Regulations, cybersecurity and AI concerns dominate enterprise concerns
For executives, the real issue is not whether regulation, cybersecurity and AI matter, but how they are governed together. Treating compliance programmes, security uplift and AI experimentation as separate workstreams usually creates duplicated controls, inconsistent risk appetite and competing demands on scarce specialist skills. The management question is who owns the combined agenda, what gets funded first, and which decisions sit with security, legal, architecture or business leadership.
That means the board and executive team need a clearer portfolio lens. Instead of approving isolated tools or one-off remediation, leaders should ask how each investment reduces exposure, improves compliance readiness or protects critical services. The trade-off is speed versus control: moving quickly on AI can create new attack paths, while over-engineering governance can delay necessary modernisation. The priority is not perfect certainty, but a decision framework that makes risk explicit and comparable across initiatives.
Another implication is operating model design. If asset visibility, incident response, third-party oversight and AI use are all rising at once, security teams cannot be the only line of defence. Organisations need shared accountability across operations, procurement, data, compliance and application owners. That raises practical questions: who maintains the authoritative asset inventory, who signs off on AI use cases, and who is responsible when regulatory evidence is requested?
The next step for leaders is to test whether current governance can absorb these pressures without slowing delivery. Useful questions include: which regulations create the biggest control gaps, where do we lack reliable asset or service ownership, and which business processes would be most damaged by a cyber incident? Those answers should shape funding, sequencing and board reporting for the year ahead.
Regulation will act as a rude awakening for many
This year saw the second iteration of the Network and Information Security (NIS2) directive come into effect, which updates the existing legal framework determining cybersecurity standards in the EU. The initial legislation, known as NIS, affected critical sectors such as healthcare, energy and transport, but NIS2 includes entities such as the food sector and cloud computing services. Its modernisation intends to strengthen and streamline security and reporting requirements for organisations, providing a minimum list of basic security elements that must be incorporated. Previously, organisations were fined following a breach, yet this latest directive dictates entities will be fined based on failing to meet legislative standards, irrespective of whether thereโs a breach. The shockwave of NIS2 will force organisations to undergo a risk management transformation. In 2024, we will see manufacturers that you wouldnโt expect being regulated under the NIS2 banner. This shift necessitates a heightened focus on cybersecurity preparedness, with intelligence becoming the centre of security decisions. In doing so, organisations will be able to ensure their compliance with the directiveโs rigorous cybersecurity standards.Further attacks on healthcare organisations, with improved accuracy
Healthcare organisations are under huge pressure and as we saw in 2023, they are actively becoming targets of coordinated cyberattacks. These attacks can be motivated by a variety of factors, including financial gain, espionage or simply the desire to cause disruption. In recent years, we have seen several high-profile cyberattacks on healthcare organisations, including the ransomware attack on the NHS in the UK and the data breach at Anthem, a major US health insurance company. These attacks have had a significant impact on the healthcare industry, disrupting patient care and costing organisations millions. As cybercriminals become more sophisticated and develop new attack techniques, we can expect to see even more attacks on healthcare organisations in the coming years. It is therefore of the utmost importance that healthcare organisations continue to invest at a board level in cybersecurity and proactive defence of core infrastructure.A new โColonial Pipelineโ โ a major critical infrastructure attack
Critical infrastructure is the term used to describe the systems and networks that are essential for the functioning of society. These systems include power grids, water and wastewater systems, transportation networks and telecommunications networks. Critical infrastructure is a prime target, as a successful attack can have a devastating impact on society. In recent years, weโve seen several high-profile cyberattacks, including on Ukrainian critical infrastructure since December 2022, the attacks on Denmarkโs critical infrastructure in May 2023 and the constant targeting of Australiaโs ports and critical infrastructure, brought to light in November 2023. The risk of a successful cyberattack on critical infrastructure in the Western world is real. The UK is the third most targeted country globally for cyberattacks, after the US and Ukraine, and a successful attack on critical infrastructure could cause widespread disruption and economic damage. Governments and businesses must take steps to protect critical infrastructure from cyberattacks. The first step is to gain visibility of the entire attack surface.Regulations regarding asset inventory management will be enhanced
Asset inventory management is the process of identifying, tracking and managing an organisationโs assets. Asset inventory management is important for a number of reasons, including compliance with regulations, risk management and financial management. UK regulations regarding asset inventory management are likely to be enhanced in the coming years with the Financial Conduct Authority keen to ensure its rules are fit for the future. Then thereโs the Digital Operational Resilience Act (DORA) that financial institutions must also contend with. When financial companies follow DORA regulations, they are considered compliant with NIS2, especially when โLex Specialisโ is considered in international law. Thereโs a lot to consider. This will ultimately require organisations to invest in new technologies and processes to manage their assets more effectively, particularly in the face of compliance.UK organisations canโt afford to wait for AI regulations
The AI arms race is real
As the UK pushes to secure itself as a world-leading AI superpower, with investments of over ยฃ1 billion in AI, and a plan to not rush regulations coming off the back of the AI Safety Summit, the UK is positioned to become a strong AI capability. Yet, this strength can incite challenge. Challenge incites conflict. And conflict leads to disaster, opening the nation up to potential AI cyberwarfare threats. The UK government may be taking their time to understand and evaluate the safety of AI, but organisations canโt afford to wait. Cybercriminals and other bad actors are already exploiting AI in their attacks, so organisations must fight back with AI of their own. This means incorporating AI technologies such as machine learning algorithms and natural language processing into their cybersecurity strategies, alongside traditional tools. 2023 illustrated how quickly AI can evolve. Those organisations that make the right call and adapt will thrive. Those who do not will be left behind.Preparing for the future
Put simply, navigating the uncertainties of the future demands a proactive stance. Whether itโs gaining better visibility through attack surface management or fortifying cybersecurity measures, businesses must be agile in the face of evolving challenges, even if that means acting before regulations come into effect. Those organisations that anticipate, look ahead and adapt to the dynamic landscape will ultimately ensure better resilience throughout 2024. Artilce by David Critchley, the regional director for UK and Ireland at Armis Comment on this article below or via X:ย @IoTNow_Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.