Cloud services and AI applications have changed how organisations approach cybersecurity. As employees and automated services access information across different environments, protecting a single network boundary is no longer sufficient. 

Enterprises must maintain control without introducing security measures that make legitimate work unnecessarily difficult. 

The National Cyber Security Centre (NCSC) identifies understanding an organisation's architecture as a foundation of Zero Trust security. That requires knowing which systems are operating, where sensitive information is held, and how access is managed. 

Discussions at Tech Show London explored what this means in practice, particularly as AI systems gain greater autonomy and organisations face pressure to balance security with operational efficiency. 

Visibility Starts With Understanding the Data 

Before introducing new controls, organisations need to establish what they are protecting. 

During Hype to Hard Truths: Aligning AI Adoption with Data Security at Tech Show London, a Netskope speaker outlined an approach beginning with data discovery and classification, followed by controls governing how information is accessed. 

The session also examined data lineage, which allows organisations to trace information as it moves between systems. 

"Don't let the connected AI know more about the data than you do," the speaker warned. 

The point becomes particularly relevant when businesses connect internal information to AI applications. Without visibility into what those systems can retrieve, organisations may struggle to establish appropriate permissions. Investigating an exposure also becomes harder when the movement of information is poorly understood. 

The NCSC's architecture guidance similarly emphasises understanding data location and sensitivity before developing access policies. 

For enterprises, that makes visibility an important starting point before expanding access to new applications. 

Identity Determines What Systems Can Do 

Knowing what exists is only useful if organisations can also control who or what interacts with it. 

The AI, Humanity & Security: Protecting Trust in an Autonomous Digital World panel at Tech Show London discussed the limitations of relying on static identity assumptions as technology becomes more autonomous. 

Traditional access controls often focus on employees. Connected environments also involve software services, while AI agents introduce systems capable of carrying out tasks with limited human intervention. 

The NCSC's identity guidance has recognised that identities can represent people, services, or devices. It recommends least-privilege access, where permissions are restricted to what is required for an intended function. 

For AI agents, this raises a further question: what should the system be allowed to do? 

An agent may have permission to retrieve information for a legitimate task, but that should not automatically give it authority to modify records or share the information externally. 

Successful authentication establishes identity. It does not remove the need to control subsequent actions. 

Recovery Matters When Prevention Fails 

Even well-designed security controls cannot eliminate the possibility of compromise. 

During the session Ransomware 3.0, The Duality of AI, and Front-Line Lessons That Are Working for CISOs at Tech Show London, speakers discussed the importance of protecting the systems organisations depend on for recovery. 

Immutable backups can prevent stored recovery copies from being altered. However, the session highlighted the risk of overlooking the identities controlling access to those systems. 

If an attacker compromise privileged credentials, recovery arrangements may remain vulnerable despite the presence of protected backups. 

The discussion emphasised identity isolation and practical recovery exercises. Testing provides evidence of whether an organisation can restore operations following an incident, rather than relying solely on the existence of a recovery plan. 

A related point emerged during Keith Poyser's Your Security Data & KPIs are Lying to You: CTEM Through the Attacker’s Lens session, which questioned whether vulnerability counts alone provide a useful measure of exposure. 

A long list of weaknesses tells security teams relatively little about which could cause serious disruption. Understanding whether a vulnerability is exploitable, and what it could expose, provides a stronger basis for prioritising remediation. 

Security Controls Must Support Legitimate Work 

The AI, Humanity & Security: Protecting Trust in an Autonomous Digital World panel also considered how organisations can introduce safeguards without preventing employees from using emerging technologies. 

One approach discussed was creating controlled environments for experimentation. Employees could explore AI capabilities without being given unrestricted access to production systems or sensitive information. 

The NCSC's authentication guidance has also recognised that strong authentication need not come at the expense of usability. Risk-based approaches can adjust the level of verification required according to the circumstances of an access request. 

The challenge is deciding when additional verification is justified. An employee accessing a familiar application under normal conditions may require a different level of scrutiny from an unfamiliar device attempting to retrieve sensitive information. 

This is where the discussion around enabling experimentation becomes relevant. Rather than restricting access to new technologies across the organisation, security teams can establish controlled environments where employees can test AI applications without exposing production systems. 

For businesses, the value of these approaches depends on how well security controls reflect the risks associated with an activity. Repeatedly interrupting legitimate work can create friction without necessarily improving protection. 

Building Security Into the Connected Enterprise 

The Tech Show London sessions showed how connected infrastructure changes the demands placed on security teams. Visibility into data becomes more important as AI systems gain access to organisational information, while identity controls need to account for automated actions. 

The ransomware discussion added another consideration: organisations must be able to demonstrate that their recovery arrangements will work when needed. 

These requirements also must fit the way people work. Controls that prevent legitimate activity can undermine the purpose of the systems they are intended to protect. 

As enterprise environments become more connected, effective security depends on understanding where intervention is necessary and designing controls that respond to risk without creating avoidable disruption.