The conflict is already here
Much of the global conversation around security focuses on the potential for future conflict. In cyberspace, however, many organisations are already operating in a contested environment.
Governments, militaries, critical national infrastructure operators and businesses face a threat landscape characterised by persistent campaigns, state-backed actors and increasingly sophisticated criminal enterprises. The pace of activity shows little sign of slowing.
This reality requires a shift in mindset. As Richard Horne, CEO of the National Cyber Security Centre, argued earlier this year, cybersecurity can no longer be viewed simply as a risk to be reduced to an acceptable level. Instead, it should be treated as an ongoing contest in which outcomes are determined by capability, performance and resilience.
For security teams, success rarely comes from entries on a risk register alone. It comes from the operational effectiveness of people, processes and technology working together across broad networks of defence.
AI is changing the battlefield, but resilience is holding
Artificial intelligence is often presented as the defining cyber challenge of our time, and rightly so.
The emergence of increasingly capable AI systems has created new opportunities for malicious actors, accelerating activities ranging from reconnaissance and social engineering to vulnerability discovery. The pace of development is striking. Threat intelligence reporting on the malicious use of AI has expanded significantly over a remarkably short period as researchers and defenders work to understand the implications.
Yet amid understandable concern, there is also a positive story.
Despite the rapid emergence of a new class of autonomous threats, the real-world impact has so far been contained. The fundamental building blocks of cyber resilience remain effective. Strong security architecture, layered defences, effective monitoring, skilled personnel and robust incident response continue to provide protection against both established and emerging threats.
The challenge for the cybersecurity community is therefore not to replace existing approaches, but to enhance them. By integrating AI into defensive operations, organisations have an opportunity to empower analysts and security teams, helping them identify vulnerabilities earlier, anticipate adversary tactics and respond at greater speed.
If attackers seek to use AI to gain an advantage, defenders must use it to regain the initiative.
Lessons from the Indo-Pacific
Working with international partners provides valuable insight into how different nations are approaching the cyber challenge.
Across the Indo-Pacific region, many organisations report persistent cyber activities attributed by governments and security agencies to state-backed actor seeking to gather intelligence, exert influence and, in some cases, undermine democratic institutions.
One of the most striking observations is that while technical security controls remain essential, many organisations place equal, if not greater, importance on developing people and institutions.
Investment in cyber skills, leadership education and national coordination frameworks is often viewed as a strategic priority.
The organisations most prepared for sustained competition in cyberspace recognise that resilience is built over years through workforce development, operational partnerships and collaboration across government, industry and academia.
These partners understand they are engaged in a long-term contest. In that context, experience drawn from the UK's own cyber ecosystem, particularly its collaborative and multi-stakeholder approach to cybersecurity, continues to be highly valued.
Ukraine demonstrates the power of people and partnerships
Perhaps nowhere are the realities of cyber conflict clearer than in Ukraine.
Since the invasion, Ukraine has implemented what many consider to be the world's first wartime cyber defence at national scale. Throughout the conflict, cybersecurity professionals have played a critical role in maintaining essential services, supporting military operations and ensuring the continuity of government.
The experience provides an important lesson.
Ukraine cannot compete against threats purely through scale. Instead, two assets have proven decisive: a highly skilled workforce and a network of international partnerships.
The country's strength in software development and cybersecurity, combined with support from allies and industry partners, has enabled it to withstand sustained cyber operations that many expected would be significantly more disruptive.
While much of Ukraine's cyber defence capability has evolved rapidly since the invasion, it has been built upon foundations that were established years earlier through investment in education, technical skills and international cooperation.
The lesson is clear: resilience is not created in a crisis. It is developed long before one arrives.
Making cyber defence a career of choice
The cybersecurity profession has long emphasised the importance of people, but the challenge now is larger than filling technical vacancies.
Cyber defence needs to be a respected and sought-after career path across a wide range of professions that all contribute to resilience. That means attracting not only technical specialists, but also professionals from policy, strategy, law, finance, insurance, risk and a host of other disciplines.
Modern cyber resilience depends on a diverse workforce bringing together different perspectives and expertise. Defending organisations, economies and nations requires far more than technical skills alone.
Around the world, cybersecurity professionals are already demonstrating the impact they can have. Individuals who may once have been viewed simply as IT specialists are now helping to protect national security, critical infrastructure and democratic institutions.
Their contribution has never been more visible, or more important.
Celebrating the defenders
The National Cyber Awards exist to recognise the individuals and organisations strengthening the UK's cyber resilience every day. Their work reflects the skill, innovation and commitment required to meet an increasingly complex challenge.
Cybersecurity may now be a constant contest, but it is also a story of opportunity. The foundations of resilience remain strong, defensive capabilities continue to evolve, and an extraordinary community of professionals is rising to meet the challenge.
The future of conflict may already be here in cyberspace. Fortunately, so is the talent needed to secure it.