Financial Accountant

Gartner Summit day two: Turning AI visibility and exposure findings into action. Knowing where a security problem exists is only the beginning. Organisations also need to understand its significance, decide what to do and give somebody responsibility for completing the work. That challenge connected many of the second-day sessions attended by Integrity360's CTO Richard Ford and Director of Product Management Brian Martin at Gartner's Security and Risk Management Summit. Discussions covered AI governance, Continuous Threat Exposure Management (CTEM), software development and automated security operations. Across these areas, the same dependencies emerged: trustworthy information, business context and clear ownership. Make AI part of enterprise risk management Richard's sessions examined how AI affects applications, employee tools, identities and software delivery. Assessing these risks requires an understanding of how AI changes the speed, reach and potential consequences of existing activities. A narrowly defined assistant presents different requirements from an agent authorised to pursue a broad goal across several systems. Controls should reflect the data involved, the permissions granted and the impact of an incorrect or unauthorised action. Governance therefore needs to cover AI the organisation buys, builds and uses. Cybersecurity, technology, data, privacy, legal and business teams all have responsibilities, with named owners for decisions and outcomes. A self-reported register is a useful starting point, but it may leave gaps. Technical discovery across applications, endpoints, APIs, identities and network activity can provide a more complete picture. That inventory should inform threat modelling so that controls reflect how each system actually operates. Make CTEM deliver a reduction in exposures CTEM helps organisations identify, prioritise and validate exposures, then coordinate action to reduce them. Its value depends on findings progressing into practical changes. Brian's sessions highlighted mobilisation as a persistent challenge. Teams may agree that an exposure matters while still lacking a clear owner, an acceptable remediation route or the authority to schedule the work. Successful mobilisation requires those barriers to be resolved. Someone must accept responsibility, the proposed response must be workable and the organisation must verify that the exposure has been reduced. Brian also highlighted the distinction between validation and post-remediation verification. Validation establishes whether a prioritised exposure is exploitable and consequential before mobilisation. Post-remediation verification checks whether the chosen response worked. Both are necessary, but keeping their purposes clear helps teams apply the right evidence at the right stage. Prioritise using exploitability and business impact The discussions on threat exposure debt challenged reliance on vulnerability counts. The number of findings says little about which weaknesses create meaningful attack opportunities. Reachability, exploitability, asset importance and compensating controls provide a stronger basis for prioritisation. Third-party dependencies also need consideration where a supplier's weakness could create direct organisational exposure. A Bitsight session explored how AI-assisted discovery could shorten the time available to assess and address weaknesses. The practical response is better visibility and a shorter path from validated evidence to action. That context should reach the security operations centre (SOC). An alert affecting a reachable, business-critical system deserves a different response from the same activity on an isolated test asset. Embed security into AI-assisted development Richard and Brian both attended Mark Horvath's session on software development in the age of AI. Coding agents can increase the pace of delivery, making periodic security reviews insufficient on their own. Approved libraries, hardened templates, secure configurations and routine checks can establish safer foundations within the development environment. These measures help developers produce more consistent results without having to resolve every security requirement independently. Applications using AI also need testing for prompt injection, unsafe tool use, information leakage and manipulation of retrieved content or memory. These checks complement established application, API and supply-chain security. Citizen-developed and "vibe-coded" applications make ownership especially important. Code can appear to work while containing weaknesses its creator does not recognise. Human owners remain accountable for testing, release decisions and maintenance, even when AI contributes much of the implementation. Improve SOC data before expanding agent authority Richard's Vectra session examined a fundamental limitation of the agentic SOC: automated investigation cannot compensate for unreliable input. Agents need accurate telemetry and an understanding of the people, devices, workloads and services involved. Asset criticality, exposure information and behavioural history help determine why an event matters and what response is appropriate. Poor context can produce confident conclusions that lack adequate evidence. Improving these foundations should therefore precede decisions to grant agents greater response authority. The quality of automated decisions also requires ongoing review. Tuning remains necessary as environments change, with feedback from analysts helping identify errors and refine the system's behaviour. Treat post-Quantum preparation as infrastructure planning Richard's post-quantum session focused on the practical work involved in migration, including discovery, supplier dependencies and hardware replacement cycles. A focused cryptographic inventory should establish where relevant algorithms and keys are used, what information they protect and how long that information must remain confidential. Planning also needs to account for performance and implementation. Systems may depend on hardware designed for existing algorithms, while migration options may be controlled by vendors or device manufacturers. Understanding these dependencies allows organisations to align preparation with infrastructure refreshes, testing programmes and budgets. Protect the capacity to act Caroline Webb's keynote, attended by Brian, provided a human perspective on the pressure for faster decisions. Judgement, motivation and coordination remain essential as automation takes on more routine work. This applies directly to CTEM and AI adoption. More findings and quicker analysis achieve little when teams lack the capacity to resolve competing priorities or carry changes through. The second day's discussions reinforced the importance of connecting discovery with delivery. Reliable evidence identifies the problem; ownership and coordination determine whether it is addressed. Speak to Integrity360 about using exposure management and security operations to turn findings into measurable improvements. Next in the series: Day three examines detection engineering, agent permissions and the evidence needed to demonstrate security outcomes. Contact Us Frequently Asked Questions What Is the Difference Between CTEM Validation and Verification? Validation assesses whether a prioritised exposure is exploitable and consequential before action is taken. Post-remediation verification checks whether the response successfully reduced that exposure. Why Does an Agentic SOC Need Business Context? Business context helps agents assess the importance of affected systems and the potential impact of an incident or response. Telemetry alone may not reveal whether an asset supports a critical service. Where Should Post-Quantum Planning Begin? Begin with a focused inventory of cryptographic dependencies, protected information and confidentiality requirements. Use it to assess vendor support, hardware implications and likely migration effort. Download its 2026 cyber security trends and predictions guide now!

Integrity360 tackles growing identity security threat with expanded global practice New Identity Services practice brings together more than 90 specialists as human, machine and AI identities become a critical attack surface London, 22 September 2026 - Attackers are increasingly targeting identities rather than attempting to breach infrastructure directly, using stolen credentials, excessive privileges and poorly governed access to reach critical systems and sensitive data. In response to this growing threat, Integrity360 has launched an expanded Identity Services practice to help organisations secure and manage human, machine and AI identities across their businesses. The launch follows Integrity360's acquisition of Identity specialist CyberIAM in August 2026 and brings together the expertise of both businesses into a single global practice. The expanded team now includes more than 90 Identity professionals with over 800 vendor certifications, giving customers access to significant specialist capability across the Identity lifecycle. As organisations adopt more cloud services, automated processes and AI, the number and type of identities requiring access is increasing. These now extend beyond employees and customers to applications, machines and AI agents. Non-human identities can hold extensive privileges, yet may be subject to less rigorous controls than human users. Brian Martin, Director of Product Management at Integrity360, says: "Attackers don't always need to break through the front door anymore. If they can compromise an identity, they can simply log in. That challenge is growing as businesses introduce more applications, machines and AI agents, all of which need the right access and controls." The expanded practice covers Access Management (AM), Privileged Access Management (PAM), Identity Governance and Administration (IGA) and Customer Identity and Access Management (CIAM). It supports organisations from initial assessment and strategy through implementation, expansion and optimisation, to ongoing support and management. Integrity360's Identity practice has more than 10 years of services experience and over 130 successful deployments. Its specialists work across major Identity technologies including Idira (formerly CyberArk), Okta, SailPoint, Ping Identity, BeyondTrust, Microsoft, Saviynt and Strivacity. Its services include Current State Assessments, AI Identity Consultancy, and Bespoke Advisory engagements, as well as implementation, technical support and Managed Identity Services across AM, PAM, IGA and CIAM. Customers can use individual services or work with Integrity360 across the full lifecycle of an Identity programme. Martin continues: "This isn't a capability that exists on paper. Integrity360 has deep Identity expertise and the ability to support customers across the full lifecycle of their Identity programme. "For some, that means understanding where their biggest risks sit. Others need help implementing technology, recovering from a stalled identity rollout, or running their Identity environment over the long term. What matters is giving customers greater control over who and what can access the systems their business depends on." The Identity specialists will also work alongside Integrity360's wider cybersecurity teams, building on long-standing capabilities such as Identity Threat Detection and Response within its Managed Detection and Response (MDR) services. This will help customers connect Identity security with their broader cybersecurity programmes rather than treating it as an isolated technology project. Michael Ribaudo, CEO of CyberIAM, comments: "Joining Integrity360 gives Integrity360 a real opportunity to build on what both businesses already do well for their customers. CyberIAM clients can now access Integrity360's broader security capabilities, while Integrity360 customers gain deeper specialist Identity expertise. "What is particularly exciting is what we can build together. By embedding Identity more closely into Integrity360's existing cyber security services, we can create new services that reflect how customers actually need to protect their businesses. Identity doesn't sit on its own, so the way we secure it shouldn't either." About Integrity360 Integrity360 is one of EMEA's leading cybersecurity specialists operating with circa 900 employees from 16 regional locations across the UK, Europe, Africa and Canada. The group provides a comprehensive range of professional, support and managed cybersecurity services that identify and assess, protect and prevent, detect and analyse and respond and recover cyber risks and threats for business organisations across multiple regions. Working either independently or as an extension of an organisation's own team, Integrity360 strengthens security postures for mid-market and enterprise organisations across a wide range of sectors including; financial services, insurance, energy, transportation, government, healthcare, manufacturing, retail, telecoms and utilities. During June 2021 the company received a major strategic investment from leading London based private equity firm August Equity as part of a significant growth and expansion plan that has built the brand internationally. Download its 2026 cyber security trends and predictions guide now!