Overview
For years, cyber security professionals have warned that the world was becoming irreversibly digital. I think it is fair to say that future has arrived.
There are now very few businesses, services or everyday activities that do not depend in some way on data, connected technology or digital infrastructure.
The scale of that dependency is reflected in the threat. The UK Government’s latest Cyber Security Breaches Survey found that 43% of UK businesses had identified a cyber attack or breach in the previous 12 months, equivalent to around 612,000 businesses. AI is accelerating that landscape further, enabling increasingly convincing social engineering and faster reconnaissance and targeting.
For organisations like Amey, which operates across transport, defence and public services, that creates a particular responsibility. We rely heavily on data and digital capability to deliver services that communities depend on, so the impact of an incident can extend far beyond a compromised laptop or stolen information. The question we should be asking is no longer whether organisations will encounter cyber threats, but whether they are resilient enough to keep operating when they do.
The biggest challenge is not technology. It’s people
People often ask me what the hardest part of my job is, and I suspect they expect me to name a particular technology, threat or increasingly sophisticated form of attack. My answer is much simpler: people.
That might sound counterintuitive, but people are paramount to effective cyber security. Criminals know this too. They exploit urgency, familiarity and trust because persuading someone to circumvent the process can be easier than defeating the technology protecting it.
That is why the answer cannot simply be adding more controls. We have to develop a culture in which people understand risk well enough to navigate it confidently. There is little value in making colleagues so frightened of cyber threats that they stop engaging with technology altogether. I often see how training and awareness campaigns increase awareness but decrease colleagues’ ability to operate independently. For me, I often see that as cyber training is rolled out it results in an increase in colleagues becoming more paranoid about clicking on links and therefore an increase in requests to have IT colleagues check the email first. Similarly, if initially surveyed on Cyber response plans or early Business Continuity Plans the reply is often “If a cyber event occurs, then we’ll call Steve!”, if the BCP even includes cyber.
The aim must be informed confidence. In the same way that we expect colleagues to recognise a physical safety hazard, we should equip them to recognise unusual digital behaviour, question unexpected requests and know when, but most importantly how, to escalate concerns.
That approach also has to start at the top. It does not take much these days to persuade an executive team that cyber security deserves serious attention, but genuine sponsorship still matters enormously. I am reassured that at Amey, our leadership is actively engaged. We have signed the Cyber Pledge, placing cyber security risk firmly on the Board agenda, with commitments around regular Board cyber training, briefings, ownership of risk and strategy, recognised cyber frameworks, early-warning intelligence and supply-chain assurance. At Amey, we have gone above this requirement and extended this training to our Executive Committee and Senior Leadership.
Technology may provide the controls, but creating a resilient organisation requires leadership, management ownership and an informed workforce working together.
He did not know he was the only human in the room
If there is one technology that has brought cyber security firmly into mainstream conversation, it is artificial intelligence (AI). The stories are compelling and, occasionally, astonishing.
One widely reported case involved a finance employee at another organisation joining what appeared to be a legitimate video meeting with colleagues. He later discovered that he had been the only real person on the call, with the other participants digitally recreated as part of the deception.
We should take examples like this seriously. AI makes impersonation increasingly convincing, while voice cloning, deepfakes and generated content are challenging some of the cues we have traditionally relied upon to establish whether somebody is who they say they are. Current cyber research also shows AI being used across the attack lifecycle to accelerate familiar techniques.
However, this is where my view sometimes differs from the popular narrative. When people ask whether AI has made cyber security harder, my answer is not necessarily.
Attackers have access to AI, but so do we. Cyber security teams are using it to identify threats faster, analyse vulnerabilities, manage large volumes of security alerts and focus human expertise on the issues requiring the greatest attention. Industry research similarly describes AI as an enabler for cyber criminals while noting that defenders are benefiting from the same technology.
I therefore see it as something of a level playing field. The fundamental asymmetry of cyber security remains: the attacker may only need to be successful once, whereas defenders need to protect an organisation continuously. AI has not created that challenge. It has accelerated the speed at which both sides can operate.
AI literacy is consequently becoming as important as AI capability. At Amey, we are developing understanding of the technology through initiatives including our Innovation Lab, helping colleagues explore AI and agentic AI and consider where they can support the way we work.
There is another question that I think organisations need to consider as their reliance on AI and cloud technology grows: who controls the kill switch? Increasing dependence on external technology providers creates questions around sovereignty, control and continuity. If access to a critical service can be restricted by a supplier, government or an outage beyond your control, organisations need to understand what that means for their resilience.
For me, the important question is not whether we should use these technologies, but whether we understand our dependencies well enough to manage the risk. If a critical platform suddenly becomes unavailable, can the organisation continue operating? If the answer is no, are we comfortable with that exposure, and do we have a continuity plan for when the cloud breaks?
The same nuance is needed when we talk about jobs. I was asked whether AI would replace cyber security professionals and joked that I thought it had already started. There will undoubtedly be tasks that disappear or become automated, just as previous waves of automation have changed other industries. However, I expect AI to reshape cyber roles more than it removes the need for them. Reducing repetitive analysis and administration should create more space for people to apply judgement, investigate complex threats, make decisions and manage risk.
AI is neither the villain nor the saviour of this story. It is an extraordinarily powerful capability, and our responsibility is to make sure we understand it well enough to use it to our advantage.
“The strongest cyber security strategy is not one that assumes nothing will ever go wrong. It is one that knows exactly what to do when it does.”
What would you do if every laptop and phone stopped working tomorrow?
One of the most common mistakes I see in cyber security is an excessive focus on prevention. Organisations invest considerable time and money in stopping attackers from getting in, but often spend less time asking the more uncomfortable question: what happens if they succeed?
Prevention is paramount, but no responsible cyber security professional can promise that every attack will be stopped. I have dealt with incidents where the response mattered just as much as the controls in place beforehand. When something goes wrong, decisions must be made quickly, often with incomplete information and significant operational pressure. Criminals exploit that urgency because hurried people are more likely to step outside normal processes.
That experience has reinforced something for me: resilience is built long before an incident occurs. Organisations need to know who will make decisions, how they will communicate, which services must be restored first and what they will do if the technology they depend on suddenly becomes unavailable.
At Amey, we test our business continuity arrangements against different disruption scenarios. One exercise removed access to the technology colleagues would normally depend upon, meaning no corporate laptops and no corporate phones.
Exercises like this expose assumptions remarkably quickly. The instinct can be to challenge the scenario and argue that such an extensive outage would never happen. My advice is simple: do not fight the exercise. Accept the situation and work out what you would do next.
That means asking difficult questions before a crisis: how would teams communicate, which services would need to be restored first, which suppliers would we depend upon and what capabilities are essential to keeping the business operating?
I encourage organisations to develop a clear incident playbook and, crucially, to exercise it. A document sitting untouched on a system is not enough. When criminals deliberately create urgency, confusion and pressure, a well-rehearsed playbook gives people a clear framework for making decisions and the confidence to follow established processes.
Cyber resilience is not a product we can buy or a project we can complete. Threats evolve, technology ages, suppliers change and new dependencies emerge, so resilience must be continually tested, challenged and improved.
For infrastructure providers, that discipline is fundamental. We rely heavily on data and technology, but ultimately our responsibility is to the people and communities who depend on the services those systems enable.
The strongest cyber security strategy is not one that assumes nothing will ever go wrong. It is one that knows exactly what to do when it does.
That, for me, is why cyber resilience has become the invisible foundation of modern infrastructure.