CyberSecurity Live returns to Hilton London Tower Bridge on Wednesday 11 November, with an agenda shaped by the past year: AI embedded in both attack and defence, tighter regulatory expectations, and boards demanding evidence of resilience. Ahead of this year’s event, here are five lessons from the 2025 edition that remain central to the debate.

1. Resilience matters more than prevention

Financial institutions must move beyond preparing for individual cyber incidents and consider how multiple disruptions could combine to threaten their operations.
Fox Ahmed, global head of cybersecurity and technology and data protection regulatory risk at BNP Paribas, argued that traditional crisis simulations no longer reflect the complexity of real-world incidents.

“For years, our crisis simulations were neat and tidy, with one system outage, one team, and one clean ending,” he said. “But that’s not how crises work in reality.”

Ahmed highlighted the growing possibility of cyberattacks coinciding with cloud outages, vendor breaches and geopolitical disruption, creating what he described as “polycrises”.
He urged organisations to move beyond paper-based exercises and test how teams make decisions under pressure, particularly when dealing with incomplete information and multiple competing priorities.

“Resilience should be a strategic conversation,” Ahmed said. “It is not built in a crisis, but through rehearsal. “We need to move beyond saying ‘this is fine’ and actually prove that it works in practice."

2. Cybersecurity is a boardroom responsibility

While technology remains a key part of cyber resilience, speakers said organisations also need greater involvement from senior leadership and a more strategic approach to cyber risk.

Manuel Hepfer, research affiliate at Oxford University’s Saïd Business School, presented research based on interviews with chief executives whose organisations had experienced cyberattacks.

He identified a distinction between cybersecurity, which is often viewed as the responsibility of technical specialists, and cyber resilience, which requires organisation-wide involvement.

“This change from being simply accountable to being co-responsible is a core mindset shift,” he said.

Hepfer also highlighted a preparedness paradox. Executives can feel confident in their organisation's ability to withstand an attack based on exercises and existing plans, only to discover their limitations when faced with a real incident.

He argued that effective leadership means remaining actively engaged, asking informed questions and supporting cybersecurity teams rather than relying on their reports.

3. AI is accelerating the threat landscape

AI is creating opportunities for security teams, but it is also giving cybercriminals new ways to deceive employees and exploit vulnerabilities.

Anna Webb, head of global security operations at Kocho, highlighted the growing use of AI-generated phishing, deepfakes and synthetic identities to make attacks more convincing.

She warned that phishing emails increasingly appear to come from trusted third parties, while AI-generated voices and images can be used to impersonate executives and authorise fraudulent payments.

However, AI also offers opportunities to strengthen defences, particularly by helping security operations centres prioritise alerts and reduce the burden on analysts.
Webb urged organisations to adopt a zero-trust approach while maintaining human oversight.

“AI can help us fight back, but it is still the human element that makes the real difference,” she said.

4. Ransomware has become a sophisticated criminal business

The ransomware threat has evolved beyond encrypting systems and demanding payment for their release. Criminal groups increasingly operate as organised businesses, using data theft, extortion and reputational threats to pressure victims.

Eddie Lamb, global head of cyber at Hiscox, explained that attackers are increasingly prioritising the theft of sensitive information over encryption.

Meanwhile, Dr Jason R.C. Nurse, associate professor in cyber security at the University of Kent, revealed how ransomware groups recruit affiliates, distribute profits and establish internal hierarchies.

“They are copying how recruitment works in legitimate businesses,” he said.
With the help of a leak of chat logs at ransomware group Conti, Nurse and his research team were able to gain a sneak peek into the mind of a cybercriminal.

“I was blown away to understand and reflect upon how these groups grow their businesses,” he said.

5. Collaboration is essential to fighting cybercrime

A final theme was the importance of cooperation between financial institutions, technology providers and law enforcement.

Craig Rice, chief executive of the Cyber Defence Alliance, highlighted Operation Stargrew, which helped dismantle LabHost, a phishing-as-a-service platform responsible for stealing hundreds of thousands of payment card details.

The operation involved international police raids and nearly 40 arrests, demonstrating how intelligence sharing can help disrupt criminal networks.

“We are no longer just reacting and defending but are now able to hit back at criminals by taking offensive actions,” Rice said.


Cyber threats continue to evolve at pace, making collaboration and knowledge sharing more important than ever. CyberSecurity Live brings together senior cybersecurity, risk and technology leaders from across financial services to explore the latest threats, regulatory developments and practical strategies for strengthening resilience.

Register today to join us on 10 November at the Hilton London Tower Bridge and hear from leading voices across financial services and cybersecurity. Places are free for professionals working within regulated financial institutions and insurance companies, while technology providers and consultants can attend for £395 plus VAT.

View the full agenda and register for CyberSecurity Live 2026 now for a chance to win a £100 Virgin Experience gift card.

---