15 September Blog

The Future of Human-Centric Cybersecurity
Part 12 of The Cyberplanz Boardroom Guide to Cyber & AI Governance

The future of cybersecurity will be powered by increasingly sophisticated technology.AI will detect threats faster, security platforms will become more automated, systems will identify abnormal behaviour in real time, AI agents will increasingly assist employees and organisations, cyber-attacks will become faster, more personalised and more convincing. And yet, one of the most important cybersecurity capabilities of the future will remain remarkably human:
The ability to make good decisions when something doesn't feel right.
After eleven articles exploring cyber governance, culture, AI, incident response, third-party risk and organisational resilience, this is perhaps the most important conclusion of the Cyberplanz Boardroom Guide:
Technology will continue to change. Human behaviour will continue to matter.
And the organisations that learn to combine the two effectively will have an advantage.
 
Cybersecurity Has Never Really Been Just About TechnologyFor years, cybersecurity has often been framed as an IT problem. Buy better security technology, install another platform, improve the firewall, strengthen authentication, deploy more monitoring and patch faster. All of these things matter; technology remains essential. But organisations are increasingly discovering that technology alone cannot answer some of the most difficult cybersecurity questions:

• Should I trust this email?
• Should I approve this payment?
• Is this really our CEO speaking?
• Should this information be entered into an AI platform?
• Does this supplier really need access to our systems?
• Should I report this mistake?
• Is this AI-generated information reliable enough to make a business decision?
• Should we shut down a critical service?
• When should we tell customers something has happened?

These are not simply technical decisions, they require judgement and judgement sits with people.
 
AI Will Change Both Sides of CybersecurityArtificial Intelligence will fundamentally influence cyber risk. Attackers can use AI to improve phishing, impersonation, social engineering, reconnaissance and automation. The poorly written phishing email filled with spelling mistakes is not the threat model of the future. An attacker may know:

• Who you work with.
• How your CEO communicates.
• What your organisation is currently working on.
• Which suppliers you use.
• Who has authority to approve payments.
• What language and tone will make a request appear credible.

AI can help transform that information into highly convincing attacks at enormous scale. But defenders have AI too. AI can help organisations:

• Detect unusual behaviour.
• Analyse security information.
• Identify emerging threats.
• Automate repetitive security tasks.
• Prioritise vulnerabilities.
• Investigate incidents.
• Improve fraud detection.
• Support security teams making complex decisions.

The future therefore isn't:
Humans versus AI, it is increasingly Humans working with AI versus humans using AI against them. That makes the quality of the human-machine relationship increasingly important.
 
The Human Firewall Is No Longer EnoughThroughout this series, we have challenged the traditional idea of employees as the organisation's “human firewall.” The metaphor sounds positive, but firewalls are passive barriers. People are not, people learn, they question, they collaborate, they recognise context, they notice unusual behaviour, they adapt, they innovate and they make judgement calls technology may struggle to understand.
This is why we prefer the concept of the:
Human Advantage
The objective should not simply be to stop employees making mistakes. It should be to create an organisation where people actively contribute to resilience.
Employees should feel confident saying:

• “This doesn't look right.”
• “I think I may have made a mistake.”
• “I don't understand why this system needs access to that information.”
• “This AI output doesn't make sense.”
• “This supplier request seems unusual.”
• “Can someone check this before I proceed?”

Those sentences may become some of the most valuable security controls an organisation has.
 
Trust Will Become a Security CapabilityThis creates an important challenge for leadership. You can buy technology. You cannot simply buy trust. Trust is created through organisational behaviour.
If an employee believes reporting a mistake will lead to embarrassment or punishment, they may hesitate. If employees believe management doesn't want to hear bad news, concerns may remain hidden. If people believe cybersecurity is solely IT's responsibility, they may assume someone else will deal with it. And if employees are frightened to admit they have used an unapproved AI tool, Shadow AI becomes harder to identify.
That is why Just Culture matters.
People should be accountable for deliberate or reckless behaviour. But honest mistakes should become opportunities for early intervention and organisational learning.
The question is not:
“Who made the mistake?”
The first question should be:
“How quickly did we know about it?”
 
Speed of Reporting May Matter More Than PerfectionNo organisation will prevent every mistake, no security platform will detect every threat, no employee will make the correct decision every time. That makes speed of reporting an increasingly important resilience measure. This is the thinking behind the Cyberplanz Five-Minute Rule:
The most important five minutes in any cyber incident are the five minutes after someone realises something might be wrong.
If something feels wrong:

• Report it.
• Don't hide it.
• Don't wait for certainty.
• Don't spend thirty minutes trying to determine whether it is serious enough.
• Early reporting creates options.
• Delay removes them.

The resilient organisation of the future will therefore not necessarily be the organisation where nobody makes mistakes. It may be the organisation where mistakes become visible fastest.
 
Cyber Culture Will Become MeasurableFor too long, organisations have measured cybersecurity culture using convenient numbers; training completion, phishing simulation failure rates and policy acknowledgements. These metrics have value, but they do not necessarily tell a Board how people will behave during a real incident.
Future Boards should increasingly ask:

• Are employees comfortable reporting mistakes?
• How quickly are concerns reported?
• Are near misses increasing because visibility is improving?
• Are managers modelling the right behaviours?
• Do employees understand AI boundaries?
• Are Cyber Champions identifying emerging issues?
• Are people asking more security questions?
• Are lessons from incidents actually changing behaviour?

This is why Boards need to move from simply measuring compliance to understanding culture. As we've said throughout this series:
Compliance tells you what the organisation has done. Culture tells you what your people will do.
And Boards should not just report the colour - Report the direction.
 
Cybersecurity Will Become More DistributedAnother important change is already happening, cybersecurity responsibility is moving beyond the security team:

• HR influences culture.
• Finance manages fraud and payment controls.
• Procurement influences supplier risk.
• Legal manages contractual and regulatory exposure.
• Marketing handles customer information and AI-generated content.
• Operations manages critical processes.
• Executives set expectations.
• Boards determine risk appetite and accountability.
• Employees make thousands of everyday decisions.

This is why Cyber Champions can become increasingly valuable. Not because every department needs another cybersecurity expert, but because every department benefits from someone who understands its particular risks and can connect cybersecurity with how work actually gets done.
The future of cybersecurity is therefore not simply about building bigger security teams, it is about building more security-capable organisations.
 
AI Governance Will Become Everyday GovernanceToday, many organisations still treat AI governance as a separate emerging issue. That distinction may not last, AI is increasingly being embedded into:

• Finance.
• Customer service.
• Software.
• Marketing.
• HR.
• Cybersecurity.
• Legal services.
• Analytics.
• Productivity tools.
• Decision-making.

Eventually, asking whether an organisation has an “AI strategy” may sound similar to asking whether it has an “internet strategy.” AI will simply become part of how organisations operate and AI governance will increasingly become part of normal business governance. Boards will need to understand:

• Where AI is being used.
• What value it creates.
• What information it accesses.
• Where human oversight is required.
• What AI suppliers are doing.
• Where Shadow AI exists.
• How AI decisions are validated.
• And what happens when AI gets something wrong.

The objective should not be to eliminate AI risk. It should be:
Maximum responsible value within an acceptable level of risk.
Or more simply: Govern at the speed of innovation.
 
Your Security Perimeter Is Becoming an EcosystemThe traditional security perimeter is also disappearing. Your organisation depends on:

• Cloud providers.
• Software vendors.
• Managed service providers.
• Payment systems.
• Telecommunications companies.
• AI platforms.
• Consultants.
• Supply chains.
• Data processors.

And those suppliers depend on other suppliers. Cyber resilience therefore increasingly becomes ecosystem resilience. A business can have excellent internal security and still be disrupted because a critical third party fails. Boards need to understand not only: “Is this supplier secure?” But: “What happens to us if this supplier fails?”
That distinction between supplier risk and dependency risk will become increasingly important, because: You can outsource the service. You cannot outsource accountability for the risk.
 
The Board's Cybersecurity Role Will Continue to EvolveBoards do not need to become cybersecurity experts. They do need to become better governors of digital risk. That means moving beyond questions such as:
“Have we been hacked?” or: “Are we compliant?” towards questions such as:

• “How resilient are we?”
• “What are our critical dependencies?”
• “What evidence tells us our culture is improving?”
• “Where are we using AI?”
• “What risks are increasing?”
• “What happens if a critical service becomes unavailable tomorrow?”
• “How quickly would our people report something suspicious?”
• “What decisions would the Board need to make during an incident?”

The Board's job is not to run cybersecurity, its job is to ensure cybersecurity, AI and digital risk are being governed in a way that supports the organisation's strategy and resilience.
 
The Future CISO May Look Different TooThe role of security leadership is changing, technical expertise will remain important, but tomorrow's most effective security leaders may increasingly need to understand:

• Business strategy.
• Human behaviour.
• Culture.
• Communication.
• Risk.
• AI.
• Governance.
• Organisational change.
• Crisis leadership.
• Board communication.

A CISO who can explain a technical vulnerability is valuable, a CISO who can explain what that vulnerability means to the business, what decision needs to be made and why the Board should care may be even more valuable. The future security leader becomes a translator between:

• Technology and business.
• Risk and opportunity.
• Security and innovation.
• Machines and people.

 
Resilience Will Become the OutcomePerhaps the biggest shift is the simplest, cybersecurity should not ultimately be measured by how many attacks an organisation stops. The strategic question is:

• Can the organisation continue to operate when something goes wrong?
• Can people make decisions?
• Can customers still be served?
• Can critical services continue?
• Can the organisation communicate?
• Can leadership maintain trust?
• Can teams recover?
• Can the organisation learn?

That is resilience and resilience brings together everything we have explored throughout this series:

• Governance.
• Leadership.
• Culture.
• Cyber Champions.
• Just Culture.
• Human Advantage.
• Third-party risk.
• AI governance.
• Incident preparedness.
• Board oversight.
• Continuous learning.

Technology supports all of them, people connect them.
 
From Cybersecurity Awareness to Organisational CapabilityThe organisations that thrive in the next decade may stop thinking about employees as people who need to be periodically “made aware” of cybersecurity, instead, they will build cybersecurity into organisational capability.

• Employees will understand the risks relevant to their work.
• Managers will know how to respond when concerns are raised.
• Cyber Champions will connect security with departments.
• Executives will model expected behaviours.
• Boards will ask better questions.
• AI will augment human capability.
• Technology will provide visibility and protection.
• And mistakes and near misses will create learning.

This is a much bigger ambition than cybersecurity awareness. It is organisational resilience by design.
 
The Future Is Human + TechnologyThere is a tendency when discussing the future to focus on what technology will replace, perhaps we should spend more time asking what technology will make more important.

• AI can process information.
• Humans provide context.
• AI can identify patterns.
• Humans exercise judgement.
• AI can automate actions.
• Humans determine accountability.
• Technology can detect threats.
• Humans create trust.
• Technology can protect systems.
• People protect organisations.

The strongest organisations of the future will not choose between human capability and technology, they will deliberately design the relationship between them.
 
Twelve Articles. One Question.Throughout this series we have discussed many different aspects of Cyber & AI Governance, but ultimately, they all lead back to one question:
Is our organisation becoming more resilient?
Not simply more compliant, better protected, nor equipped with more technology, but more capable of anticipating disruption, making good decisions, responding quickly, maintaining trust, recovering effectively and learning continuously.
That is the real objective.
 
The Boardroom Questions for the FutureAt your next Board meeting, consider asking:
1. Are we treating cybersecurity as a technology problem or a business resilience issue?
2. Do our people feel safe reporting mistakes and concerns?
3. How quickly would we know if something had gone wrong?
4. Are we measuring cyber culture or simply compliance?
5. Are we developing our Human Advantage alongside our technology?
6. Do we understand where AI is actually being used?
7. Is our AI governance enabling responsible innovation?
8. Which suppliers could materially disrupt our organisation if they failed?
9. Have we practised how we would lead through a serious cyber incident?
10. What evidence tells us our cyber resilience is improving?
And perhaps the most important question:
Are our people, our governance and our technology becoming stronger together?
 
The Future of Human-Centric Cybersecurity

• Cybersecurity will continue to evolve.
• AI will become more powerful.
• Attacks will become more sophisticated.
• Technology will become increasingly autonomous.
• New risks will emerge that we cannot yet predict.
• Organisations will respond with new platforms, new controls and new forms of automation.

But technology alone will never create a resilient organisation, resilience requires people who are willing to speak up. Leaders who listen, boards that ask good questions, cultures that learn, governance that creates clarity, technology that enables rather than replaces human capability and organisations prepared to adapt when the environment changes. That is the future of human-centric cybersecurity.
Not human versus technology.
Not technology replacing people.
But:
Human judgement + Technology capability + Strong governance = Organisational resilience.
And that brings us back to the principle at the heart of the entire Cyberplanz Boardroom Guide: Cyber resilience isn't built by technology. It's built by leadership, enabled by governance, and delivered by people.
 
CYBERPLANZ | THE BOARDROOM GUIDE TO CYBER & AI GOVERNANCEBuilding the Human Advantage in an increasingly AI-enabled world.
Helping Boards build secure, resilient and AI-ready organisations.