Meet the Senior Security Consultant: Berenike Vollmer

My musician parents raised my four siblings and I without a television or computer; instead, the air vibrated with orchestra rehearsals and political debates. I pursued my passion for culture by exploring diplomacy. A government scholarship took me to Costa Rica, where I led humanitarian projects, learning first-hand how to influence decision-making, communicate across cultures, and drive change in resource-strained environments. Years later, these same skills have become my greatest strengths as a consultant.

During a cyber-crisis simulation at university, I found what felt like modern diplomacy – fast-paced, impactful decision-making between technology and strategy. I remember thinking, “This is it. This is where I can make a difference.” 

Fast-forward 10 years and here I am working as part of our cyber security team in a role that allows me to flex my brain as a cyber threat intelligence analyst, while also working to support governments across the world as they navigate the operational and cultural nuances of threats on the international stage.

Threats are borderless

Threat actors operate across the world. They aren’t held back by traditional borders, and they can move rapidly from one state to the next. That’s why it is so important that we understand what the latest trends are. Researching technical and threat actor reports is an important role of my team, so that we can better understand what state-sponsored and financially motivated threat actors might be doing, what hacktivists are up to, and which political and ideological motivations are shaping their movements.

This feeds into the fascinating world of cyber capacity building. Putting our knowledge of the threat landscape to work is what I get really excited about, and this is where my love for diplomacy steps in too. I work closely with government organisations across the world to understand their concerns, share crucial knowledge, and analyse what steps they can take to mitigate against current and emerging threat actors. 

Every government is different, with different concerns and a different cultural context. Sometimes it’s the potential threats against critical national infrastructure that are top of the priority list. For other states, there might be a particular concern about fraud. Wherever I am in the world, it’s about putting the threats in the context of that country’s culture – just like in diplomacy. If you can understand a country’s past, you can understand what threats it might be wary of now or in the future, and therefore provide the cyber threat intelligence that is most relevant and helpful. 

What’s keeping me up at night?

These days, a few urgent questions keep surfacing in my cyber security advisory work:

1. How can we secure crucial supply chains in our national infrastructure? From hospitals to power plants, our most vital services depend on complex, often opaque, supply chains. We’ve seen encouraging moves in both policy and technology, like shifts toward the Security by Design approach. But the reality is that most organisations still lack visibility specifically into their operational technology (OT) environments, and this leads to a significant knowledge gap especially among non-technical decision-makers. Bridging that gap is crucial to protecting the systems that keep our societies running.
2. Are our IoT networks exploited for cyber operations? When we talk about cyber espionage or surveillance threats, people picture high-end software exploits or zero-days, but often a threat can be as ‘boring’ as a low-cost router. Threat actors – both state-sponsored and criminal – see IoT as a low-hanging fruit for gaining persistent access, co-opting these devices for their own uses. With billions of these devices exposed online, securing them isn’t just a technical question, it’s a strategic challenge.
3. How secure are the sub-sea cables we rely on? The global internet, and therefore societies and economies, rely on a surprisingly vulnerable backbone: physical undersea cables which carry over 95% of international data traffic. Yet, many remain inadequately protected against both physical and cyber threats, with current geopolitical tensions only heightening the risk of tampering or sabotage. 
4. How do we prevent election interference in the world of influence operations, deepfakes and social media? Around the world, we are seeing elections being influenced by trolls, bots and generative AI that can convincingly mimic trusted figures. AI is most likely to present a threat in three areas — disinformation campaigns, some components of cyber operations, and the security of AI itself. The challenge is more complex than any single organisation may be capable of solving in isolation, requiring effective collaboration between private industry, government, media and the wider public.
5. How do we stop ransomware from threatening critical infrastructure? Ransomware continues to be one of the most disruptive threats out there, especially when it hits critical sectors like healthcare or energy. Recent policy discussions have focused on the legality of ransomware payments and the development of coordinated incident response, prevention and resilience-building frameworks.

These are all timely questions, with countries like the UK advancing their resilience agendas through new legislation such as the Cyber Security and Resilience Bill.