About Mark · The Hacker in the Huddle · The CISO Perspective · Explore My Impact · The Cyber Columbo Mentorship Hub Coach Ouch· Cyber Beats· Contact

The CISO Perspective

Clear thinking and responsible leadership in complex risk environments

📍 Latest insight

Gartner Security & Risk Management Summit 2026, London

Executive summary

The 2026 summit theme, "Smarter, Faster, Stronger … Together", reflected a security environment shaped by an expanding threat landscape, rapid AI adoption, tariffs, geopolitical instability and regulatory change. The central message was that security organisations must develop, share and act on insight faster than threats evolve.

Key takeaways: a cyber risk perspective

AI is reshaping cyber risk on both sides. It strengthens defences while expanding the attack surface and compressing attack timelines. Risk assessments should consider both how organisations use AI and how attackers may use it against them. Agentic AI, shadow AI, AI-enabled attacks and non-human identities belong on the risk register, each with a named owner.

Identity is now a critical control point. Attackers increasingly log in rather than break in, while service accounts, machine actors and AI agents are growing faster than many governance models can accommodate. Identity risk needs clear ownership across privileged, machine and agent identities, including access rights, activity monitoring and accountability.

Resilience should be measured alongside prevention. The key questions are how quickly an organisation can recover, which exposures are genuinely exploitable and whether it can show continuously that its controls are effective. Board reporting should focus less on alert and vulnerability volumes and more on exposure, resilience, business impact and decisions required.

Not every emerging trend deserves the same response. Assessing each trend as embrace, monitor or deprioritise helps prioritise investment, and gives the board a clear rationale for both action and inaction. Each decision should have a documented rationale and an accountable owner. Early, proportionate preparation matters too: a cryptographic inventory is a practical first step towards post-quantum readiness.

Human behaviour remains a powerful risk lever. Secure behaviour becomes resilient when it turns into habit, so awareness programmes should be judged by measurable impact rather than completion rates. Shadow AI is largely an insider-risk challenge: well-intentioned employees may enter sensitive information into unapproved tools without malicious intent. Banning it is unlikely to work on its own. Approved tools, clear data-handling rules, guardrails and visibility of usage are a safer approach, alongside targeted, behaviour-based interventions.

AI is both an opportunity and a risk

AI was the dominant topic across the agenda. Security leaders are balancing AI-enabled business opportunities against AI-related risks, while managing geopolitical instability, diverging regulation and an expanding attack surface.

Discussion focused on governing the secure use of AI, defending against AI-generated attacks and integrating AI into security operations. AI is also compressing attack timelines. Attackers are increasingly identity-led, lateral movement remains a particularly dangerous phase, and AI is helping adversaries accelerate reconnaissance, credential misuse and movement through an environment.

Security operations are consequently evolving towards AI agents, exposure management, AI-enabled security operations centres, cyber resilience and platform consolidation. Organisations should treat AI agents and other non-human identities as a distinct risk class, supported by clear ownership, an accurate inventory, defined use cases, appropriate access controls and ongoing monitoring.

Identity is becoming the new perimeter

Identity was a recurring theme, including a dedicated Identity and Access Management track. The growth of machine and agent identities means identity risk now extends well beyond traditional user access management. Identity governance, privileged-access management, least-privilege controls, lifecycle management and behavioural monitoring are better treated as core business and operational controls than as IT hygiene.

Cyber resilience is replacing prevention alone

The summit reflected a continuing shift away from isolated tools and reactive detection towards cyber resilience, exposure reduction, identity-centric security, AI-assisted operations and continuous evidence that controls work.

Continuous Threat Exposure Management prioritises weaknesses that are genuinely exploitable rather than relying on overall vulnerability counts, which helps focus investment on the exposures most likely to affect critical services. The move from point-in-time audits towards continuous assurance means control reporting should show not only that a control exists, but that it operates consistently and reduces risk over time.

Business continuity during cyber disruption was another important theme. Ransomware remains a significant concern, and traditional defensive approaches are no longer sufficient without strong resilience, recovery and response capabilities.

Governance, regulation and geopolitical volatility

Regulatory divergence and geopolitical instability featured prominently, alongside privacy, third-party risk, threat intelligence and cloud security.

Post-quantum readiness was identified as an emerging planning priority. A practical starting point is a cryptographic inventory showing where cryptographic algorithms are used, which systems and suppliers depend on them, which algorithms may become vulnerable and which data has long-term sensitivity. This provides a foundation for prioritising future migration and remediation.

Board communication

Security leaders were encouraged to act as "sense makers", translating complex security developments into clear business implications and decisions. To build board confidence, reporting should connect cyber activity to business resilience, customer and colleague impact, financial and regulatory exposure, strategic priorities and clear risk decisions. Metrics should support decisions rather than simply report activity.

Platform consolidation and vendor scrutiny

Sessions on converged security tools, mesh architectures and technology-provider selection reflected a move away from multiple point products towards platforms aligned to measurable outcomes.

Consolidation can improve integration, visibility and efficiency, but it can also increase concentration risk, vendor dependency and lock-in. These factors belong within third-party risk assessment, including common-mode failure, data portability, supplier resilience, negotiating leverage and the practical ability to exit or replace a critical provider.

1

Looking ahead: the future of AI in cybersecurity (2026 to 2029)

Gartner's research on the future of AI in cybersecurity, led by VP Analyst Jeremy D'Hoinne, describes a shift from reactive AI adoption towards governing autonomous, agentic AI and securing the wider AI surface. While AI accelerates threat detection and operational efficiency, it also expands the enterprise attack surface and identity footprint.

2

Key predictions

Securing AI becomes a major market. Gartner expects spending on securing AI to be the fastest-growing segment, passing endpoint protection as a primary software line item by 2029, with dedicated AI security platforms becoming mainstream by 2028.

Agents drive a surge in non-human identities. A growing share of business decisions will be made semi-autonomously by AI agents by 2028. Traditional identity and access management struggles here, so agents need real-time, context-aware identity governance.

New attack vectors emerge. Risks extend beyond data breaches to operational disruption. One example is cost exhaustion, where attackers exploit public-facing AI interfaces to run up usage costs, making token consumption a meaningful security metric.

Consolidation accelerates. Disconnected point solutions struggle against machine-speed attacks, with duplicate telemetry and slower incident response, pushing organisations towards integrated platforms.

3

Roadmap guidance for security leaders

Short term (2026): inventory and baseline

Map the AI footprint, including shadow AI, custom models, third-party integrations and deployed AI agents.

Establish AI trust, risk and security management guardrails covering prompt injection, model data leakage and risk management.

Begin phasing out siloed products in favour of platforms that share telemetry in real time.

Medium term (2027 to 2028): governance and identity architecture

Extend privileged access management and identity governance to autonomous agents.

Monitor AI cost and API usage anomalies alongside standard intrusion telemetry.

Upskill SOC teams from manual triage towards supervising AI-driven detection and response.

Long term (2029 onwards): autonomous resilience and cryptographic agility

Use semi-autonomous tools to remediate low-level incidents at machine speed, with humans in the loop.

Prepare data architectures for sovereign AI requirements and migration to post-quantum cryptography.

4

Overall conclusion

The message was not simply that security must adopt more technology. It was that security must become more adaptive, evidence-led and connected to business outcomes. The priorities are to govern emerging AI use, treat identity as a fundamental control layer, measure exposure and resilience continuously, prepare early for post-quantum change and make risk decisions easier for executives and the board to understand.

The direction is clear: smarter decisions, faster response and stronger resilience, achieved together.

Mark Adjei

Thought Leadership for a New Era of Cyber Risk

Emerging threats demand clearer thinking. Modern organisations need sharper insight. Leaders require guidance they can trust.

I speak on the issues that shape our sector’s future, bringing clarity to a rapidly shifting landscape.

The security challenges we face today are more interconnected, more dynamic, and more consequential. My work focuses on helping leaders interpret these risks with precision — and respond with confidence.

Speaking Focus: Making the Complex Understandable

Every stage is an opportunity to cut through noise. Every audience deserves clarity. Every conversation is a chance to strengthen collective understanding.

My speaking engagements translate complex risk concepts into practical, actionable insight:

Emerging and evolving cyber threat landscapes

Cyber governance for modern boards

Risk oversight in financial and regulated environments

Operational resilience and crisis readiness

Human factors, culture, and the leadership side of security

Lessons from sport: discipline, strategy, and performance under pressure


Collaboration, Integrity & Shared Understanding

Strong security is never achieved in isolation. It is built through collaboration. It is strengthened through integrity. And it matures when teams share a common understanding of risk.

These principles guide how I engage with organisations and how I contribute to industry-level dialogue. As a CIONET Signatory Panel Member, I help shape perspectives on technology, governance, and risk — ensuring clarity becomes a catalyst for progress.


🔗 Related perspective: The AI risk few are talking about — read my post on LinkedIn →


Education, Outreach & Inclusion

Cyber Security education is a leadership responsibility. It is a commitment to raising collective awareness. It is one of the most effective tools for building long-term resilience.

My outreach work supports governance maturity, strengthens operational readiness, and demystifies risk for decision-makers. I remain committed to developing the next generation of tech professionals — particularly those from underrepresented backgrounds — helping them step into roles where their insight is needed and their leadership can thrive.

Principled Leadership in Practice

Technology alone cannot deliver resilience. People do. Purpose does. Shared commitment does.

A perspective I return to often is:

“The strongest firewalls are built not from code, but from shared purpose, collective expertise, and unwavering commitment.”

This belief shapes how I lead and how I speak: security is not only about protection — it is about empowerment, trust, and creating environments where good decisions are possible.

Where these conversations have taken place



HotTopics Studio Sardinia

Keynote speaker

'What do American Football teams and cybersecurity leaders have in common?

Sardinia

(2026)

LinkedIn

#cybersecurity #leadership #ciso #cyberrisk #cybercolumbo #thehackerinthehuddle #hottopicsstudio #americanfootball #bafa #nfl | Mark Adjei | 13 comments

What do American Football teams and Cybersecurity leaders have in common? More than you would think and it was the heart of the keynote I gave on the final day of HotTopics Studio, Sardinia. Both run on the same skills: clear communication under pressure, fast decisions on incomplete information, and the discipline to execute when the stakes are highest. Whether you are calling a play in the red zone or running a live incident at 2am, the technology is only ever the tool. People are the strate

CIONET

Crisis Management Interactive Workshop

"The Hacker in the Huddle"

(2026)

www.cionet.com

Man Overboard: Human and Digital Anatomy of a Crisis.

Join CIONET for an exclusive VIP evening at the coast, a deep dive into the Human and Digital Anatomy of a Crisis.


Pulse Conferences

Chaired the CISO sessions

6th CISO & 2nd CSO 360 Americas atOne World Trade Center,

New York

(2026)

LinkedIn

#pulseconferences #cybercolumbo | Mark Adjei

Attending the CISO & CSO 360 Americas at One World Trade Center, NY was a masterclass in balancing innovation with resilience. In an era of geopolitical shifts and rapid AI advancement, the ability to bridge the gap between cyber and corporate security is no longer optional, it’s a strategic imperative. The 'side-by-side' format allowed for incredible cross-pollination between disciplines while providing actionable intelligence I could take straight back to my board. A huge thank you to Pulse C

Pulse Conferences

"Enhancing Digital Trust in our Cyber Ecosystems"

New York

(2025)

linkedin

#pulseconference #ciso360 #newyork2025 #pulseconferences #pulse | Mark Adjei | 16 comments

#Pulseconference - Enhancing Digital Trust in our Cyber Ecosystems  Last week, I had the privilege of moderating a distinguished panel discussion with some of the brilliant minds Haydn Brooks, Thomas Gentsch, Oriel Vaturi, Cyrille Vignon and Facu Lopez Juncal in cybersecurity space at the 5th CISO 360 Americas Pulse Conferences Together, we explored critical and forward-looking questions about the industry's evolution. Including: - What Problem Are We Solving? - What Inspired the Creation? -

HotTopics

House of Commons

"Rebuilding Digital Trust in the Age of Deepfakes "

London

(2025)

linkedin

#deepfakes #digitaltrust #cybersecurity #ai #tatacommunications #hottopics #cybercolumbo | Mark Adjei | 14 comments

Last week, at the House of Commons, one question echoed louder than any speech. 𝗛𝗼𝘄 𝗱𝗼 𝘄𝗲 𝗿𝗲𝗯𝘂𝗶𝗹𝗱 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝘁𝗿𝘂𝘀𝘁 𝗶𝗻 𝗮𝗻 𝗮𝗴𝗲 𝘄𝗵𝗲𝗿𝗲 𝗱𝗲𝗲𝗽𝗳𝗮𝗸𝗲𝘀 𝗺𝗮𝗸𝗲 𝘀𝗲𝗲𝗶𝗻𝗴 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗯𝗲𝗹𝗶𝗲𝘃𝗶𝗻𝗴? I was honoured to be part of the conversation. In a world racing toward AI-powered hyperconnectivity, trust is becoming a casualty. The digital trust gap is widening fast, as deepfakes, phishing, and vishing attacks now turbocharged by generative AI and


Pulse Conferences

8th Annual

CISO360

Global Congress -

"Driving Resilience and Trust: Cyber Security Value Creation Tactics and Strategies"

(2024)

linkedin

CISO360: Cybersecurity Value Creation Tactics and Strategies | Mark Adjei posted on the topic | LinkedIn

Reflections on the 8th Annual CISO360 Global Congress 2024 - Driving Resilience and Trust: Cybersecurity Value Creation Tactics and Strategies. As I stepped into the sun-kissed halls of the InterContinental - Hotel Dieu, Marseille, I knew I was about to embark on a journey that would redefine my perspective on cybersecurity. The #CISO360 event, hosted by Pulse Conferences, promised to be more than just another industry gathering—it was an intellectual feast, a melting pot of ideas, and a cataly


Cyber Exchange 360

"Talk to the Board"

The Science Museum,

London

(2024)

LinkedIn

#cybersecurity #board #ceo #cmo #hr #cto | Pulse Conferences

𝙁𝙤𝙪𝙧 𝙢𝙤𝙧𝙚 𝙧𝙚𝙖𝙨𝙤𝙣𝙨 𝙩𝙤 𝙖𝙩𝙩𝙚𝙣𝙙 𝙉𝙀𝙓𝙏 𝙒𝙀𝙀𝙆𝙨 𝙏𝙖𝙡𝙠 𝙏𝙤 𝙏𝙝𝙚 𝘽𝙤𝙖𝙧𝙙! Mark Adjei Director, Cyber Security Risk Advisory & Governance Leader (GCISO) Tim Ward Co-founder and CEO at Think Cyber Security Ltd Harry Sweetman UK&I Public Sector Solutions Lead at Quest Software Simon Mair CISO This program offers a unique, non-security-focused perspective on #cybersecurity, giving participants a rare chance to engage openly and ask the questions they’d ideally pose to

CIONET

Cyber War: Facing Off the Rogue Nations

HMS Belfast

London

(2023)

linkedin

#cionet #cybersecurityefforts #cybersecurity #ciso #cyberwarfare #digitaldefense #cionet #cyberwar #cyber #cyberthreats #cyberawareness #informationsecurity #technologyleadership #cyberrisk… | Mark Ad

Reflecting on the CIONET Cyber War Dinner Event: A Keynote Panellist’s Perspective…….. I recently had the honour of participating as a keynote panellist at the esteemed #CIONET Cyber War dinner event. This gathering was a profound convergence of minds addressing the critical topic of countering cyber threats, especially those posed by rogue nations. My focus was on elucidating strategies from both external and internal vantage points. Being recognised as a signatory CIONET member at this pre







ADINKRAHENE

Adinkrahene sits at the centre.

It reflects leadership as responsibility, not status — the role of bringing alignment, setting direction, and holding steady when others are looking for clarity.

It speaks to presence, judgement, and the discipline to guide movement forward without creating noise or confusion.


In practice

When an organisation is in flux — facing a threat, a leadership transition, or a strategic crossroads — I focus first on restoring clarity of direction. I do not add noise. I help identify what matters, who needs to move, and how to hold the line without creating confusion. Leadership is not about being at the front.

It is about ensuring everyone knows where the front is.




↑ Back to Top







© 2026 Mark Adjei. All rights reserved. Website designed & built by Bloom Studio