for it.

“Whatever the infrastructure, security should always start with the data. If you know that, along with the risks attached to it, you have a much better chance of keeping the business running.

“As businesses adopt AI, that understanding has to include full visibility of how data is used. How it flows through the model, who accesses it and most importantly, how decisions get made. Nothing can be assumed. We need to understand the risk for every user, device and workload.

“AI can help here too. It can give businesses a clearer picture of these risks and their exposure across their infrastructure, automate the response to an attack and suggest what needs to be done to remove it. The decisions themselves must still be left to people.”

 

Richard Cassidy, EMEA CISO, Rubrik

 

 

“Recent research from Rubrik found that only 28% of IT and security leaders believe they could fully recover from a cyber incident within 12 hours, down from 43% the year before, a fall in confidence arriving precisely when the sector can least afford it. Cybersecurity Awareness Month is the moment to do the unglamorous work: decide which systems the business cannot trade without, agree which of them get restored first and confirm where the clean recovery points actually sit. Mid-crisis decisions are rarely good ones, and having seen enough incident rooms, we know preparation makes all the difference.”

 

Fiona Boyd, Vice President UK&I Security Consulting Practice Lead, Kyndryl

 

 

“The overall theme for this cybersecurity month is ‘don’t make it easy for them’. With the power and adaptability of LLMs and AI agents rapidly scaling, organisations have a steep task to stay ahead of attackers’ growing capabilities. Resilience is no longer about the perimeter or email defence – it’s a multi-layered, multi-domain challenge where parties on both sides of the equation keep raising the bar.

“Our research found that cyberattacks are the top external risk concern, and just 37% of leaders feel ready. So assume disruption will happen and plan for continuous monitoring, automated detection and remediation, tested recovery, asset visibility, patching, identity/access controls and segmentation. Not all businesses can manage this themselves so strategic partnerships are critical to accessing the skills and technologies needed.

“One thing to note is that despite the AI hype, technology alone isn’t enough. Cybersecurity is the top challenge organisations report when executing AI strategy, while governance readiness remains low. Without well-trained and alert people playing their part, risks cannot be well-managed.”

 

Nick Benson, CEO, CREST

 

 

“Organisations and teams across the cybersecurity ecosystem need to actively demonstrate their technical capabilities and professional governance. Those deploying or evaluating AI systems should benchmark their processes against assessable industry standards, publicly commit to principles for responsible use of AI, and seek independent accreditation.

“Adopting independently verified frameworks – both for the safe delivery of AI-enabled services and the rigorous testing of AI systems themselves – is now the only way to provide our communities with genuine confidence and keep pace with ever-evolving risks.

“Policy goals and voluntary commitments alone aren’t enough to protect AI-enabled systems and critical infrastructure. It is a fundamentally technical, complex and constantly evolving field.

“Managing this transition necessitates the implementation of actionable, technical frameworks backed by independent assurance and practical testing to leave no stone unturned.”