Cybersecurity is shifting from a narrow focus on preventing attacks towards a wider test of operational resilience. Organisations are being asked to prove that they can detect disruption, make decisions under pressure, recover essential services and manage security across increasingly complex supplier ecosystems.
This edition of the Cybersecurity Roundup examines the metrics that reveal whether a business is genuinely resilient, Singapore’s warning about AI-enabled attacks, the suspension of new US defence cybersecurity rules, ENISA’s proposed certification scheme, AI’s role in secure software development and DigitalXForce’s industry recognition.
Cyber resilience must be measured through business outcomes
Organisations have no shortage of cybersecurity statistics. They can count vulnerabilities, alerts, patches, completed audits and employees who have finished security-awareness training. But those figures do not necessarily show whether a company can continue operating during a serious incident.
The World Economic Forum’s guidance on cyber-resilience metrics argues that businesses should measure their ability to detect, absorb, contain and recover from disruption. The focus should move from security activity to operational outcomes.
A useful starting point is defining the organisation’s “minimum viable business”: the services and capabilities that must remain available—or be restored first—when normal operations are no longer possible.
From there, leadership teams should measure factors including:
- Time required to detect an incident.
- Time needed to make critical recovery decisions.
- Speed of containment and service restoration.
- Maximum tolerable downtime for essential services.
- Availability of manual workarounds.
- Customer, financial and regulatory impact.
- Supplier recovery capabilities.
- Effectiveness of crisis communications.
The Forum describes resilient organisations as those capable of “shrinking the V”: reducing both the depth and duration of the operational decline caused by an attack.
Realistic exercises are essential. According to the Forum, 44% of highly resilient organisations conduct cyber simulations or recovery exercises with ecosystem partners, compared with only 16% of insufficiently resilient organisations.
This reinforces the importance of treating cyber resilience as a corporate-governance responsibility. Similar board-level accountability has been emphasised in previous guidance covered by HIPTHER, including the Reserve Bank of India’s recommendations for stronger cybersecurity and IT governance.
Security programmes should ultimately demonstrate that investment is reducing potential business damage—not merely increasing the number of tools and controls.
Singapore warns that AI will accelerate cyberattacks
Artificial intelligence could dramatically reduce the time and expertise required to construct sophisticated cyberattacks, according to David Koh, the founding chief executive of the Cyber Security Agency of Singapore.
In an interview with Channel NewsAsia, Koh warned that defenders will not be able to continue operating in the same way as AI changes the speed, scale and economics of cybercrime.
Many attacks currently depend on a limited group of specialists who manually identify vulnerabilities and combine them into an effective attack chain. AI could automate significant parts of this process, reducing development times from weeks or days to hours or minutes.
This could also undermine “security through obscurity.” Older, specialised or proprietary operational technology has sometimes attracted less attention because attacking it requires substantial research for a limited number of targets. AI may make it economically viable to analyse and attack these less common systems, including those used in power plants, transport networks and other critical infrastructure.
The defensive implications are significant. A two- or three-week patching cycle may become inadequate if attackers can weaponise a newly discovered vulnerability within hours. Annual audits will also provide limited protection against threats that continuously adapt.
Organisations may consequently need:
- Continuous monitoring instead of periodic assessments.
- Faster vulnerability triage and patch deployment.
- AI-assisted threat detection and response.
- Greater visibility into operational technology.
- Board-level accountability for critical systems.
- Faster mechanisms for sharing threat intelligence.
The warnings support the case for global collaboration. Partnerships such as the previously reported alliance between HYAS Infosec and CyberRey to strengthen international cyber defences demonstrate why intelligence-sharing and coordinated response will become increasingly important.
AI is likely to improve defensive capabilities, but it will also enable attackers to operate at a speed that traditional security workflows were not designed to match.
US defence department suspends CMMC Phase II
The US Department of Defense has suspended the second phase of its Cybersecurity Maturity Model Certification programme amid concerns that the requirements would impose billions of dollars in compliance costs and exclude smaller companies from the defence supply chain.
According to Military.com’s report on the CMMC suspension, the decision follows concerns that the programme could generate approximately $7 billion in costs.
CMMC Phase II was scheduled to take effect on 10 November 2026 and would have expanded requirements for independent third-party cybersecurity assessments. The department said the current approach created prohibitive costs and administrative obstacles, particularly for small, medium-sized and non-traditional defence suppliers.
A further practical problem was the shortage of assessors. More than 100,000 defence-industrial-base companies reportedly required assessments, while only around 100 qualified assessing organisations were available.
The suspension does not remove contractors’ obligation to protect federal information. Phase I self-assessment requirements remain in force, while baseline compliance will continue through NIST SP 800-171 Rev. 2 self-assessments and selected government-led reviews.
A dedicated task force will now conduct a comprehensive review and recommend more scalable measures.
The decision exposes a recurring cybersecurity-policy dilemma: requirements must be robust enough to improve security but practical enough to implement. Excessive administrative costs can force smaller suppliers out of regulated markets, reduce competition and concentrate essential services among a limited number of large providers.
Europe faces a similar balancing exercise under NIS2, whose impact on service providers and resellers has been explored in HIPTHER’s analysis of NIS2 as a double-edged sword for the IT channel.
The success of CMMC reform will depend on whether the US can reduce bureaucracy without creating weak links across its defence supply chain.
ENISA opens consultation on managed-security certification
The European Union Agency for Cybersecurity has published a draft of the European Cybersecurity Certification Scheme for Managed Security Services, known as EUMSS.
As reported by Industrial Cyber, the proposed framework is intended to establish consistent security and assurance requirements for managed security providers operating across the European Union.
The initial draft prioritises incident-response services and covers the complete incident-management lifecycle, including detection, response, recovery, reporting, escalation, coordination and post-incident review.
The scheme combines horizontal baseline requirements with vertical service-specific profiles. Its objectives include secure-by-design service delivery, integration with customer environments, resilience against disruption and stronger lifecycle management.
Certification could help customers compare providers against a common European benchmark. It may also reduce fragmentation caused by differing national certification schemes, an increasingly important consideration as managed security services support organisations operating across several EU jurisdictions.
However, certification must avoid becoming a static compliance exercise. A provider may hold appropriate policies and technical controls while still responding poorly to an actual crisis. EUMSS will be most valuable if its assurance requirements test operational performance, communication and recovery—not merely documentation.
ENISA’s public consultation remains open until 13 September 2026. Stakeholders have been invited to submit detailed comments and proposed amendments to the draft.
The initiative illustrates the broader connection between cybersecurity certification and compliance management. Organisations are already adopting tools that provide data-security controls for complex regulatory requirements, and a harmonised EU scheme could give those controls a clearer service-level framework.
Telefónica puts AI into the secure development lifecycle
Artificial intelligence is changing software development by accelerating code generation, testing, documentation, refactoring and error analysis. Telefónica argues, however, that productivity is only part of the opportunity.
In its analysis of AI, software development and corporate cybersecurity, the telecommunications group explains how AI can help organisations build applications that are more secure, scalable and compliant.
AI tools can analyse code changes, identify insecure configurations, review dependencies, detect potential vulnerabilities and suggest corrections before weaknesses reach production. This supports a shift from reactive remediation towards security integrated throughout the development lifecycle.
But AI-assisted development also creates a new risk surface. Generated code may appear functional while containing hidden vulnerabilities, inappropriate dependencies or implementations that do not match the intended architecture. Organisations must therefore validate both the resulting software and the way AI was used to produce it.
Telefónica’s approach emphasises:
- Secure and isolated AI-development environments.
- Protection of corporate and customer data.
- Human review of generated code and suggested fixes.
- Automated testing and vulnerability analysis.
- Governance, traceability and compliance controls.
- Architectural validation and integration testing.
- Clear accountability for final deployment decisions.
The developer’s role consequently moves towards architecture, supervision and validation. AI may produce more of the initial implementation, but experienced professionals remain responsible for deciding whether that output is secure, maintainable and appropriate.
The goal is not simply faster code production. It is using automation to identify weaknesses earlier while preserving human judgement at critical points.
DigitalXForce recognised for AI-native risk management
DigitalXForce has been named a finalist in Cyber Defense Magazine’s 2026 Top InfoSec Innovator Awards and its selection of the world’s 25 most innovative cybersecurity companies.
According to the company’s announcement through EIN Presswire, it received recognition for its AI-powered Trust, Risk, Security and Compliance Management technology and its X-ROC Risk Operations Center.
DigitalXForce describes its platform as an AI-native environment for automated governance, risk and compliance, enterprise security-posture management, third-party risk and cyber resilience.
Its AI engine uses intelligent agents, machine-learning models and a dynamic control library to monitor controls, map evidence, assess risks and produce real-time insights. The stated objective is to reduce manual compliance work while improving audit readiness and organisational visibility.
Final winners are expected to be announced in October 2026.
Although the recognition is based on the company’s own announcement, it highlights a wider market trend: security platforms are increasingly trying to unify technical risk, regulatory evidence, third-party exposure and resilience planning.
As organisations face more frameworks and larger volumes of security data, the competitive advantage will not come from producing additional alerts. It will come from converting fragmented information into prioritised decisions that leaders can understand and act upon.
The bigger picture
This week’s developments illustrate a cybersecurity market moving from defensive controls towards provable, continuously managed resilience.
The emerging priorities are clear:
- Measure operational impact rather than security activity alone.
- Prepare for AI-enabled attacks that develop in hours instead of weeks.
- Design regulations that improve security without excluding smaller suppliers.
- Establish reliable standards for managed security providers.
- Integrate AI into software development with validation and oversight.
- Turn compliance and risk data into actionable intelligence.
Cybersecurity can no longer be treated as an annual audit or a technical function operating separately from the business. The strongest organisations will be those that can demonstrate how quickly they detect problems, make decisions, maintain essential operations and recover when prevention fails.
