Methods

Fellow Brummies, am back in the hood! Back working with the lovely people at WMCA. I am leading on some digital work with a great Methods / WMCA team. It’s really is lovely to be back in Brum.

The 𝟐𝟎𝟐𝟔 𝐃𝐒𝐈𝐓 𝐫𝐞𝐩𝐨𝐫𝐭 report is out, and the numbers tell a story we have been seeing on the ground: the UK cyber sector is maturing, but it is also getting leaner. The headline figures show revenue is up by 𝟏𝟏 𝐩𝐞𝐫𝐜𝐞𝐧𝐭, yet employment only grew by 3 percent. For any executive team, this "𝐞𝐟𝐟𝐢𝐜𝐢𝐞𝐧𝐜𝐲 𝐠𝐚𝐩" should be a red flag. It proves that we can no longer hire our way out of trouble. Frankly, the budget and the talent pool simply do not exist to solve cyber risk through headcount alone. 𝐂𝐲𝐛𝐞𝐫 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐣𝐮𝐬𝐭 𝐚 𝐭𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐝𝐞𝐩𝐚𝐫𝐭𝐦𝐞𝐧𝐭 𝐢𝐬𝐬𝐮𝐞. The regulatory landscape for 2026 has turned it into a primary board-level liability. We are seeing a pincer movement of new laws that demand executive ownership: 🛡️ 𝐓𝐡𝐞 𝐔𝐊 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐚𝐧𝐝 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐁𝐢𝐥𝐥: This mandates a 24-hour reporting window for incidents. This is not just a technical challenge; it is a business continuity and legal risk that requires immediate attention from the top. ⚙️ 𝐓𝐡𝐞 𝐄𝐔 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐀𝐜𝐭 (𝐂𝐑𝐀): With key obligations starting this June, this moves security into the realm of product liability and supply chain management. If you are in engineering or enterprise services, this is now a CEO and COO priority. The recent nearly £1 million fine for 𝐒𝐨𝐮𝐭𝐡 𝐒𝐭𝐚𝐟𝐟𝐨𝐫𝐝𝐬𝐡𝐢𝐫𝐞 𝐖𝐚𝐭𝐞𝐫 is a stark reminder of what happens when governance fails. In that case, an initial breach went undetected for 20 months. Under the new Bill, a detection gap like that is not just a technical oversight; it is a failure of board-level accountability. This is why the 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐏𝐥𝐞𝐝𝐠𝐞 launched at CYBERUK is so important. It asks for a named board member to take accountability for cyber, moving it from the server room to the boardroom. If we cannot find a thousand new analysts to watch the screens, we have to build systems that are inherently harder to break and easier to fix. I advocate for Resilience by Design because it is the only logical business response to the data. Whether we are supporting organisations to become CAF-enabled through the NCSC framework, or applying standards like ETSI and ISO 42001 to secure the AI supply chain, the goal is the same: 𝐞𝐧𝐝𝐮𝐫𝐚𝐧𝐜𝐞. At Methods , we believe we have to move away from the era of "protection" and into the era of "𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞" If you build it right the first time, you do not need a small army to defend it later. #CyberSecurity #Leadership #ResilienceByDesign #NCSC #CyberUK2026 #InfoSec #CRA #CyberGovernance #Methodsforgood