Volume 10 (2026-27)

The Internet is shifting from a human-centric web towards an agentic frontier, with artificial intelligence (AI) agents increasingly integrated into daily life. The transition from instruction-based bots to goal-orientated agents is accelerating, signalling a move from automation to autonomy. According to internal Akamai data, AI bot traffic grew by 300 per cent over the past year, bringing a new kind of Internet traffic characterised by distinct behaviours. As AI agents evolve, existing security defences are proving inadequate; signature-based rules cannot effectively counter reasoning-driven agents. This paper examines the taxonomy of attacks, both AI as a threat and threats targeting AI systems. Whether dealing with aggressive AI inference crawlers such as Bytespider or innovative AI-engineered threats, current security limitations heighten business risks and operational challenges. This necessitates a fundamental evolution, not only of traditional firewalls but also of the security architecture, towards a new, agent-aware defence framework that moves beyond identifying who is accessing resources to understanding the intent and logic of autonomous actors. Semantic firewalls are essential, protecting users and agents at input and output stages while keeping models safe. To enable verifiable autonomy, strategic shifts at the board level are critical, establishing governance frameworks that allow organisations to transition from black-box models to transparent, verifiable glass-box models, paving the way for trustworthy autonomous systems. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: AI agents; agentic frontier; verifiable autonomy; inference crawling; AI as threat; threats to AI

Organisations implementing cyber threat intelligence (CTI) more often than not focus solely on defensive capabilities: detecting threats, preventing breaches, monitoring the dark web. While these outcomes matter and are important, they barely scratch the surface of CTI’s potential value. This paper examines how organisations can transform CTI from a defensive necessity into a strategic advantage, uncovering benefits that extend far beyond threat detection into compliance, talent development, third party risk management, and mergers and acquisition due diligence. Based on real-world examples from implementations in the financial services and flexible workspace sectors, the lessons learnt reveal that CTI’s hidden value often exceeds its primary security benefits. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: cyber threat intelligence; CTI; information risk management; digital risk protection; third party risk management; TPRM; cyber security; strategic business value

The growing accessibility of artificial intelligence (AI) voice synthesis poses significant cyber security and evidential risks, particularly with the rise of hybrid shallowfake audio. This term refers to recordings that merge authentic speech with synthetically generated voice segments. These hybrid manipulations challenge existing forensic audio authentication practices, which have traditionally focused on distinguishing between entirely authentic and fully fabricated recordings. Recent threat assessments, including 2024 findings from INTERPOL, underscore the growing criminal exploitation of synthetic voice technologies and the lack of consistent frameworks to effectively identify hybrid audio manipulations. This situation raises concerns about the continued reliance on legacy forensic methodologies that predate the widespread use of AI speech synthesis tools. This paper explores the procedural and analytical challenges of detecting shallowfake audio through a controlled experimental investigation that mimics realistic manipulation scenarios. Test audio files comprising mixed authentic and synthetic speech were created using affordable, commercially available production tools and examined using established audio authentication techniques. The results reveal that current forensic approaches may not consistently detect hybrid manipulations, especially when recordings are stream-captured or re-recorded after synthetic voice insertion, heightening the risk of evidential misinterpretation. This research identifies significant gaps in standardised forensic protocols and offers practical recommendations for cybercrime professionals. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: shallowfake audio; audio deepfake; mixed authentic and synthetic audio; audio manipulation; audio forensic practitioners; hybrid shallowfake

Traditional cyber threat intelligence (CTI) remains a valuable mechanism for attribution, contextualisation, and strategic awareness; however, its reliance on post-disclosure indicators imposes inherent temporal limitations. As adversaries increasingly exploit pre-disclosure vulnerabilities, legitimate credentials, and cloud-native attack pathways, indicator-driven detection models are frequently unable to provide timely defensive insight. This paper draws from real-world case studies on pre-vulnerability disclosure exploitation, multistage intrusions and nation-state activity to present behavioural intelligence as a complementary and operationally critical detection paradigm, capable of identifying malicious activity through deviations from established system and user behaviour days to weeks before traditional CTI signals emerge. It further addresses a gap in existing research, going beyond detection to interpretability by proposing two practical frameworks for operationalising behavioural intelligence within security operations centre and threat hunting workflows. These frameworks integrate unsupervised and supervised machine learning, graph analytics, and agentic reasoning to correlate low-signal anomalies into high-confidence threat narratives. The findings highlight behavioural intelligence as a necessary evolution of CTI, enabling earlier detection, improved contextual understanding, and more adaptive defence against modern, rapidly evolving adversaries. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: behavioural intelligence; threat detection; vulnerability exploitation; threat intelligence; threat hunting; anomaly detection

The digital infrastructure of UK local government has undergone a seismic shift, evolving from a back-office administrative support function into the primary engine for essential public service delivery. This GovTech transformation, characterised by the ‘digital by default’1 philosophy, has significantly expanded the attack surface of local authorities, rendering them susceptible to a spectrum of sophisticated cyber threats that range from opportunistic ransomware campaigns to targeted state-sponsored espionage.2,3 This paper proposes a holistic approach to understand, define, and specify the cyber intelligence requirements (CIRs) for UK local authorities, which will help to support those councils engaged in the Local Government Reorganisation4 work. This approach tackles identified threats in 20265 by integrating the National Cyber Security Centre Cyber Assessment Framework6 and the Local Authority Cyber Eco-System framework.7 As local authorities increasingly adopt emerging GovTech technologies, such as artificial intelligence and cloud-based services, the requirement for a robust, intelligence-led approach to security becomes paramount.8,9 The fundamental challenge lies not merely in the procurement of defensive technologies but in the precise identification of CIRs and the subsequent development of meaningful, outcome-orientated metrics that align technical performance with organisational mission and public value.10,11 This view has been formed from the author’s observations over the past seven years, working closely with the UK local government community. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: cyber security; local government; LACES; GovTech; information governance; intelligence requirements; practice based; supply chain management

The rapid enterprise adoption of agentic artificial intelligence (AI) has introduced a category of security risk that existing cyber security frameworks were not designed to address. With 78 per cent of Fortune 500 companies projected to deploy agentic AI by 2026 and the global market expected to reach US$89.6bn, the attack surface created by these autonomous workflows demands urgent attention from security practitioners. This paper examines the distinct threat model presented by agentic AI, drawing on recent high-profile incidents, including the weaponisation of a large language model in a state-sponsored espionage campaign affecting 30 organisations and the compromise of an open-source agent framework exposing 30,000 Internet-facing instances, to illustrate the consequences of inadequate controls. Grounded in the Open Worldwide Application Security Project’s Top 10 for Agentic Applications (2026) and the National Institute of Standards and Technology’s ongoing agentic AI security initiative, the paper proposes a five-layer defence-in-depth framework encompassing input validation, identity and least privilege, runtime sandboxing, human-in-the-loop governance, and continuous behavioural monitoring. It identifies sandboxing and least-privilege enforcement as the highest return on investment controls, provides a prioritised implementation roadmap, and discusses the emerging paradigm of cryptographic workflow authentication. The analysis concludes that organisations treating agentic AI security as an extension of traditional application security will find themselves critically exposed and that a purpose-built security architecture is now a business imperative. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: agentic AI; autonomous workflows; defence-in-depth; prompt injection; sandboxing; least privilege

Cyber threat intelligence (CTI) is considered an essential element of a robust cyber security programme. Given the relative nascency of the discipline, however, there is a degree of ambiguity among the community around what it takes to establish a credible CTI capability in support of the cyber security mission. At the same time, there is now a thriving industry offering commercial CTI products and services in support of the customer’s capability development efforts, with many instances of opportunistic vendors poised to exploit this fledgling market. This has spurred the growth of research and advisory companies that attempt to present an objective review and offer guidance around CTI vendor selection. Their perspective, however, is often heavily influenced by a small group of select vendors and the evaluation criteria is often incomplete and skewed towards the participating vendors. This paper makes the case for a first-principles approach that CTI teams can adopt as an unbiased anchor to guide their decisions around establishing an adequate CTI capability, and offers pragmatic recommendations to assist CTI teams with qualifying their prospective vendors to ensure good fit. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: threat intelligence; first principles; adversary; vendor selection; intelligence requirements; intelligence collection; intelligence analysis

Traditional security awareness programmes rely on annual training, phishing simulations, and engagement campaigns. These approaches generate activity and compliance metrics, but they do not effectively reduce human-driven security risk. This paper presents a strategic framework for shifting from campaign-based security awareness to behavioural risk mitigation, grounded in a decade of leading security awareness across one of the USA’s largest and most complex higher education systems. The framework addresses what prompted the shift, what analysis revealed about the limitations of traditional approaches, how buy-in was built to pivot toward behavioural risk mitigation, and what security leaders should consider when implementing similar transformations. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: behavioural risk mitigation; human risk management; security awareness; security culture; SebDB

In today’s evolving digital landscape, a new kind of AI has emerged: agentic artificial intelligence (AI) systems. These are not just tools but intelligent entities that act on their own, make decisions, and carry out tasks proactively. Once placed inside containerised cloud environments such as Kubernetes, however, these powerful agents open the door to a whole new category of security concerns. They often interact on the fly with application programming interfaces, data channels, and other AI agents, sometimes all at once, and not always in predictable ways. Recognising the risks, this paper introduces a formal framework designed to capture and analyse these unique vulnerabilities. Going beyond theory, the study offers a full threat taxonomy focused on agent behaviours, uses temporal logic to trace how agents and environments interact over time, and introduces a practical measure called the Agentic Vulnerability Exposure Metric (AVEM). To put this model to the test, researchers ran simulated cyberattacks on a Kubernetes-based orchestration system that was managing large language model (LLM)-powered agents. The results were eye-opening: AVEM was able to expose security holes such as weak isolation between agents, overlooked permissions, and routes for privilege escalation that had gone undetected before. To test the practicality of the model, real-world attack scenarios are simulated on a Kubernetes-managed AI platform utilising LLM agents. The findings reveal that AVEM effectively uncovers weaknesses such as poorly defined isolation boundaries, unexpected capabilities, and opportunities for privilege escalation between agents. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: generative AI; agentic AI; AI agents; cloud security; threat modelling; attack vectors; containerised environments; cyber security; vulnerability exposure; security framework; formal modelling; Kubernetes; autonomous systems

Systems are becoming increasingly interconnected, forming complex Systems of Systems (SoS) that are difficult to manage and secure. This paper addresses the challenges of governing the security status of such environments, particularly the need to preserve the richness of qualitative risk assessments while enabling scalable, standardised analysis. It proposes a graph-based approach that models risk scenarios quantitatively through the calculation of an ‘interest’ value, enabling prioritisation of countermeasures across large system perimeters. Combined with Boolean representations and event simulation, this framework provides a structured method for synthesising, monitoring and supporting decision-making in the management of large-scale system security. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: risk management; system of systems; rational analysis; operational research; graph theory

The rapid digitisation of critical infrastructure has made traditional fragmented risk assessment practices increasingly challenging to scale. For global industrial leaders managing hundreds of diverse projects, there is a real need for a unified methodology that ensures technical rigour, cross-project reproducibility, and scalability. This paper introduces the Advanced Risk Assessment Methodology for Industrial Systems (ARAMIS), an innovative framework developed through a strategic partnership between Airbus Protect and Alstom. ARAMIS merges the structured, requirement-driven security levels of ISA/IEC 62443 with the scenario-based approach of Expression des Besoins et Identification des Objectifs de Sécurité Risk Manager (EBIOS RM). The paper details the five-module structure of ARAMIS, its unique multilayered modelling of operational scenarios and its algorithmic approach to calculating security levels target (SL-T). Finally, it discusses the implementation of the methodology within the Fence risk management tool to ensure seamless reproducibility and knowledge capitalisation across global project portfolios. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: risk assessment; industrial cyber security; ISA/IEC 62443; EBIOS RM; critical infrastructure; transportation system; security levels; Fence risk assessment tool

Financial services institutions face increasing pressure from regulators, boards, and customers to demonstrate the effectiveness of their cyber security controls. Many organisations, however, operate extensive portfolios of security tools without clear evidence that these investments deliver measurable risk reduction. This paper examines the operational and governance challenges associated with tool sprawl and introduces the concept of ‘security debt’ as the accumulation of unvalidated exposures and misconfigurations. Drawing on practitioner experience and industry research, it argues that the core issue is not the absence of technology but the lack of systematic validation of control effectiveness. The paper proposes a structured four-phase model to streamline cyber security programme performance: baseline, integrate, remediate what matters, and automate and scale. The model emphasises alignment with recognised frameworks, including MITRE ATT&CK, the National Institute of Standards and Technology Cybersecurity Framework, the Center for Internet Security Critical Security Controls, and the Digital Operational Resilience Act, alongside continuous measurement of control performance. By shifting from activity-based to effectiveness-based metrics, organisations can improve visibility, prioritise remediation, and strengthen governance. The paper concludes that a disciplined focus on validation enables financial institutions to reduce exposure, improve returns on existing investments, and provide more meaningful, evidence-based reporting to senior stakeholders. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Keywords: cyber security effectiveness; tool sprawl; security debt; control validation; financial services; operational