As we head to our 21 st edition of Cyber News Global, we will be focusing on one of the most important issues effecting us all right now, AI! so let’s look at Ai Governance, the World Cup has started so in the true spirit of friendship CNG have partnered with Ai Partners to bring you the Ai Governance World Cup special edition.
With the advancements in Ai and its use being embraced so widely, it’s no surprise that Ai Governance has become a critical process to ensure that everyone understands their responsibility when utilising Ai to expand their capability. We will feature a special review of Scotland’s Ai Strategy, try to understand what is at stake for every single person and company now deploying Ai in their every day working life.
Quantum computing plans to revolutionise industry like never before, with that in mind CNG has yet another excellent Quantum focused article explain the challenges now facing every sector.
Shadow AI and Governance will feature a Quantum focus from our friends at Vernewell Group. Cyber Resilience in times of Uncertainty and” Its only Data Until it Isn’t” will set the scene of issues that we should all be considering.
Let’s not loose site of our competitive edge and please find time to visit the many reports published around the Ai Governance World Cup.
So dear readers, don’t lose sleep, know that there is an army of cyber and Ai warriors out there looking at the future.
Building Cybersecurity Through Inclusion, Confidence and Community
By
Cyber News Global recently managed to catch up with Heide Young cofounder of the Women in Cyber Security Middle East, we wanted to understand what it takes to create a career in the UAE for a female cyber professional, this is what Heide had to say.
I have been in the UAE for nearly eight years. Before that, I was in Australia, where I served on the leadership team for the Australian Women in Security Network, founded by the wonderful Jacqui Loustau. When I moved to the UAE, I was genuinely surprised that there was no dedicated group for women in cybersecurity.
What started as a very small community has grown into something I am incredibly proud of today. Women in Cyber Security Middle East was built on a simple belief: women belong in cybersecurity, and they should have access to the networks, training, mentorship and opportunities needed to thrive.
I did not start my career in cybersecurity, which is why I strongly advocate for career changers and anyone with the passion to learn more about the field.
Cybersecurity needs people with different experiences, perspectives and strengths. There is no single path into this profession. For me, one of the most rewarding parts of cybersecurity is the human side.
I enjoy understanding how different business units operate and helping position cybersecurity as a business enabler, not a blocker. When security teams work closely with the wider business, they can build trust, improve resilience and support innovation.
Confidence, communication and knowing your value
One of the most important skills I have developed is strong organisational discipline. I also spend a lot of time mentoring women, including mothers returning to the workforce. Confidence does not happen overnight, and returning to work can feel daunting. My advice is simple: sit down and write out your core skills, your strengths and the value you bring. There is a seat at the table for you. And when you are at that table, do not be afraid to speak up. No one will always call on you in a meeting. If you have something to say, say it. Your voice, perspective and expertise matter.
The challenges mothers still face at work
Many of the barrier’s women face are still rooted in unconscious bias. Often, decisions are made based on assumptions rather than conversations. Early in my own experience as a mother, there were times when people assumed I did not want a promotion or additional responsibility simply because I had children. That was never true.
Too often, working mothers are overlooked because others assume they are too busy or no longer ambitious. The reality is that many women absolutely want to grow their careers — they simply need flexibility and understanding from their employers.
Flexibility does not mean less commitment. It means recognising that life happens. A child gets sick. A school calls. Responsibilities shift. Professionals can still deliver exceptional results while also needing an employer who understands those realities. That is why honest conversations with leaders matter. Women should feel empowered to say: I am committed to my work, I want to grow my career, and I need the flexibility to manage life when it happens. Organisations that understand this will not only retain talent, t hey will strengthen it.
Why diversity is essential in cybersecurity
Cybersecurity remains a maledominated field, and many women still find themselves as the only female in the room. That can be intimidating, especially when surrounded by highly experienced professionals. But no one has all the answers. This is why I speak so often about cognitive diversity. Cyber threats come in many forms, so cybersecurity teams need diverse perspectives, cultural experiences, educational backgrounds and problemsolving styles. Diversity is not just a social goal; it is a business and security imperative.
Heide YoungCo Founder of WiCSME
What is next for WiCSME
We are entering an exciting new phase for Women in Cyber Security Middle East. We recently signed a partnership with the OSINT Group , giving our members exclusive discounts on opensource intelligence training programs. This is a significant step in expanding access to high-quality learning opportunities for women across our network.We have also signed an agreement with Dubai University to continue the important work of the CyberShe program, originally started in Kuwait by Dr. Reem and Priyanka.
In addition, WiCSME, together with EC-Council and the London School of Cybersecurity, has developed a bespoke four-week intensive boot camp that combines technical skills with the soft skills employers are increasingly demanding. The goal is to prepare women to contribute to the workforce immediately. We aim to train 125 women in the UAE over the next three years, and 1,500 women across the region during the same period. This is a major step toward creating more pathways for women to enter and advance in cybersecurity.
The challenge: turning ambition into impact
One of our biggest challenges is sponsorship. WiCSME is a volunteerled, not-for-profit organisation, and initiatives like these depend on the support of sponsors and partners who believe in the mission.
If we want to build a stronger, more inclusive cybersecurity workforce across the region, we need sustained investment in the women who will help
AI, cybersecurity and the new trust
AI is reshaping not only technology, but work culture itself. In cybersecurity, it has changed the speed and scale of both attack and defence. On the threat side, AI lowers the effort needed to create convincing social engineering content, making it harder for people to judge what is real. It also allows malicious actors to increase both the volume and impact of attacks. Deepfakes are just one example of how trust is being challenged in real time. At the same time, AI introduces an entirely new attack surface. Risks such as prompt injection, insecure output handling, training data poisoning, sensitive information disclosure and over-reliance are now very real concerns.
But I like to step back and look at this practically. If organisations have not put the right governance, policies and internal processes in place, how can they safely enable employees to use these tools? We used to talk about shadow IT. Now we are talking about shadow AI, where adoption is moving faster than governance. AI is reshaping trust, decision-making and accountability. That means AI literacy must become a security control. In the past, we said, “Think before you click.”
Today, the message is broader: verify before you trust. Text, voice and video can all be artificially generated. Businesses must understand what each business unit needs now and in the future, and security teams must be embedded within those functions. Only then can cybersecurity be seen for what it should be: a partner in progress, not a barrier to it.
A final word
None of this work happens alone. Male allies and champions play an important role in helping create opportunities and open doors. Their support matters. The future of cybersecurity depends on inclusion, adaptability and trust. If we want stronger organisations and safer digital ecosystems, we need to ensure more women are not only entering the field, but being heard, supported and given every opportunity to lead.
And to every woman considering a move into cybersecurity: your experience is valuable, your voice matters, and there is absolutely a place for you here.
To listen to Heide Young interview with Lets Talk Cyber:
SCAN ME
Turning Global AI Regulation into a Game the World Can Understand
AI GOVERNANCE WORLD CUP
The world is entering a new era of artificial intelligence regulation. Across continents, governments are drafting laws, issuing guidance, and publishing frameworks to govern the design, development, and deployment of AI systems. Yet for all its importance, AI governance remains an abstract subject for most people. It is technical, legalistic, and often perceived as dry. The AI Governance World Cup was conceived as a response to that challenge: a way of turning global AI regulation into something understandable, comparative, and genuinely engaging.
What Is the AI Governance World Cup?
At its heart, the AI Governance World Cup is a structured comparison of national AI governance frameworks, presented in the format of a football tournament. Instead of watching two national teams compete on the pitch, audiences watch two regulatory systems compete across defined pillars: risk management, transparency, enforcement, scope, ethics, and innovation strategy.
Each “match” compares the strengths and weaknesses of two countries’ approaches to governing AI. The result is not determined by referees or VAR, but by informed community participation.
Why Football?
The idea rests on a simple observation. Football unites people. The FIFA World Cup is one of the most watched events in the world, drawing hundreds of millions of viewers and creating shared cultural moments that endure for decades.
People remember where they were when a famous goal was scored or when an underdog nation advanced further than expected. Regulation, by contrast, rarely inspires that kind of emotional engagement. The AI Governance World Cup seeks to borrow the structure and energy of sport and apply it to one of the defining policy debates of our time.
How it works
The format is straightforward. For each participating jurisdiction, a detailed governance report is prepared. These reports examine the architecture of a country’s AI framework:
whether it is legislative or guidance-based, whether it adopts a risk classification model, how it defines high- risk systems, which actors are regulated, and what enforcement mechanisms are available. Technical thresholds, such as compute limits used to define systemic models, may also be considered. The aim is not to oversimplify, but to distil complex regulatory ecosystems into comparable components. To ensure fairness, each match is assessed against consistent criteria.
These pillars might include the robustness of risk classification, clarity of obligations, transparency requirements, cybersecurity safeguards, institutional oversight, and balance between innovation and precaution. By using the same metrics across jurisdictions, the comparison becomes structured rather than rhetorical. It allows observers to see not only which country has legislated, but how it has legislated and where its priorities lie.
Once the comparative analysis is presented, the audience becomes part of the process. Voting can take place at conferences, online, or through social media platforms. In some formats, participants vote pillar by pillar, awarding points for each dimension
From KYC to KYAI: Know Your AI
A recurring theme in AI governance discussions is the need for organisations to “know their AI.” Borrowing from financial regulation’s “Know Your Customer” principle, the concept emphasises understanding what systems are in use, what data they process, and what risks they pose. The AI Governance World Cup reinforces this mindset.
By examining how different countries classify and manage risk, participants gain clarity on their own responsibilities. Governance becomes less about abstract compliance and more about operational awareness.There is also a geopolitical dimension. Regulatory frameworks are not merely protective mechanisms; they are instruments of influence. The so-called “Brussels Effect” demonstrated how European data protection rules shaped global practice. AI governance may follow a similar trajectory. Countries that establish credible, coherent frameworks may set de facto standards beyond their borders. The World Cup format makes this competitive dynamic explicit. It frames AI regulation as part of a broader contest over norms, trust, and technological leadership.
AI Governance Performs on a Global Stage
Critically, the initiative recognises that public memory shapes policy discourse. Iconic sporting moments endure because they combine narrative, emotion, and shared experience. Regulation rarely achieves that combination. By aligning AI governance debates with the structure of a tournament, the World Cup creates reference points. Participants may recall that one country “advanced” due to stronger risk controls, or that another fell short on enforcement clarity. These associations anchor complex policy discussions in memorable narratives.
None of this diminishes the seriousness of AI governance. On the contrary, it underscores its importance. Artificial intelligence is increasingly embedded in healthcare, finance, public services, and critical infrastructure
Decisions about how to regulate these systems will shape innovation trajectories, market access, and public trust for decades. The AI Governance World Cup offers a way to democratise that conversation without diluting its substance.
A Pivotal Moment for AI Governance
Ultimately, the value of the AI Governance World Cup lies in its ability to bridge two worlds: the technical realm of policy design and the cultural realm of shared experience. It recognises that engagement is not a luxury but a necessity. If regulation remains confined to specialist circles, its legitimacy may suffer. If it becomes part of a broader, participatory dialogue, it stands a better chance of being understood and respected.
As the global AI landscape continues to evolve, so too will the frameworks that govern it. Comparisons will intensify. Debates will sharpen. The AI Governance World Cup does not claim to resolve these tensions. Instead, it provides a platform for exploring them in a structured and accessible way. In doing so, it transforms AI governance from a background technicality into a visible, collective endeavour. In a world where millions gather to watch a ball cross a line, perhaps it is not unreasonable to gather, too, to consider how algorithms cross borders. The stakes, after all, are just as high.
Turning Global AI Regulation into a Game the World Can Understand
Ai governance world cup
The world is entering a new era of artificial intelligence regulation. Across continents, governments are drafting laws, issuing guidance, and publishing frameworks to govern the design, development, and deployment of AI systems. Yet for all its importance, AI governance remains an abstract subject for most people. It is technical, legalistic, and often perceived as dry. The AI Governance World Cup was conceived as a response to that challenge: a way of turning global AI regulation into something understandable, comparative, and genuinely engaging.
What Is the AI Governance World Cup?
At its heart, the AI Governance World Cup is a structured comparison of national AI governance frameworks, presented in the format of a football tournament. Instead of watching two national teams compete on the pitch, audiences watch two regulatory systems compete across defined pillars: risk management, transparency, enforcement, scope, ethics, and innovation strategy.
Each “match” compares the strengths and weaknesses of two countries’ approaches to governing AI. The result is not determined by referees or VAR, but by informed community participation.
Why Football?
The idea rests on a simple observation. Football unites people.
The FIFA World Cup is one of the most watched events in the world, drawing hundreds of millions of viewers and creating shared cultural moments that endure for decades. People remember where they were when a famous goal was scored or when an underdog nation advanced further than expected. Regulation, by contrast, rarely inspires that kind of emotional engagement. The AI Governance World Cup seeks to borrow the structure and energy of sport and apply it to one of the defining policy debates of our time.
How it works
The format is straightforward. For each participating jurisdiction, a detailed governance report is prepared. These reports examine the architecture of a country’s AI framework: whether it is legislative or guidance-based, whether it adopts a risk classification model, how it defines high- risk systems, which actors are regulated, and what enforcement mechanisms are available.
Technical thresholds, such as compute limits used to define systemic models, may also be considered. The aim is not to oversimplify, but to distil complex regulatory ecosystems into comparable components. To ensure fairness, each match is assessed against consistent criteria. These pillars might include the robustness of risk classification, clarity of obligations, transparency requirements, cybersecurity safeguards, institutional oversight, and balance between innovation and precaution.
By using the same metrics across jurisdictions, the comparison becomes structured rather than rhetorical. It allows observers to see not only which country has legislated, but how it has legislated and where its priorities lie.
Once the comparative analysis is presented, the audience becomes part of the process. Voting can take place at conferences, online, or through social media platforms. In some formats, participants vote pillar by pillar, awarding points for each dimension of governance.
In others, an overall winner is selected based on the aggregate strength of the framework. The essential principle remains the same: the community is invited to weigh evidence and form a view parallel. This creates narrative symmetry and helps anchor the discussion in a broader cultural moment.
Even where football scheduling does not dictate the pairing, comparisons can be designed to spark meaningful debate— European Union versus United States, for instance, or Singapore versus Canada. The structure is flexible, but the comparative discipline remains constant.
Contrasting Ai Governance Philosophies
One of the most illuminating aspects of the AI Governance World Cup is the way it exposes differences in regulatory philosophy.
Leading in Uncertainty: Cyber Resilience Leadership
RICHARD PREECE
In cyber security, leadership has always mattered. Now it matters differently. In a world shaped by geopolitical tension, technological acceleration and deep interdependence, the real challenge is no longer just protection. It is adaptation.
Cyber security has always been a leadership challenge disguised as a technical one. That is even more obvious now.
We are operating in a world defined by overlapping pressures: geopolitical competition, economic strain, technological disruption, threatened physical and digital supply chains and growing social distrust. In that environment, cyber risk cannot be treated as a standalone technical issue. It sits inside a much broader system of dependencies and vulnerabilities.
That changes the job of leadership
The old model was built for a more stable world. Leaders were expected to assess the landscape, set direction, assign responsibilities and drive execution through relatively clear structures. Now the situation has changed, it is no longer enough. In conditions of persistent uncertainty at the technical, operational and strategic levels, leadership cannot just be about setting a plan and holding the line. It must be about sensing change, interpreting what matters and adapting in time.
That may be uncomfortable for some organisations and individuals, because it forces a conversation about what leadership is and how it needs to evolve.
At its core, leadership is about personal power: the ability to win the hearts and minds of others in pursuit of a common purpose. In practice, that means aligning people, often under pressure, cutting through friction and confusion. Ultimately helping organisations move forward when the facts are incomplete and the situation is changing. Cybersecurity and technology professionals are in many ways at the centre of this; it is the job!
Uncertainty is no longer temporary
There is a temptation to treat uncertainty as a passing phase, something to be endured until conditions settle down. That is wishful thinking.
We are living through a structural shift. The assumptions that shaped the post-Cold War era are under strain. Strategic competition is reshaping trade, investment and supply chains. AI is moving fast and quantum computing is just around the corner! Digital dependency is deepening and the boundary between physical and digital infrastructure is becoming harder to separate. Energy systems, water, communications networks, cloud services, semiconductors and data infrastructure supply chains are now tightly entangled.
That matters because cyberspace does not operate in isolation from any of it, it cuts across it all!
Take AI. It is often discussed as though it exists purely in software; it is not. It depends on data centres, power generation, cooling, telecommunications, advanced chips and scarce technical talent. So, the cyber question is not just about securing models or data. It is also about resilience in energy, supply chains, infrastructure and geopolitics. Once seen through that perspective, cyber resilience leadership looks less like a specialist technical function and more like a key contributor to strategy and operations.
That is where many organisations still fall short. They continue to treat cyber as a technical or compliance issue rather than as part of a wider system of organisational resilience. That is neat for org charts and for those used to a more stable, certain, simple and clear world! But it doesn’t reflect reality!
Chief Training Officer at OSP Cyber Academy
Why the leadership model has to evolve
A great deal of leadership culture still rests on a flawed assumption: that leaders are supposed to provide certainty. They are not.
In volatile, uncertain and complex conditions, the pretence of certainty is usually a liability. It narrows the range of views that reach senior decisionmakers, discourages challenge and makes adaptation harder when reality breaks the often-implicit assumptions and biases we all have. Leaders who act as though they already know the answer often create brittle organisations, especially in cyber where threat, technology and context can all move at once. This is a team of teams’ endeavour.
A better approach starts with intellectual honesty. Leaders need enough confidence to say what they do not know. That is not weakness. It is the basis of better feedback and judgment.
From there, the task is to create conditions in which foresight, insight and hindsight can all emerge from across the organisation. Useful signals do not arrive only through formal hierarchy. They may come from engineers, operations teams, risk specialists, frontline staff, external partners or suppliers. If an organisation only listens upwards, or only listens to the same familiar voices, it can miss what matters.
Managing by walking about is still vital, but in the age of Zoom calls, outsourcing, etc, the channels of communication maybe different!
This is not an argument for endless consultation or soft indecision. It is an argument for stronger leadership built on better inputs. Leaders still must decide. They still must take responsibility. But the quality of those decisions depends heavily on whether the organisation is structured to anticipate and surface reality rather than suppress it.
Strategy is now about adaptability
In uncertain times, perhaps the most important strategic capability now is adaptation.
That does not mean abandoning direction or becoming reactive. It means designing organisations that can anticipate, absorb and adapt. It means building flexibility into decision-making, governance, operations and crisis response. It means shortening feedback loops to detect, learn and adjust faster.
Technology teams have understood this for years. The best agile methods were built around a simple point: learning from feedback matters more than rigid planning. The mistake many organisations make is confining that principle to software delivery. The same logic applies much more widely. Leaders should be asking how to build rapid learning into operations, resilience planning, risk management and executive decisionmaking.
That is especially important in cyber resilience, where assumptions can mask vulnerabilities.
The value of scenarios
This is where scenario thinking becomes genuinely useful.
Scenarios are often misunderstood as prediction exercises. They are not. Used properly, they are a way of stress-testing assumptions against multiple severe/ extreme but plausible futures.
That matters because many organisations are built around hidden assumptions they rarely examine. Assumptions about stable suppliers, affordable energy, regulation, available skills, trusted partners or predictable escalation paths in a crisis. Scenarios force leaders to test where those assumptions break and what the consequences would be.
Many organisations have plans for what to do in a disruption or cyber incident. But these are mere arrangements, until the capability and capacity to respond and recover under severe but plausible scenarios has been tested. They may lack decision speed, operational bandwidth, technical depth, or the ability to communicate and coordinate effectively across silos.
Culture is a hard issue
If adaptation is the goal, culture matters far more than many leaders admit.
If leaders want adaptability, they need cultures where people can speak candidly, question assumptions and recover quickly from setbacks. That does not mean lowering standards. Quite the reverse. It means creating an environment where realism is valued. Otherwise, problems are often hidden, weak signals ignored and teams become less capable of clear thinking under pressure.
In uncertain conditions, silence gets filled by rumour and poor communication gets filled by cynicism and fear. People do not need false reassurance. They do need clarity about what is happening, why decisions are being made and what may need to change next. Credibility comes not from pretending to control everything, but from showing that leadership is engaging honestly with reality.
What cyber leaders need to do now
For cyber leaders, the implication is clear. Not to pretend uncertainty can be eliminated; it cannot. The point is to lead through it more effectively. The role still requires the securing of systems, assurance of compliance and respond to incidents. But increasingly to help organisations navigate an environment in which technology, business strategy and geopolitical context are all moving at once.
Be willing to challenge narrow definitions of cyber risk. Look beyond the network to the dependencies that make the organisation function. Build structures that allow information and intelligence to flow across silos. Use scenarios to test assumptions. Develop people who can apply principles (desired outcomes) to context, not just verify compliance with controls. Finally, when decisions are needed, take them with clarity and be ready to review them, when the situation changes.
That demands leaders who are more curious, humble, strategic and adaptive.
SCAN ME
SCOTLAND’S AI STRATEGY 2026 - 2031
A Leadership Guide for Adopting Scotland’s National AI Strategy This executive summary details Scotland’s AI Strategy 2026-2031 into the essential considerations that leaders across business, public services and academia must understand and act upon. Scotland’s ambition is clear: to harness the potential of AI to drive responsible and inclusive growth across our economy and make a positive difference at every level of society.
Why Leaders Must Act Now
Scotland has helped to shape the modern world. For a small country on the edge of Europe, we have long been at the centre of innovation and new inventions.
We have a proud history of leading scientific and technological change and our ideas, nurtured to enlightenment by our leading universities and colleges, have revolutionised whole schools of thought leading to breakthroughs in fields as diverse as philosophy, photography and physics.
Now, Artificial Intelligence (or AI) presents an opportunity for Scotland to rekindle that pioneering spirit, to lead instead of follow and, by doing so, to harness AI’s potential for responsible, transformative economic growth. “
AI is the great disruptor, re-shaping industries through the power of machine learning – but, as Scots, we have always been comfortable on frontiers.”
Secure the benefits of AI for everyone in Scotland.
That means boosting our economy, closing the productivity gap and driving innovation while also supporting improvement to our health and education outcomes and increasing the efficiency and quality of our public services.
At the same time, we must recognise the wider risks and uncertainties that come with the rapid evolution of AI. People are rightly concerned about transparency, fairness, the impact on jobs and the accelerating pace of change.
Scotland’s response is to address these issues openly and responsibly, demonstrating that progress and safeguards can go hand in hand. Above all, our approach to AI must be firmly rooted in our values and guided by the Scottish Government’s commitment to Fair Work.
Scotland’s Unique AI Strengths: What Leaders Must Leverage
Leaders adopting this strategy must understand the exceptional foundations Scotland already possesses. These are not aspirational for they are live, competitive assets that underpin the entire strategy.
World-Leading AI Pioneers
Scotland’s long association with visionary leaders in AI from Geoffrey Hinton (Nobel Prize, 2024) to Amanda Askell (co-author of GPT3) demonstrates the strength of our academic and research institutions and their ability to attract the finest minds.
World-Leading AI Research
Five Scottish universities were placed in the UK’s top 30 for AI research output in 2025. Edinburgh hosts ARCHER2, the UK’s national supercomputer, and will host the new £750 million UK National Supercomputing Centre. The National Robotarium at Heriot-Watt is driving breakthroughs in medical and offshore robotics.
Renewable Energy Advantage
In 2024 alone, Scotland produced 38.4 TWh of renewable electricity the highest annual total ever recorded, a 13.2% increase on the year before. There is 26.4 GW of new renewable capacity in planning or consented pipelines, one of the largest in Europe relative to population.
Business Leadership & Investment
Scotland is home to an estimated 296 AI-focused companies. The first AI Growth Zone in North Lanarkshire is backed by over £8 billion of private investment and is set to deliver more than 3,400 new jobs. A £15 billion AI Pathfinder Investment in North Ayrshire will create one of Europe’s most significant AI infrastructure developments.
The Strategic Imperative: Why Leaders Cannot Wait.
Artificial intelligence is advancing rapidly and offers enormous economic potential. Leaders must internalise the urgency of this moment.
Economic Opportunity Rapid developments in agentic and autonomous AI show how quickly new capabilities are emerging. Adoption remains uneven and Scotland must act to close the gap.
Public Services Pressure
Demand for public services is rising amid tightening public finances. AI has already shown promise in enabling preventative approaches, improving planning, reducing costs and supporting frontline decision-making.
Data Governance
Scotland’s public sector data is often fragmented and difficult to access. Improving data sharing and governance is essential to support safer, more effective services and research.
Global Competition
A worldwide innovation race is underway. Emerging international standards including the OECD AI principles and the EU AI Act are shaping expectations of fairness, transparency and safety.
Scotland must act now to ensure that AI is introduced in ways that are safe, fair and focused on public benefit. This Strategy sets out how Scotland will do this, harnessing the potential of responsible AI to improve outcomes across our economy and at every level in our society.
The Four Outcomes Leaders Must Deliver By 2031
The Scottish Government has defined a clear and ambitious purpose for this Strategy: to harness the potential of AI to drive responsible and inclusive growth across our economy and make a positive difference at every level of society. Leaders must orient their organisations around four outcome areas.
It’s Only Data.. Until It Isn’t
Why organisations must rethink their approach to data protection
By Irene Coyle, Data Protection Officer
Trust
Many organisations believe data protection is about policies, registers and regulatory compliance. In reality, it is about something far more fundamental: trust. When organisations mishandle personal data, the real damage is not just operational or financial – it is the loss of confidence from the people whose information they hold. But as a data governance specialist I believe data protection is not about documentation. It is about trust, leadership and understanding the real value of the data organisations hold.
There is one phrase I often use when explaining the importance of data protection to leadership teams:
“It’s only data... until it isn’t.”
From Policing to Data Governance
My perspective on data protection was shaped during a 30-year career with Police Scotland, where handling sensitive information was an everyday responsibility.
“We’ve Never had a Breach”
Data protection often suffers from an image problem.
For many organisations, it still feels like an administrative task – something to be documented, filed away and revisited only when a regulator asks questions.
Policies are written, registers are completed and GDPR compliance boxes are ticked. But this mindset fundamentally misunderstands the purpose of data protection.
It is not simply about compliance. It is about trust.
Over three decades working in policing and now as Chief Operating Officer at OSP Cyber Academy, I’ve seen how organisations approach sensitive information – and more importantly, how quickly the consequences appear when that information is mishandled.
Much of that work involved developing systems and processes designed to protect highly sensitive personal data. One initiative I was involved in was the creation of a vulnerable persons database – designed to support individuals who required additional protection and safeguarding.
Working with information of that nature quickly changes how you view data.
You realise that data is never just a record in a system. Behind every data entry is a real person – someone whose safety, privacy or wellbeing could be affected if that information is mishandled.
Later in my policing career, I was responsible for implementing GDPR across the recruitment function. It was a fascinating challenge because it highlighted how many organisations initially see data protection as a purely legal or administrative requirement. In reality, it is far more than that.
One of the most common questions organisations ask about data protection is also one of the most revealing:
“We’ve never had a breach – so why do we need to invest in this?”
At first glance, that may seem like a reasonable question. When nothing has gone wrong, data protection can feel abstract. It can appear procedural, even bureaucratic.
But data protection should never be about waiting for something to go wrong.
It is about understanding the value of the data your organisation holds.
Every organisation processes personal data – employee records, payroll information, customer data, contracts, supplier details and more. That information represents something incredibly important: trust.
And trust is something organisations build carefully over time but can lose very quickly.
It’s Only Data.. Until It Isn’t
Another common misconception is that organisations assume they are unlikely targets for cyber-attacks. But many breaches do not originate from direct attacks at all.
They come through third-party suppliers, partners or inherited systems.
So even if an organisation believes it is unlikely to be targeted, it must still consider the broader ecosystem surrounding its data.
Ultimately, data protection is about foresight. I always ask “If your systems were disrupted tomorrow, would you know which data matters most?” and “would your team know what to do in the first critical hour?”
Data Protection is Not Just GDPR paperwork
Another persistent myth is that data protection is primarily about documentation.
Policies, procedures and compliance frameworks are important. But documentation alone does not protect data. Data protection is fundamentally about how organisations think and behave when handling information.
The questions organisations should really be asking are practical ones:
• What data do we hold?
• Why do we hold it?
• Where is it stored?
• Who is responsible for it?
Many organisations proudly point to the policies they have in place with a big smile on their face. But policies that sit unread in folders or shared drives provide very little protection.
“Policies don’t protect data – people do.”
That is why structured training is so important. When staff understand how data flows through their organisation, how breaches occur and when to escalate concerns, the conversation moves from theory to practice.
Recognised training programmes –particularly those aligned with frameworks such as National Cyber Security Centre (NCSC) guidance – help organisations build real capability.
They help people recognise early warning signs of incidents, understand lawful data processing and embed accountability across the organisation.
Most importantly, they help leaders move beyond compliance towards competence.
The Real Risk isn’t the Fine
When organisations think about the consequences of data breaches, the discussion often centres on regulatory fines.
While financial penalties can be significant, they are rarely the most damaging outcome.
Reputation is. When personal data is mishandled, the message people hear is not about the size of a regulatory fine. The message they hear is much simpler:
“You didn’t protect me.”
That perception affects confidence from customers, employees and partners alike. Trust is therefore a leadership issue.
Data protection cannot be seen as solely the responsibility of the Data Protection Officer. That would be the equivalent of saying cyber security is solely the responsibility of the IT department.
Neither assumption is true.
Protecting data requires awareness and accountability across the entire organisation.
When Human Error Causes a Crisis
Many high-profile breaches are associated with sophisticated cyber-attacks. Yet some of the most damaging incidents arise from far simpler causes.
Human error remains one of the most common contributors to data breaches.
A recent example involved the inadvertent publication of personal information relating to approximately 9,400 police officers and staff in Northern Ireland. The data was mistakenly disclosed through a Freedom of Information response.
The incident was not malicious. But the consequences were severe.
Thousands of individuals were exposed, legal action followed and the PSNI faced intense public scrutiny.
It highlights an important reality: many breaches are not the result of malicious intent, but simple mistakes made by people who do not fully understand the risks.
The Importance of Knowing Where Your Data is
Understanding where organisational data resides is one of the most critical aspects of effective protection.
Without visibility, organisations cannot properly secure their information.
A well-known example illustrates this risk.
In 2018, Marriott International disclosed a breach affecting approximately 339 million guest records worldwide. The intrusion originated from a booking system belonging to Starwood Hotels – a company Marriott had acquired several years earlier.
Attackers had already gained access to the system before the acquisition and remained undetected.
When regulators investigated, the issue was not just the cyber intrusion itself. It was the due diligence surrounding the systems Marriott had inherited.
The organisation had not fully assessed the personal data stored within those systems.
The result was a regulatory fine of over £18 million and widespread reputational damage.
The lesson is simple:
“You cannot protect what you cannot see.” Data mapping is not merely administrative work. It is about gaining visibility of where risk exists within the organisation.
Without that visibility, organisations are effectively operating with blind spots.
And blind spots are where risk quietly grows.
Three Priorities for Leaders
For leaders trying to strengthen their organisation’s approach to data protection, the starting point does not need to be complicated.
In fact, it can be distilled into three priorities.
Clarity
Leaders must understand what data their organisation holds and how it flows across systems, departments and external partners.
Accountability
Responsibility for data must be clearly owned rather than assumed.
Culture
Many breaches arise from simple behavioural issues – an email sent to the wrong recipient, an incorrect spreadsheet attachment or access rights not removed when someone leaves the organisation.
These are not technology failures.
They are awareness failures.
When people understand why data matters, behaviour changes.
And when leadership supports structured training and governance, the organisation becomes both more competent and more confident in its data protection practices.
Preparation, Not Perfection
Data protection can feel overwhelming for organisations. But it should not be about achieving perfection. It should be about preparation.
Behind every data record is a person – a colleague, customer or member of the public. When that information is mishandled, what is damaged is not just data.
It is trust.
The reassuring reality is that many incidents are preventable through simple governance measures: visibility, accountability, training and leadership oversight.
When those elements are in place, good governance should actually feel uneventful.
And that is exactly how it should be. Because the real goal of effective data protection is not headlines. It is steady confidence.
After all: It’s only data.. until it isn’t.
Author:
Irene Coyle is Chief Operating Officer at OSP Cyber Academy and a cyber resilience and data protection specialist with over 30 years’ experience in policing, governance and organisational risk management. She works with leadership teams across public and private sectors to strengthen cyber resilience, data protection capability and practical governance.
To
listen to Irene Coyle interview with Scan Me
As AI adoption accelerates, organisations across the UAE and GCC face growing challenges around governance, cyber risk, privacy and regulatory compliance.
OSP Cyber Middle East has officially launched, bringing cyber security & AI governance to organisations across the UAE and wider GCC.
The launch marks an important step for OSP Cyber Academy as it expands its presence into the Middle East, supporting organisations as they respond to a fast-changing digital, regulatory and threat landscape.
With the UAE and GCC continuing to invest heavily in artificial intelligence, smart infrastructure and digital transformation, the need for practical cyber resilience and AI governance has never been greater.
OSP Cyber Middle East has been created to support leaders, boards, executives and teams responsible for managing cyber risk, AI adoption, data protection and organisational resilience. The company will provide awareness training, strategic learning programmes, cyber exercises, AI governance education and practical support for organisations looking to strengthen their approach to digital risk.
A key part of the launch is the introduction of AI Strategy Essentials for Executives, a short video series designed to give senior leaders a clear and accessible overview of the issues shaping AI governance in the UAE and GCC. The series explores how AI is already influencing decisionmaking, why human oversight matters, where accountability sits, and what practical first steps leaders can take to put effective controls in place.
Rather than treating AI purely as a technology issue, the series frames AI governance as a leadership responsibility. It highlights the importance of understanding not only what AI systems can do, but who remains accountable for the outcomes they create.
The launch builds on OSP Cyber Academy’s established experience in cyber security training, awareness, data protection and resilience exercises. By bringing that expertise into the Middle East, OSP Cyber Middle East aims to support a region already recognised for its digital ambition.
As AI adoption accelerates, organisations across the region face growing questions around regulation, ethics, cyber risk, privacy and operational control.
OSP Cyber Middle East will help organisations move from awareness to action, giving them the knowledge and confidence to embrace innovation while maintaining strong governance and resilience.
The AI Strategy Essentials for Executives video series is now available through the OSP Cyber Middle East website. Find out more: https://ospcyber.ae/ or contact: info@ospcyber.ae
Control Through Access: Rethinking Cybersecurity in Emerging Technology Systems
Espionage draws value from access to confidential knowledge during research, design, and early development, when technologies remain inside controlled environments and knowledge remains concentrated among a relatively small group of actors.
Advanced technologies often take shape well before public deployment through a combination of technical choices, legal arrangements, investment structures, supply-chain design, and strategic decisions that influence their development, transfer, and use. I work inside that terrain, at the intersection of international business law, emerging technologies, and national security, with a focus on cross-border transactions, technology transfer, and export control.
Experience in space-related and advanced technology matters sharpened that perspective early, because strategic capabilities move across jurisdictions through legal structures long before they appear as finished systems. Cybersecurity therefore appears in my work as a structural issue. It is present in the way access is granted, in the way data flows are organised, and in the way trust is operationalised between actors who operate under different regulatory and geopolitical conditions. Law, capital, and technology meet at the point where access is defined, and that point carries enormous consequences for how exposure develops across the life of a system.
Access defines exposure from the outset. Legal and operational arrangements structure access to technological systems, define information exposure, and determine how that exposure develops through ongoing engagement. Partnerships, supply chains, investment structures, licensing terms, joint development arrangements, and procurement pathways all shape the access architecture around a system. Contracts sit at the center of that architecture because contracts distribute rights, responsibilities, interfaces, and permissions.
Cross-border collaborations make that dynamic especially important because each additional layer of operational integration can produce another layer of visibility. Early visibility influences capability development, market timing, procurement decisions, and competitive positioning. Advantage forms where knowledge is most concentrated, and timing strengthens that advantage as technology moves toward deployment.
Technical safeguards come afterward. By the time a technical control is installed, access may already have been widened through the design of the relationship itself. My work repeatedly returns to that point. Due diligence, in this context, functions as a security discipline in substance. It requires close attention to counterparties, ownership structures, technology pathways, data handling arrangements, export-control implications, and the operational meaning of proximity. Exposure follows the structure of access throughout the system lifecycle. Systems carry that exposure forward as they mature, scale, and connect to other systems.
Cybersecurity discourse often concentrates on attacks, breaches, and resilience. A significant part of my work focuses on risk mitigation and due diligence within legal and operational structures, where exposure is shaped through access configuration, technology transfer, supplychain integration, and information visibility, and where cyber espionage represents one of the most consequential manifestations of that structure. Espionage draws value from access to confidential knowledge during research, design, and early development, when technologies remain inside controlled environments and knowledge remains concentrated among a relatively small group of actors. Advanced research, proprietary technologies, trade secrets, internal communications, design parameters, and emerging capability roadmaps form the real terrain.
Visibility at that stage gives insight into direction. It reveals how systems are being built, how priorities are evolving, which capabilities are receiving investment, and where strategic intent is taking shape.
A further dimension appears when attention shifts from immediate-value information to information that retains significance across extended periods. Strategic communications, national securityrelated data, and confidential financial and strategic information that reflect how capital, resources, and capabilities are organised over time belong in that category. Investment portfolios and allocation strategies provide insight into how capital is positioned, where priority sectors are emerging, how future actions are structured, and which capabilities are expected to receive sustained backing. Financial positioning retains its relevance within this dynamic, as it reflects future decisions that unfold over time. Strategic communications carry a similar significance because they reveal how institutions frame decisions and sequence action. Value persists across time because the decisions embedded in such information unfold across time.
Time therefore becomes part of the exposure structure. Within cybersecurity and intelligence communities, the phrase “store now, decrypt later” captures a straightforward logic: encrypted information acquired in the present can retain strategic value as computational capability evolves. Data is preserved with the expectation that access conditions will change. Early access and future capability become linked through a single timeline.
Quantum computing defines that trajectory. Cryptographically relevant quantum computers influence the assumptions on which current encryption systems rely across financial systems, government communications, critical infrastructure, and many forms of protected data exchange. Contemporary cryptographic schemes rest on computational conditions that define what counts as secure in the present. Quantum capability changes those conditions. Protection therefore becomes a question of duration. Confidentiality depends on how long encryption remains effective as computational capability develops.
The sequence remains continuous: access takes place early, encryption preserves content under current conditions, and computational capability changes the duration of that protection.Cyber espionage and quantum cybersecurity operate across the same lifecycle, linking how access is structured with how protection holds over time. Post-quantum cryptography enters here as a planning and implementation priority, because the transition touches infrastructure, standards, procurement cycles, system inventories, and institutional capability. Quantum communication also matters within this landscape, since communication integrity and secure transmission remain central to trust across distributed systems. Quantum sensing broadens the picture further by bringing additional strategic implications into navigation, timing, detection, and broader operational environments.
As computational capability evolves, the conditions that sustain that protection evolve as well, which influences how previously collected encrypted data can be accessed over time. The structure of access and the evolution of capability therefore remain connected throughout the lifecycle of the system, and managing that connection requires attention to the frameworks that govern how technologies and data are controlled in practice. Legal and regulatory structures sit directly within this transition. They remain inseparable from how advanced technologies are accessed, transferred, and integrated into operational systems, and their effect becomes visible through the way access, control, and data movement are organised across those systems.
Contracts define who can access specific technologies and data, how that access is exercised, and under which operational conditions interactions take place, while data governance frameworks determine how information is stored, processed, and shared across interconnected environments.
Further, compliance requirements and export control regimes introduce jurisdictional constraints that regulate which actors may access particular capabilities and under what conditions, and technology transfer rules further shape how technical knowledge, software, and hardware move between entities and across borders. These layers operate together, and alignment between them determines whether access, control, and system behaviour remain coherent as technologies evolve.
Divergence across these layers creates inconsistencies in how access is implemented and enforced, and exposure develops within those inconsistencies, carrying forward into system
This structure becomes more complex in environments where the same underlying technologies are used across both civilian and security contexts. Civilian frameworks define access through regulatory requirements, accountability standards, and controlled deployment conditions, while security and defence applications follow strategic priorities linked to national interests and operational objectives. The same technology can therefore be subject to one set of access conditions in a regulated environment and a different set of conditions in a security-driven context, even though its technical properties remain unchanged. Governance operates across these conditions, shaped by how technologies are used in practice.
Questions of control, proportionality, and state interest arise at this intersection, shaping how access is granted, restricted, and exercised across jurisdictions and operational environments.
At this point “readiness” becomes the point where all of these threads converge. Technological change accelerates quickly. Institutional adaptation follows a longer timetable. My own work in this area has focused on narrowing that distance through initiatives designed to connect awareness, governance, capability development, and practical adoption. Since 2020, that effort has taken shape through the Quantum Technology Adoption Program and through platforms such as the Quantum Innovation Summit, where policymakers, regulators, researchers, cybersecurity actors, investors, and industry leaders can engage the same questions from different operational positions. Applied work matters because abstract awareness rarely shifts institutions on its own. Real readiness grows through foresight, governance, planning, and action. Maritime use cases, logistics challenges, and infrastructure applications show how the discussion moves from theory into implementation, where institutions can evaluate genuine operational value, identify bottlenecks, and prepare transitions in a way that reflects real conditions.
Trabelsi Leob Founder and President, Vernewell Group Inc., Dubai,
Emerging technologies reshape how systems are built, how information moves, and how control is exercised across digital environments. Cybersecurity evolves within that same movement, shaped by how institutions structure access and align with technological change as it unfolds. Staying ahead in this environment requires a structured approach. It begins with foresight, understanding where technological capability is heading and how it will influence existing systems. It requires governance, ensuring that development and deployment take place within frameworks that support trust and control. It depends on planning, translating that understanding into concrete strategies and operational pathways. It is completed through action, where those strategies are implemented and sustained. Institutions that move through this sequence early position themselves at the front of the curve. Institutions that move through this sequence early position themselves at the front of the curve and define how cybersecurity is applied within emerging technologies.
Interview with Malak Trabelsi Leob:
Malak
UAE
HYBRID EVENT PLATFORM HYBRID EVENT PLATFORM
Bridging Science, Sovereignty, and Scale
Bridging Science, Sovereignty, and Scale
The global platform for quantum The global platform for quantum and emerging technologies and emerging technologies
Grand Hyatt Dubai Conference & Exhibition Centre, UAE 28-30 SEP 2026
Organized By Media Partner
From Shadow AI to Structured Governance:
How Enterprises Are Balancing Innovation and Risk
The Urgent Shift to AI Governance
Enterprises are moving from ad hoc AI usage to structured, risk-aware governance. This shift is essential because with every powerful new technology come both opportunities and challenges. The real focus is on how organizations can introduce and manage AI with proper controls—without killing innovation.
How AI Adoption Evolved from Ad Hoc to Structured
AI has been around for some time, particularly through machine learning, but its recent explosion has transformed how organizations operate and how people work and live. The COVID-19 pandemic accelerated this by forcing a shift from office-based to remote and hybrid workforces, creating tremendous pressure on enterprises to adapt quickly.
Initially, AI adoption was largely ad hoc. Different departments identified promising use cases—often through SaaS features or simple pilots—and implemented them without formal governance processes. This shadow AI mirrored the early days of digital transformation around 2014–2015, when organizations rushed to become web- and mobile-based for competitiveness and customer interaction. Big data and data science followed, but AI’s rapid spread created new complexities.
Big data and data science followed, but AI’s rapid spread created new complexities. Over the past year and a half, organizations have begun moving from shadow AI to formal governance.
This includes establishing clear AI usage policies, frameworks for responsible and ethical use of AI, high-level AI steering committees, and comprehensive AI inventories. These inventories help organizations stay on top of all AI use cases and track how they evolve.
Different organizations are at varying levels of maturity. Some have well-defined AI governance committees with clear criteria for acceptable and unacceptable use, while others are still catching up. In the UAE, government entities are setting a high bar by taking serious control over AI governance, recognizing the significant risks of uncontrolled deployment.
From Model-Centric to RiskCentric Governance
A key evolution is the shift from model-centric to risk-centric governance. In the model-centric approach, enterprises focused narrowly on the AI model itself and the specific use case— primarily its accuracy and business value. They often lacked a full picture of the overall risk the organization faced when deploying that system.
The risk-centric approach is more holistic and mature. It asks critical questions: Even if the model delivers good return on investment and measurable value, how much risk does it expose the organization to? This includes responsibility, ethics, respect for individual privacy, the nature of training data, and broader implications.
Higher-maturity organizations are adopting this perspective to address not just technical performance but also privacy, bias, and societal impact.
Embedding Governance by Design
Another major change is moving from bolt-on governance to embedded governance. In cybersecurity’s early days, security was often an afterthought— approached just before go-live as a simple checkbox. The industry matured to “secure by design,” involving security professionals from day zero.
AI governance is following the same journey. Mature organizations now speak of “ethical by design” or “responsible by design.” Governance teams get involved right from the start, even as models are being trained. They ensure data is responsibly sourced, does not violate privacy, and has proper approvals from data subjects. This embedding integrates AI governance into existing mechanisms such as project and change management, third-party risk, data governance, security, and privacy-by-design.
From Shadow AI to Structured Governance:
How Enterprises Are Balancing Innovation and Risk
The result is a more scalable process that supports rather than blocks business initiatives.
Achieving Visibility Through AI Inventory
Visibility is foundational to effective governance. Many organizations still lack a reliable map of where AI is being used, including capabilities hidden inside vendor tools.
Without a solid AI inventory, governance remains reactive.
Inventory is the number one critical factor in any governance initiative. Standards like ISO 27001, ISO 42001, and others all begin with asset management for good reason.
For AI, however, visibility is more complex than traditional IT systems. An AI system can draw data from dozens of sources, involve multiple training layers, and include intricate processes.
Many organizations are adopting a Configuration Management Database (CMDB) approach to AI— breaking systems down into layers and components, each with subelements, to ensure every part is secure, respects privacy, and meets ethical standards. This granular view enables better monitoring and control.
Clarifying Roles, Responsibilities, and Decision Rights
AI’s complexity also complicates roles and ownership. Traditional IT systems had clear business owners and system owners. With AI, ecosystemvernance bypasses as teams seek workarounds
Best practice is to break down roles and responsibilities with high granularity.
Some responsibilities may be shared, requiring primary and secondary owners. The AI Steering Committee provides high-level oversight.
Organizations that invest time in clearly documenting these elements build stronger, more effective AI governance frameworks.
Balancing Control with Innovation
Striking the right balance between control and innovation remains challenging. Too much control restricts experimentation and drives shadow AI. Too little exposes the enterprise to regulatory, ethical, security, and reputational risks.
The EU AI Act aims to achieve this balance by focusing on risk levels.
Principal Information Security Officer at the Ministry of Energy & Infrastructure
Vijay Velayutham
Use cases with minimal business impact can have lighter oversight, while those affecting individuals’ health, job performance, recruitment decisions, or societal outcomes require stricter controls, greater explainability, and accountability.
Tiered approaches—fast, lowfriction paths for low-risk uses and rigorous oversight for high-risk applications—help maintain agility while managing exposure.
The Growing Need for Technical Depth and Explainability
Technical depth is increasingly important. Governance bodies must address explainability, bias, adversarial risks, model drift, and robustness.
Explainability means the ability to trace an AI system’s decisions back to specific data inputs and criteria.
For instance, if AI scores job candidates or evaluates employee performance, the organization should later explain exactly why a particular score was assigned.
This technical area brings together machine learning, data privacy, programming, and governance. Governance committees and even boards will increasingly need members with technical understanding of AI. Without it, a gap emerges between governance expertise and technological reality. Future regulations may mandate such expertise at the highest levels.
Leadership and the Path Forward
As AI permeates every part of enterprise operations, leaders must deepen their understanding of its benefits and risks. Education is essential so executives can oversee how AI is used, controlled, and governed ethically while remaining aware of potential pitfalls.
The journey from shadow AI to structured, risk-aware governance is well underway. Organizations that embed responsible practices, maintain strong visibility, clarify roles, and balance innovation with control will be best positioned to harness AI’s advantages sustainably and ethically.
Effective AI governance is not about slowing progress. It is about enabling trustworthy, responsible advancement in the AI era.
About Vijay Velayutham:
Vijay Velayutham heads Governance, Risk Management and Compliance for the Ministry of Energy and Infrastructure in the UAE. Previously, he led the same function for the Smart Dubai platform and its Big Data platform. With 25 years in technology, including 19 years in cybersecurity spanning operations, security monitoring, incident response, and now risk management and governance, Vijay Velayutham has witnessed multiple waves of technological and cybersecurity change.
SCAN ME
Watch our exclusive pod cast Interview with Vijay Velayutham
