Manchester, 4th November - Governments are reshaping cyber security policy in response to AI, emerging quantum technologies and geopolitical tensions. NCC Group’s latest Global Cyber Policy Radar investigates the diverging approaches to national cyber defence, supply-chain security and organisational resilience caused by these upheavals.
The report warns that these developments mean businesses must move beyond treating cyber security in isolation. Collaboration between industry and government will be critical to strengthening both organisational and national resilience.
AI’s impact on cyber threats and global regulation
As governments incorporate AI into national cyber defence, organisations face new questions around trust, access and sovereignty. They should consider their readiness to adopt trusted AI-supported defences and understand how national approaches could affect their operations.
In the UK, the NCSC and DCMS have recently announced the National Cyber Shield, which aims to deliver sovereign cyber defence capabilities supported by a wider ecosystem.
Can temporary attention on high profile breaches be converted into resilience?
The rise of generative and frontier AI has driven a more sustained focus on cyber security, according to the report. This contrasts with the spikes in public attention that typically follow major breaches, which tend to fade even as their regulatory and policy consequences continue.
The challenge for organisations is to ensure that this focus translates into lasting commitment. Boards must maintain investment, strengthen governance and ensure incident response and recovery capabilities are tested, rather than allowing cyber security to slip down the agenda when the headlines move on.
Preparing for the next shift in quantum readiness
AI has shown how quickly an emerging technology can reshape the cyber security landscape, accelerate government action and create new expectations for businesses. The Global Cyber Policy Radar highlights a similar shift in quantum, with governments moving from post-quantum cryptography guidance towards implementation expectations. Organisations should consider how quickly they can accelerate their post-quantum preparedness, before a shock event reduces their room to manoeuvre.
Supply chain dependencies are more critical than ever
Political awareness of supply chain dependencies is driving regulatory change within and beyond critical infrastructure. The UK’s Energy Sector Cyber Security Strategy reflects a growing focus on suppliers further down the supply chain. Supplier mapping, ownership monitoring, software bills of materials and stronger third-party assurance can improve visibility of who organisations depend on, how those dependencies could be disrupted and how operations can continue if disruption occurs. Organisations should also understand where they themselves are a critical dependency for others.
Managing geopolitical disruption as a persistent operating condition
Geopolitical disruption is becoming a persistent operating condition that boards must manage as part of everyday governance. Organisations should assume potential exposure to state-linked activity, identify the core functions that must continue and test recovery plans before they are needed. They should also understand what relationships they need with government and regulators during a crisis.
How age assurance can establish trusted attributes
This edition also examines age assurance. The report highlights the UK’s commitment to a minimum age of 16 for certain social media platforms, while the EU’s KIDS Act sets a minimum age of 15 to open a social media account. Privacy-enhancing technologies (PETs) can allow services to confirm an attribute, such as a user’s age, without collecting more personal data than necessary.
But minimising data and using PETs do not make a system trustworthy on their own. Secure architecture around these technologies remains critical to establishing trust in digital systems.
Katharina Sommer, Director of Government Affairs at NCC Group, said, “Cyber policy has never had a simple trajectory. Today, rapid technological change and geopolitical fragmentation mean organisations must make decisions before the final shape of policy is clear. That uncertainty is not a reason to pause resilience initiatives or wait for further guidance.
“From AI-enabled national cyber defence to growing geopolitical fragmentation, organisations need to anticipate how these developments could affect their operations. Understanding strategic dependencies and preparing for disruption must become an ongoing part of governance, not something addressed only when a crisis occurs.”
The full Cyber Policy Radar 6.0 is available below:
Read the report
