October was National Cybersecurity Awareness Month, and I was recently asked to provide some commentary for Node4 on how AI is changing the cybersecurity landscape, and what businesses should be doing in response.

I’m pleased that some of my comments were picked up by journalists, appearing in articles published by Cybersecurity Insiders and Cyber Protection Magazine.

Those articles brought together perspectives from several contributors, so I thought I’d share my original commentary here, in full. We also posted an edited version as the “CTO Corner” this month’s Node4 customer newsletter.

Cybersecurity’s growing decision-speed gap

National Cybersecurity Awareness Month often focuses on the latest threats, the latest attack techniques and, increasingly, AI. Those things matter, but they’re not the most important lesson businesses should take from what’s happening in cybersecurity today.

The bigger issue is the growing gap between the speed at which attackers can operate and the speed at which many businesses make decisions.

AI is changing the economics, not the fundamentals

AI is changing the economics of cybercrime. It can help attackers automate research, improve phishing campaigns and carry out activities at a scale that once required much more time and expertise. But attacks still tend to rely on weaknesses we’ve understood for years: stolen credentials, excessive privileges, poor visibility, weak governance and slow remediation.

The difference is that attackers can now exploit those weaknesses more efficiently.

Too many businesses still respond through operating models designed for a slower world. Security reviews happen periodically. Access rights are reviewed to a schedule. Vulnerabilities compete with other priorities, while changes move through governance processes before anyone acts. That’s not necessarily a technology problem. In many cases, it’s an organisational one.

The Microsoft Digital Defense Report 2026 (sic) says AI is “compressing attack timelines” and that security teams must prepare for attackers and defenders increasingly operating at machine speed. That supports my view that the cyber gap is becoming a decision-speed gap. The challenge often isn’t spotting the risk – it’s making a decision and doing something about it quickly enough.

Businesses won’t close that gap simply by buying more tools. They need to identify risk, decide what matters and act before an attacker exploits the opportunity.

For most businesses, the priority isn’t a new security programme. Instead, the focus should be on reducing unnecessary privilege, improving visibility, tightening control over identities and shortening the time between identifying a risk and acting on it.

Stop blaming people for poorly designed processes

We also need to stop calling people the weakest link in security.

For years, us IT folks have talked about human error as though employees are a problem to be fixed. But most people are working within processes, systems and incentives that somebody else designed.

If one person can expose sensitive information, approve a fraudulent payment or create a serious incident by clicking a convincing phishing link, we shouldn’t only ask why they made a mistake. We should ask why one human decision was allowed to create that level of risk.

Good security doesn’t assume people will behave perfectly. It assumes mistakes will happen and designs around that reality. Multi-stage approvals, proper segregation of duties, conditional access and stronger control over access and permissions can all reduce the chance of an error and limit the damage when one occurs. That’s more useful than another round of awareness training telling people to be more careful.

Govern AI agents as identities

This becomes even more important as businesses adopt AI agents.

Most organisations are currently thinking about AI agents in terms of productivity and automation. The more important security question is whether they’re treating them as identities.

An agent can access information, use tools and take actions on somebody’s behalf. It may operate across systems that were originally designed around human interaction. That doesn’t automatically make it dangerous, but it does mean the organisation needs to know what it can access, what it’s allowed to do and how those permissions can be changed or removed.

Many businesses already struggle to govern human identities, service accounts and application permissions. Adding AI agents without clear ownership and accountability risks making an existing challenge harder to manage.

For at least a decade, we’ve been talking about identity as the primary control plane for defence and Microsoft now notes that this now extends beyond human users to include applications and agents. Whilst identity-led security isn’t new, what’s changing is the number of non-human identities organisations now need to govern, and the level of autonomy some of those identities may be given.

The question to ask is whether businesses are prepared to apply the same discipline to AI agents that they already know they should be applying to people, applications and service accounts.

Don’t lose sight of the fundamentals

It’s easy to understand why AI dominates so many cybersecurity conversations. The technology is influencing both attack and defence, and its role will only grow over time.

The risk is that businesses become so focused on what AI might change that they overlook the factors that continue to determine whether most attacks succeed.

Identity, governance, resilience and operational discipline aren’t particularly fashionable topics, but they remain the foundations of effective security. AI can help security teams detect threats faster, analyse more data and automate routine activity. Those are valuable capabilities. What it can’t do is compensate for weak processes, unclear ownership or slow decision-making.

This is one area where a good MSP can genuinely help. The challenge is rarely a complete lack of technology. More often it’s a lack of visibility, operational capacity or access to specialist expertise. The value isn’t another security dashboard. It’s helping businesses improve visibility, strengthen governance, access specialist expertise and act more quickly when risks emerge.

The biggest cyber risk facing many businesses isn’t that attackers have suddenly become unstoppable. It’s that attack speed is increasing while decision-making, governance and control remain stubbornly human-paced.

If that gap continues to grow, no amount of security technology will close it on its own.