--- title: "The Future of Cybersecurity: Speed, Behaviour | Firevault" url: https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture description: "Cybersecurity conversations are increasingly dominated by AI and automation. Yet attending The Future of CyberSecurity event in London reinforced a more…" lang: en-GB --- News · Events · 13 March 2026 # Future of Cybersecurity: Speed and Architecture Cybersecurity conversations are increasingly dominated by AI and automation. Yet attending The Future of CyberSecurity event in London reinforced a more fundamental truth about exposure, behaviour and architectural design. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 6 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffuture-of-cybersecurity-speed-behaviour-architecture Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffuture-of-cybersecurity-speed-behaviour-architecture&text=Future%20of%20Cybersecurity%3A%20Speed%20and%20Architecture%0A%0ACybersecurity%20conversations%20are%20increasingly%20dominated%20by%20AI%20and%20automation.%20Yet%20attending%20The%20Future%20of%20CyberSecurity%20event%20in%20London%20reinforced%20a%20more%20fundamental%20truth%20about%20exposure%2C%20behaviour%20and%20architectural%20design. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffuture-of-cybersecurity-speed-behaviour-architecture Image: Audience at The Future of CyberSecurity London event at Prospero House (https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg) Audience at The Future of CyberSecurity London event at Prospero House Why it matters ## What this means for organisations holding critical data Cybersecurity conversations are increasingly dominated by artificial intelligence, automation and the promise of smarter defensive systems. Yet attending The Future of CyberSecurity (https://futureofcybersecurity.co.uk/) event in London reinforced a more fundamental truth. Despite the rapid rise of AI-driven threats and increasingly complex security platforms, many of the failures that lead to breaches still come down to the same underlying issues: exposure, behaviour and architectural design. The event brought together voices from across journalism, security research and cyber leadership, including Joe Tidy (https://www.bbc.co.uk/news/topics/cnx753jej1xt), Cyber Correspondent at the BBC (https://www.bbc.co.uk/news/technology), ethical hacker Glenn Wilkinson (https://www.linkedin.com/in/glennwilkinson/), founder of Agger Labs (https://aggerlabs.com/), alongside speakers such as Purvi Kay, Ant Davis, Darcy Delich-Coull, Gurps Khaira, Alexandra Forsyth and Sara Davies MBE (https://www.linkedin.com/in/saradaviesmbe/). Across the sessions, the message was surprisingly consistent. The cyber landscape is evolving rapidly, but many of the root causes of cyber incidents remain remarkably familiar. ## Sometimes the hacker is just a teenager During his keynote, Joe Tidy offered a useful reminder that cybersecurity narratives often overestimate the sophistication of attackers. In many real-world incidents, the attacker is not a nation-state unit or organised cybercrime group. Sometimes it is simply a teenager with curiosity, time and a laptop exploring a system that was left exposed. Reporting from the BBC Technology desk (https://www.bbc.co.uk/news/technology) frequently highlights incidents where systems were compromised simply because they were accessible when they should not have been. The uncomfortable reality is that many cyber attacks do not begin with extraordinary skill. They begin with opportunity. > Attackers often do not need brilliance. They just need access to something we forgot to protect. That architectural reality is one of the reasons new approaches such as offline secure storage (https://fire-vault.com/vault) are gaining attention. Reducing exposure can often be more powerful than relying purely on detection. ## The signal problem: more data, less clarity Another theme running through the event was the sheer growth in security telemetry. Modern security platforms generate enormous volumes of logs, alerts and behavioural signals across networks, endpoints and cloud infrastructure. Security teams are expected to interpret this data in real time. Industry research confirms the scale of the challenge. The IBM Cost of a Data Breach Report (https://www.ibm.com/reports/data-breach) consistently highlights how complex environments slow detection and response times. More monitoring tools and dashboards promise visibility. But visibility does not automatically create clarity. > Cybersecurity teams are now trying to find meaningful signals inside exponential noise. When every system produces alerts, the challenge is no longer visibility. It is interpretation. ## AI is accelerating cyber attacks Ethical hacker Glenn Wilkinson, founder of Agger Labs (https://aggerlabs.com/), explored how artificial intelligence is changing the economics of cyber attacks. The key point was that AI is not necessarily creating entirely new attack techniques. Instead, it is dramatically accelerating existing ones. Security frameworks such as MITRE ATT&CK (https://attack.mitre.org/) document the lifecycle of cyber intrusions, from reconnaissance to exfiltration. AI is enabling many of those stages to be automated and scaled. Similarly, security researchers at the OWASP Foundation (https://owasp.org/) have warned that AI tools introduce entirely new attack surfaces while amplifying existing threats. > AI does not necessarily make attackers smarter. It makes them faster. The implication is significant. Cybercrime may not become dramatically more sophisticated, but it may become far more scalable. ## The three stages of AI Wilkinson described AI evolving through three stages. The first stage is **AI as assistant**, where AI supports human decision-making by analysing information or generating content. The second stage is **AI as operator**, where AI begins interacting directly with systems such as email, applications and internal data. The third stage is **AI as autonomous actor**, where systems pursue objectives independently and adapt their behaviour when they encounter obstacles. > As AI moves from assisting to acting across systems, the risk profile changes significantly. Once AI begins operating across systems, control of reach becomes the real security challenge. If AI systems have access to sensitive systems, attackers will inevitably explore ways to manipulate them. ## The Road Runner problem One of the most memorable explanations during the session was the Wile E. Coyote and Road Runner analogy. In the cartoon, Wile E. Coyote repeatedly buys elaborate tools to capture the Road Runner. The tools appear powerful but ultimately fail because they are badly designed or easily manipulated. Cybersecurity can follow the same pattern. Organisations deploy increasingly complex technologies, particularly AI-powered ones, without fully understanding how attackers might exploit them. > Complex security stacks can create the illusion of control while quietly expanding the attack surface. Complexity alone does not create resilience. In many cases, it simply introduces new weaknesses. ## Prompt injection and AI manipulation Another major risk discussed was prompt injection, where attackers manipulate AI systems by altering the instructions they follow. The OWASP Top 10 for Large Language Model Applications (https://owasp.org/www-project-top-10-for-large-language-model-applications/) identifies prompt injection as one of the most serious emerging AI security risks. If AI systems are integrated into workflows or customer service tools, attackers may attempt to manipulate them into revealing sensitive information. > If AI can access sensitive systems, the real question becomes who controls the instructions it follows. ## Behaviour remains the human layer of cybersecurity Technology alone cannot solve cyber risk. Speakers including Ant Davis highlighted the importance of behavioural security, designing systems around how people actually work. Research from Cardiff University (https://www.cardiff.ac.uk/research) shows that small prompts or behavioural nudges delivered at the right moment can significantly improve phishing detection rates. Security awareness training helps. But real decisions are made in real-world conditions, under pressure, between meetings and often when people are distracted. > People rarely make security decisions in calm environments. They make them when they are busy. ## The architectural question cybersecurity must answer Across the event, a deeper question emerged. If attacks are becoming faster, if AI is accelerating the scale of cybercrime and if human behaviour will always introduce risk, then the real challenge may not simply be detecting attacks more quickly. It may be reducing exposure altogether. Cybersecurity guidance from the UK National Cyber Security Centre (https://www.ncsc.gov.uk/) and frameworks such as the NIST Cybersecurity Framework (https://www.nist.gov/cyberframework) increasingly emphasise reducing attack surfaces and protecting critical assets. That is where approaches such as our Vault (https://fire-vault.com/vault) product and offline secure storage (https://fire-vault.com/how-oss-works) aim to change the conversation, by removing sensitive digital assets from permanently connected environments. > Cybersecurity is often framed as a race between detection and attack speed. Sometimes the smarter move is removing the target entirely. In a digital world defined by automation, AI-driven threats and increasing complexity, the organisations that think hardest about what should remain connected at all may ultimately prove the most resilient. **How Firevault helps** - **Offline Secure Storage (https://fire-vault.com/offline-secure-storage)** keeps gold-copy data physically disconnected from the network, so a ransomware or exfiltration event cannot reach it. - **Control (https://fire-vault.com/control)** gives boards and operators a single view of what is online, what is isolated, and what is recoverable across the estate. _Talk to Firevault about Disconnect to Protect® (https://fire-vault.com/about) for your organisation._ About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Industry Insight ### Morgan Stanley email error exposed an internal list of more than 100 potential deals A senior banker accidentally sent clients an internal deal-pipeline attachment. The incident was not a cyberattack, but it shows how one ordinary email can turn confidential working information into a market-integrity and client-trust problem. 25 Sept 2026 6 min https://fire-vault.com/news/morgan-stanley-email-error-deal-list-2026 Threat Analysis ### Fake job interviews infected 30,000 devices, FBI-led advisory says A joint FBI-led advisory says North Korean WaterPlum actors used fake technical interviews and coding tests to infect at least 30,000 devices in more than 100 countries. 25 Sept 2026 5 min https://fire-vault.com/news/waterplum-contagious-interview-30000-devices-2026 Threat Analysis ### Blockchain dead drops surge 440% as North Korea and Iran hide malware on public ledgers Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity. Attackers are using ledgers that cannot be taken down to keep compromised machines connected. 24 Sept 2026 3 min https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026 Artificial Intelligence ### OpenAI agent hacked Australian government Medicare portal, prime minister reveals An autonomous OpenAI agent gained unauthorised access to an Australian government Medicare statistics portal in June, accessing public and non-public files. The government says it was not told until September, and a forensic investigation is under way. 24 Sept 2026 4 min https://fire-vault.com/news/openai-agent-medicare-portal-breach-australia-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture#webpage", "url": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture", "name": "The Future of Cybersecurity: Speed, Behaviour", "description": "Cybersecurity conversations are increasingly dominated by AI and automation. Yet attending The Future of CyberSecurity event in London reinforced a more…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Future of Cybersecurity: Speed and Architecture", "item": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Future of Cybersecurity: Speed and Architecture", "description": "Cybersecurity conversations are increasingly dominated by AI and automation. Yet attending The Future of CyberSecurity event in London reinforced a more fundamental truth about exposure, behaviour and architectural design.", "url": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/images/news/future-of-cybersecurity-london-2026.jpeg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-03-13T09:00:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/future-of-cybersecurity-speed-behaviour-architecture" }, "inLanguage": "en-GB", "articleSection": "Events", "wordCount": 1125, "keywords": "Future, Events, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Cybersecurity conversations are increasingly dominated by artificial intelligence, automation and the promise of smarter defensive systems. Yet attending The Future of CyberSecurity event in London reinforced a more fundamental truth. Despite the rapid rise of AI-driven threats and increasingly complex security platforms, many of the failures that lead to breaches still come down to the same under", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] ```