Cyber Heard

Bruno Bossola explains why dependency and supply chain risk keeps slipping past security teams, and why the fix is rarely another scanner but a proper process across the whole development lifecycle. He also sets out why AI coding assistants are quietly reintroducing vulnerable libraries at scale.

Joe Hubback explains why cyber risk quantification only really works when it's built around reasonable worst case scenarios, why third party and OT risk are often more about people than technology, and why he believes the industry's biggest blind spot is behaviour, not tooling.

Thomas Owen explains why he sees almost all security failures as access control failures rooted in human identity, and how measurable, causal testing can actually shift intrinsic staff behaviour rather than just producing a click rate on a dashboard. He also sets out where AI has changed the economics of phishing and deepfakes, and where he draws the line between protecting staff and quietly surveilling them.

A field CSO who built SOC teams from the ground up explains why board risk numbers are more storytelling than maths, why supplier questionnaires are mostly theatre, and why the weakest link line about users is wrong.

A veteran penetration tester explains why legacy technology, rigid procurement cycles and marketing-driven security purchases leave ships, planes and industrial control systems exposed, and gives a grounded assessment of how much AI is really changing offensive security today.

A practical look at how small agencies can protect themselves against phishing and social engineering, why identity and MFA now matter more than network boundaries, and how to bring AI into a business without losing control of governance and data.

Chris Jefferson explains why AI systems fail by design rather than by accident, where language models and vision systems break under attack, and why some of these weaknesses have no real defence. He also covers the practical risks of data leakage, AI generated code, and handing tasks to autonomous agents.

A practical look at treating unattended bots as machine identities with their own attack surface, why supply chain hits like JLR change how automation vendors get access to client infrastructure, and where AI-assisted coding and zero trust claims fall short in real deployments.

A look at what it actually takes to secure NHS trusts, from managing risk on medical devices that can't simply be patched to translating cyber threats into patient safety and financial terms a hospital board will act on. Covers supplier assurance, staff retention against private sector pay, and why the NHS is far less standardised than most people assume.

A look inside the signalling layer of mobile networks, the control plane attackers exploit while most cyber teams focus elsewhere, covering SS7 and Diameter weaknesses, why 5G security depends on the older generations it still connects to, and where accountability really sits for SIM swap fraud.