Octavian Tanase
Chief Product Officer, Hitachi Vantara
Over the last year, cyber risks have increased as AI capabilities have become more sophisticated, giving threat actors new ways to identify vulnerabilities faster and launch attacks on a broader scale. At the same time, data governance is taking on greater importance amid sovereignty concerns and international regulations like DORA, NIS2 or GDPR. Protecting that data and ensuring it remains available and recoverable needs to be the top priority for any board or leadership team. This requires organisations to think beyond prevention and prepare for how they will maintain business continuity and recover trusted data when an attack occurs.
Cyber resilience starts with a strong data foundation and clear governance, and it needs to be built into your data infrastructure from the start. If critical data is compromised, organisations need to know they can recover trusted data quickly and keep the business running. Planning for that recovery in advance is critical to maintaining business continuity and customer trust.
Building cyber resilience into infrastructure means giving organisations multiple layers of protection, detection and recovery, from immutable data snapshots and anomaly detection to automated recovery processes and air-gapped environments. The goal is not simply to withstand an attack, but to be ready to restore trusted data and operations as quickly as possible when disruption occurs.
Chris Millington
Global Solutions Lead, Data and Cyber Resilience, Hitachi Vantara
AI has accelerated the speed at which attackers can operate. Although this isn’t necessarily new, organisations can use AI themselves to better understand these risks and their exposure across their infrastructure, while helping to shape a new security and governance approach. For example, it can help automate a response against a malicious attack and then suggest what needs to be done to eradicate it. However, the decision-making process must still be left to humans.”
Security isn’t always about infrastructure, but it should always be about the data. If you know where your data is, the level of protection it has, who is responsible for it and the risks associated with it, your chances of successfully maintaining business continuity are much greater.”
Pieter Danhieux
Co-Founder and CEO, Secure Code Warrior
We cannot bridge an AI security and literacy gap through passive governance policies or automated scanning alone. In a new, pervasive workflow where AI agents generate code, review pull requests, and trigger deployments, securing what the AI misses becomes the chief focus for every human across the organisation.
At the same time, we need to get comfortable, very quickly, with the fact that the enterprise attack surface has fundamentally expanded forever, because the definition of who actually ‘commits code’ has changed. With the rise of generative LLMs, low-code/no-code platforms, and agentic assistants, software creation is no longer restricted to the time-honoured engineering departments of old. Today, business users across finance, HR, marketing, and operations (our ‘citizen developers’) are building custom workflows, integrating APIs, and deploying applications directly into fundamental business functions.
If organisations want to maintain control over the attack surface, all staff who generate or commit code with AI, from seasoned software engineers to business citizen developers, must possess verifiable security skills, both in the context of their roles and within the tools they are using. Organisations must equip every employee with the practical judgment needed to audit AI outputs, manage credentials safely, and identify security flaws before code reaches production.
That is why this Cyber Security Awareness Month, we encourage security leaders to move beyond static awareness and build real, verified defence capabilities across their workforce.
Kevin Charest
CISO & VP of Cyber Governance Services, Netrio
Mid-market organisations face the same security threats as large global enterprises, but they do so with a fraction of the resources. What I see repeatedly is understaffed IT teams trying to stitch together fragmented tools, leading to a reactive posture instead of a resilient one. Mid-market IT leaders need to focus on three fundamentals: clear visibility across their environment, outcome-driven security aligned to regulatory requirements, and a realistic plan to address ‘unpatchable’ technical debt through compensating controls. Cyber security can’t be treated as a luxury line item anymore; it determines how quickly you can withstand and recover from attacks in order to protect your day-to-day operations. It must be a top priority for businesses of any size.
Matthew Lowe
Regional Director – Pacific, Anomali
AI is moving from advising humans to acting on their behalf, and that raises a question every Board member and C-suite leader is facing today: what do we allow machines to decide?
Cyber security leaders want autonomous threat hunting that keeps working while their teams sleep, and policy-driven decisions that run in real time across their systems. But most organisations struggle with the fidelity of their data, and if you can’t trust your data, you can’t trust the decisions AI agents make on your behalf. You end up with confident but bad decisions, and in cybersecurity, that risk is untenable.
As reliance on AI-driven alerts grows, accuracy becomes the discipline every security leader has to own. Autonomy earns trust one governed decision at a time, with human approval and audit where it matters.
This Cyber Security Awareness Month, the lesson is clear: the near-term future of AI will be judged by whether we can stand behind every decision it makes.
Hayley Fisher
Managing Director, Adyen Australia and New Zealand
Customers shouldn’t have to choose between security and convenience when they pay online. But for businesses, preventing payment fraud without creating unnecessary friction for genuine customers is becoming harder.
Nearly nine in ten merchants say they have been targeted by or experienced payment fraud in the past year. Businesses need strong defences, but applying the same level of scrutiny to every transaction risks turning security into another barrier at checkout.
The answer lies in recognising that not every customer or transaction carries the same level of risk. Signals across the payment journey can reveal the difference between trusted customers and unusual activity, giving businesses a clearer basis for deciding when extra authentication is warranted.
A low-risk transaction can move through checkout with minimal intervention, while unusual activity can trigger stronger verification. Getting those decisions right also supports conversion, helping genuine customers complete their purchases without unnecessary interruptions.
Cyber Security Awareness Month is a timely reminder that effective security depends on making informed decisions about when to intervene, protecting customers while keeping the payment experience seamless.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
