Geopolitics and Critical National Infrastructure

Views on the security implications of a shifting global order

recent posts

about

  • At the Table or On the Menu? A Temperature Check on the Middle Powers Idea

    Report from the 2026 GZERO Summit in London

    October 2026

    By Stephen Hermanson

    Introduction

    It was a pleasure to return to the GZERO Summit in London1 on 8 October 2026. As in 2025, Eurasia Group and LSEG assembled a strong line-up that spanned a broad agenda of geopolitical and policy risks.

    A few weeks before, I came across an article in The Times by Gerard Baker (17 September 2026) aimed at the UK Prime Minister, Andy Burnham: “Grin and bear it, Andy, and stick with Trump – The US-UK relationship may no longer be so special but Mark Carney’s idea of a new ‘middle powers’ bloc is a non-starter”.2 Carney had set out the idea at Davos in January, arguing that “the middle powers must act together, because if we’re not at the table, we’re on the menu”.3

    I anticipated the GZERO Summit would return in part to the Middle Powers question, so in addition to a general update, I decided to use the conference to take a temperature check on the Middle Powers concept – picking up a thread from my earlier report on the Chatham House London Conference 2026.4

    I sense there’s a secret doubt amongst Middle Powers proponents that concedes Gerard Baker’s premise is possibly quite accurate. I’ve also wrestled with the seemingly intractable list of obstacles that a successful Middle Powers coalition would need to overcome – chief amongst them the prisoner’s dilemma and the game theory of breaking ranks.

    The Prisoner’s Dilemma

    The logic is simple and unforgiving. Each Middle Power is better off if all of them hold the line together against pressure from Washington or Beijing. But each one, acting alone, can usually secure a better short-term outcome by striking its own deal. So everyone defects, and all end up worse off than if they had cooperated.

    We’ve seen this play out. Faced with US tariffs in 2025, the UK, Japan, the European Union (EU) and South Korea each negotiated separate arrangements with Washington rather than a coordinated response, and Canada withdrew its digital services tax under US pressure. Each decision was rational on its own terms; together they confirmed that Middle Powers can be picked off one at a time. I sense this sits at the heart of Baker’s scepticism, and it’s a fair challenge.

    Variable Geometry: A Different Kind of Alliance

    A useful insight that took shape during the summit was the different modes a Middle Powers alliance would need to adopt. The broad idea, bear with me, is that a Middle Powers alliance doesn’t look and behave like a traditional alliance such as the EU or NATO. Instead, the members form and reform around salient issues depending on their exposure and leverage – especially in relation to the US, China and Russia, where each Middle Power has a slightly different set of problems and expectations. Carney calls this “variable geometry, in other words, different coalitions for different issues based on common values and interests”.5

    This matters for the prisoner’s dilemma. A one-off game rewards defection; a repeated game changes the calculation. When the same players meet again and again – on trade, defence, technology and energy – reputation and reciprocity start to count, and cooperation becomes the rational strategy. That was Robert Axelrod’s insight in his work on “tit-for-tat”.6 Issue-based coalitions, constantly forming and reforming, are in effect a repeated game.

    Some traditional institutions such as the UN probably operate in a similar way, where members lean into or away from issues and subjects depending on their capacity and interest. Of course, the UN is so broad that the effect is often diluted, contorted or deadlocked. As a smaller group, Middle Powers could do better.

    The key, we heard, was to ensure the alliance focused on the future as opposed to relitigating past issues. For example, if the EU were created today (in the guise of a broader Middle Powers alliance that could include the UK, Canada, Japan, South Korea, Australia and others), then security and cost of living would be fundamental drivers alongside single markets, the rule of law and other principles.

    There are early signs of variable geometry in practice. In June 2026, Canada became the first non-European country to join the EU’s €150 billion Security Action for Europe (SAFE) defence loans instrument7, while the UK’s own SAFE negotiations collapsed in late 2025 over the size of its financial contribution,8 a reminder that the national interest can still trump the collective one. In March 2026, members of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), a 12-nation Trans-Pacific trade pact that the UK joined in 2024, and the EU issued a joint ministerial statement committing to cooperate on rules-based trade, supply chain resilience and economic coercion.9

    Europe as the Anchor

    The tone at the summit in 2025 was Europe in irreversible decline, but the discussion in 2026 showed signs of Europe repositioning itself as a trusted and reliable partner in a Middle Powers bloc, with Europe contributing strengths such as infrastructure, relative stability and the rule of law. The concern was fragmentation in Europe – itself an experiment in whether Middle Power coalitions could align sufficiently to make a difference. National interest and competency caveats across a range of dossiers seem to conspire to fragment the European alliance on the precise priorities it’s seeking to grasp, with security and defence as prime examples.

    There’s no doubt that flexibility is important in keeping an alliance together and sharing the benefits and costs. It was interesting to hear that perhaps the EU could be more flexible with the UK as it develops a new relationship with the EU – not necessarily re-entry (although Prime Minister Andy Burnham said in late September that rejoining is one of the options),10 but the makings of a different alliance (and a reformed, modernised EU) that’s perhaps the genesis of the elusive Middle Powers coalition. Brussels, for its part, still regards free movement, the jurisdiction of the European Court of Justice and dynamic alignment as non-negotiable, so the test of that flexibility has some tall asks.

    What a Middle Powers Coalition Needs

    If variable geometry is the operating model, four things would give it substance: a single market, regulatory coherence, a workable definition of sovereignty, and hard power backed by credible signalling.

    1. A single market as leverage

    A single market is perhaps the last lever available to a Middle Powers bloc that would have meaningful leverage with the US and China. Assuming technology and energy are firmly dominated by the US and China, Middle Powers will need a single market to exert leverage in other ways. This single market should extend to telecoms, energy, capital, AI and security – much of the territory Enrico Letta mapped out in his 2024 report on the future of the EU Single Market.11

    However, the national interest (the politics around jobs, investment, innovation and growth) inserts a protectionist and localisation agenda that undermines collective strategy. This tension (global vs local, protectionist vs open) isn’t new. Globalisation under the liberal international order, which we hear has largely unravelled in recent years, probably peaked a decade ago. Middle Powers will need to find that openness again and ring-fence it with a single market. Until then, the spectre of a GZERO world (Ian Bremmer’s term for a world where no power or group is willing to lead) seems likely to remain.

    2. Regulatory coherence, not deregulation

    Regulation is often cited as a reason that Middle Powers might struggle to be competitive in areas that the US and China dominate (a case Mario Draghi made forcefully in his 2024 report on European competitiveness).12 The tension between deregulation and regulation keeps surfacing, and there seems to be a real lack of evidence about where to draw the line. There’s clearly considerable social and political pressure to ensure that regulation is appropriate to keep society and the environment safe, secure and sustainable – and the very topical debates about AI and online safety exemplify the point. At the same time, we hear that Europe is overregulated compared to the US and China – with the ability to build and commission data centres (energy connections, planning, environmental rules etc.) providing another topical example. In the UK, Ofgem has consulted on fees and readiness milestones to clear speculative data centre projects from the grid connection queue.13

    As a thought experiment, would scrapping the EU GDPR, Digital Services Act, Digital Markets Act and anything else that would seem to create friction in the ability to innovate, start up, scale and operate make any noticeable difference in the short to medium term? Some in the EU say no; it’s anathema, and regulation is a convenient scapegoat for other more nuanced factors. The US and China have regulation too – and the US has its own fragmentation problem, with the White House moving in December 2025 to challenge a growing patchwork of state AI laws.14 One gets the sense that neither China nor the US would find it easy to advise the EU on precisely how their own regulatory regimes create less friction than EU regulation does. Suffice to say, regulation is a consideration, but by no means a silver bullet.

    The issue is more likely the fragmented way in which EU regulation is implemented than the regulation itself. The IMF has estimated that barriers within Europe are equivalent to a tariff of around 44% on manufactured goods and 110% on services.15 A group of Middle Powers all reserving the right to adjust elements to accommodate the national interest seems to be the culprit. If Middle Powers can agree on a single market, then surely they can agree on common and consistent regulation too. The EU’s Digital Omnibus on AI, provisionally agreed in May 2026, which delays and simplifies parts of the AI Act rather than scrapping it, suggests a pragmatic direction of travel.16 Perfect shouldn’t be the enemy of good, but all too often the fragmentation risk persists, and part of the reason is possibly that politics isn’t doing enough to explain the why to societies as opposed to the what.

    AI will be the next test. There are growing calls for treaties to manage AI proliferation and the pace of the AI frontier, responding to political pressure (stemming from societal concerns) about the safety of AI. Where this translates into more regulation, the arbitrage between low and high regulatory regimes reignites the trade-off between more or less regulation and how that incentivises or undermines competitiveness and investment. It would seem sensible for Middle Powers to have a common framework and approach, bearing down on over-regulation and fragmentation. With AI capabilities underpinning so much of the future economy, it’ll need to be pragmatic to avoid throttling the advantages AI can bring.

    3. Sovereignty, dependence and investment

    Another obstacle to the Middle Powers coalition that doesn’t appear to have any obvious solution is the heavy US and Chinese technology and industrial integration in Middle Power economies. This leverage, it seems, is always poised to countermand any attempts by individual Middle Powers or groups to hold the line in other areas, such as single market access and the ability to compete in parts of the technology stack and value chain.

    Yet we hear that the pace of technology development is being measured in days whilst the pace of government is measured in years. Can Middle Power governments move swiftly enough to move onto the offensive and away from the defensive posture we seem to be trapped in? Arriving at a pragmatic and workable definition of sovereignty and sovereign capability that makes sense across this coalition is a start and should be high on the agenda. A smart and nuanced approach to the sovereignty question (as opposed to the binary protectionism and excessive regulation we know the Middle Powers must avoid) feels critical to unlocking the potential of a Middle Powers alliance.

    We hear from the US and China that current European sovereignty requirements are dissuading investment and undermining European competitiveness. Investment from outside the Middle Powers alliance is important, but has to safeguard the ability of the Middle Powers to create and sustain choices (efficient, effective and competitive choices). Middle Powers will need to agree who gets the investment and jobs that US and Chinese investment brings, and reconcile the national interest so that the alliance isn’t a zero-sum system. The EU’s “Made in Europe” preference is a live test: Prime Minister Burnham has asked Brussels not to shut UK firms out of it, warning of “collateral damage” to UK industry.17

    4. Hard power and signalling

    In addition to a single market, Middle Powers must rebuild hard power. Russia is probing and testing EU and NATO defences and the appetite to respond. Some will be averse to hard power and find its development and exercise very alien. This is where sub-coalitions will need to form to lead and assure where others might not have the cultural or political space for hard power competition, for example the UK and French-led “coalition of the willing” for Ukraine and the UK-led Joint Expeditionary Force. The premise is that contributions come in various ways and places. This, it seems, is another possible obstacle, as the burden-sharing formula and narrative could be quite complex – especially given the lessons we’re taking from the US challenge to NATO and Europe on defence spending, which produced the 5% of GDP target agreed at The Hague in June 2025 and an immediate argument with Spain over whether it applied.

    Something that Middle Powers will need to establish is a reliable mechanism for signalling to adversaries their capabilities and intent in such a way as to avert escalation and maintain the status quo. In the Cold War era, the elaborate systems of signalling between NATO and the Soviet Union (and Warsaw Pact) – from the 1963 Washington–Moscow hotline created after the Cuban Missile Crisis to the 1972 Incidents at Sea Agreement – kept either side from stepping over the brink, albeit there were a number of scares and close calls, Able Archer 83 among them.

    That Cold War system of signalling and escalation management seems to be in a state of deep disrepair. New START, the last remaining US–Russia nuclear arms control treaty, expired in February 2026,18 and Russian drone and aircraft incursions into Polish and Estonian airspace in September 2025 showed how quickly ambiguous incidents can become crises. As Olga Oliker and Alexander Graef argue, the danger now lies as much in misreading incidents as in deliberate escalation.19 A world with a more complex group of Middle Powers will need something equally robust to accommodate hybrid threats that manifest in a greater variety of ways across the Middle Powers. This system is missing, and without it the hard-power element is only half complete.

    The View from the G2: the US and China

    It’s interesting to reflect on how China sees all of this. China has increasing leverage over Russia stemming from Russia’s war in Ukraine and its hybrid campaign against Europe. European Middle Powers are increasingly distracted and preoccupied with the war, and China is likely happy to see Europe and NATO contained in this way. Indeed, China’s foreign minister, Wang Yi, reportedly told the EU’s Kaja Kallas in July 2025 that Beijing did not want to see Russia lose, fearing the US would then turn its full attention to China.20 So it doesn’t appear likely that China will take any significant steps to bring an end to a war which is increasing its leverage on Russia and diluting European and NATO capacity to compete. Hard power, robust signalling mechanisms, single market access and stronger regulatory alignment, exercised as a cohesive Middle Powers strategy, may change the calculus for China.

    The US and China (the G2) see themselves on a separate (and higher) plane. A regulatory “deal” between them could constrain options and access for Middle Powers, as G2 regulation slows the ability of others to close the gap and effectively bakes in the G2 advantage. Whether the US and China can ever come to such a consensus is uncertain, but the first steps may already be visible. During Xi’s visit to Washington in late September 2026, the two sides agreed to set up a bilateral communication channel for AI incidents.21 Both will be looking for their own equilibrium, regulating enough to answer domestic concerns, but no more than their rival.

    At the moment, with the US still fractionally ahead of China in AI (Stanford’s 2025 AI Index found the performance gap between leading US and Chinese models had narrowed to under two percentage points22), the US has more incentive to reach a regulatory deal that in effect puts throttles on China’s ability to catch up and move ahead.

    Conclusion: So What?

    Gerard Baker may be right that a formal Middle Powers bloc is a non-starter, but he’s arguing against the wrong model. What’s emerging is variable geometry: SAFE opening to Canada, CPTPP talking to Brussels, coalitions of the willing on Ukraine. Whether it holds depends on Middle Powers treating cooperation as a repeated game rather than a one-off deal, and on governments explaining the why, not just the what. For business, it means planning for several overlapping rulebooks rather than one. You can’t wait for clarity, and you shouldn’t bet on a single bloc. Five practical steps follow:

    1. Map your exposure by jurisdiction. Identify where your technology stack and supply chain depend on US or Chinese suppliers (cloud, AI models, semiconductors, network equipment, energy) and test what happens if that dependency becomes leverage.
    2. Track which coalitions you’re eligible for. Market access and procurement increasingly depend on which coalitions your country belongs to. Build this into horizon scanning and bid strategy.
    3. Turn sovereignty into practical procurement terms. Specify data location, operational control and exit or switching rights. The aim is to keep choices open, not to buy local by default.
    4. Bring evidence to the regulation debate. Governments need evidence on where regulation and fragmentation create friction. In the UK, the forthcoming Regulating for Growth Bill23 and government’s call for evidence on AI in the energy system (closing 6 November 2026)24 are live opportunities to contribute, as is the EU’s Digital Omnibus for companies operating in both markets.
    5. Treat geopolitical risk as an operational risk. As escalation management weakens, hybrid incidents (sabotage, hostile surveillance, cyber-attacks, economic coercion etc.) land first on businesses and critical national infrastructure. Use threat intelligence in business continuity planning and risk scoring.

    References

    1. LSEG, 2026 GZERO Summit in London, 8 October 2026. lseg.com
    2. Gerard Baker, “Grin and bear it, Andy, and stick with Trump”, The Times, 17 September 2026. thetimes.com
    3. Mark Carney, address to the World Economic Forum, Davos, 20 January 2026. aol.com
    4. Stephen Hermanson, “Report from the Chatham House London Conference 2026: The Weight of Expectation on Middle Powers”, Geopolitics and Critical National Infrastructure (50years.blog), 12 July 2026. 50years.blog
    5. See note 3.
    6. Robert Axelrod, The Evolution of Cooperation (Basic Books, 1984).
    7. Eunews, “Defence: EU countries give final go-ahead for Canada’s participation in SAFE funding”, 15 June 2026. eunews.it
    8. Bloomberg, “Talks for UK to Join Flagship EU Defense Fund End in Failure”, 28 November 2025. bloomberg.com
    9. GOV.UK, CPTPP–EU Joint Ministerial Statement, 27 March 2026. gov.uk
    10. Euronews, “Andy Burnham is rethinking the UK’s ties with the EU. What are his options?”, 2 October 2026. euronews.com
    11. Enrico Letta, Much More Than a Market: Speed, Security, Solidarity (April 2024). economie.fgov.be
    12. Mario Draghi, The Future of European Competitiveness (September 2024), and the Commission’s one-year review. commission.europa.eu
    13. Ofgem, Curate – Demand Connections Reform (consultation on proposed data centre connection reforms), 29 July 2026; responses closed 16 September 2026. ofgem.gov.uk
    14. Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence”, 11 December 2025; summary by Wiley. wiley.law
    15. International Monetary Fund, Regional Economic Outlook for Europe: A Recovery Short of Europe’s Full Potential (Washington, DC: IMF, October 2024). imf.org
    16. Loyens & Loeff, “Digital omnibus on AI agreement: an overview” (provisional agreement, 7 May 2026). loyensloeff.com
    17. See note 10.
    18. Marion Messmer, “Avoiding a new nuclear arms race”, Chatham House research paper, 13 May 2026. chathamhouse.org
    19. Olga Oliker and Alexander Graef, “A Three Body Problem: NATO, Russia and the Politics of Air Incursions”, Deep Cuts Issue Brief, 17 December 2025. deepcuts.org
    20. Finbarr Bermingham, “China tells EU it does not want to see Russia lose its war in Ukraine: sources”, South China Morning Post, 4 July 2025. scmp.com
    21. Al Jazeera, “China, US to open AI communication channel after summit, White House says”, 26 September 2026. aljazeera.com
    22. Stanford HAI, AI Index Report 2025, Technical Performance. hai.stanford.edu
    23. Pinsent Masons, “Sandboxes central to Regulating for Growth plans”, Out-Law, 14 May 2026 (Bill announced in the King’s Speech, 13 May 2026). pinsentmasons.com
    24. Department for Energy Security and Net Zero, Vision for an AI-enabled clean energy system (call for evidence), 8 September 2026; closes 6 November 2026. gov.uk

  • Civil-Military Cooperation

    Critical National Infrastructure

    Civil-Military Cooperation

    September 2026

    By Stephen Hermanson

    Introduction

    My previous blog (Design Basis Threat and the Threshold Gap) about the MI5 Director General’s call for government, business and academia to treat national security as a shared endeavour generated significant interest.

    Given the level of traction, there appears to be more appetite for insights into how successful collaboration might be structured. The Annual CIMIC (Civil-Military Cooperation) Foresight Conference (ACFC) is a useful reference point. The 2026 conference (ACFC26) has just concluded in The Hague (14-18 September 2026). As the ACFC26 conference report will likely take a few days or weeks to emerge, we can nonetheless refer to the 2025 conference report to see what the ACFC is recommending.

    The NATO Civil-Military Cooperation Centre of Excellence is essentially coming at the same shared endeavour question from a different direction. The ACFC25 conference report offers some useful insights about systematic integration of civil actors into operational [military] processes, which responds in part to the vision that Sir Ken at MI5 is aiming to inspire.

    This blog looks at relevant conclusions from the ACFC25 conference report and comments on how they might be used in the broader context for the Civil-CNI (Critical National Infrastructure) relationship.

    Eight Takeaways for the Civil-CNI Relationship

    1. The growing need for professionally secure and “safe” discussion spaces to address conceptual frictions and integration challenges.

    Comment: Very similar if not identical to the Joint Operational Plan (JOP) concept covered in my blog “Design Basis Threat and the Threshold Gap” (see reference #1). Governments can use convening power and actively participate themselves to create safe and secure spaces (or reuse existing platforms to avoid clutter). The key is good organisation (a competent chair and secretariat) and persistence – with regular interactions and all parties contributing to the agenda (ad hoc discussion is simply insufficient). The precise frequency, format and membership can be configured to suit the nature and purpose of the group. The pre-requisite is that organisations will detach relevant personnel and provide them with the mandate and resources to contribute. For busy security professionals, there is a danger this becomes a “reasonable efforts” second order priority because the Executive Committee sponsor is missing or not convinced. That needs fixing straightaway if there’s any doubt. It’s revealing that the ACFC25 report says, “preparedness and resilience carry fiscal and political costs, which must be evidenced to decision-makers”.

    1. Joint training, exercises and tabletops, including institutionalise pre-crisis liaison and exercising.

    Comment: A classic item for JOP agendas. In some cases, the whole agenda could be dedicated to exercising or specific operational issues. The key is to ensure that exercising doesn’t slip off the agenda and become unfamiliar. For some, exercising can feel artificial and contrived, and the role-play can sometimes feel uncomfortable. The solution is to agree a scenario (meeting #1), brief the scenario (meeting #2), run the exercise (meeting #3) and de-brief/report on actions and follow-ups (meeting #4). In between meetings exercise leads are iterating and refining. The point is that a good exercise doesn’t jump off the page and happen in one meeting. If the group is meeting quarterly, then already the set-agendas for the year should include all the elements (#1-4) and continue year after year whilst rotating the exercise leads to spread the load.

    1. Emphasise the commercial attractiveness of collaboration.

    Comment: Super interesting to see this takeaway from ACFC25. Commercial attractiveness could mean a number of things. One is the commercial quid-pro-quo from having stronger preparedness and response – meaning less relative cost to deter, detect, respond and recover added to the commercial gain from mitigating or avoiding reputational or strategic damage. The message, it seems, is that collaboration can re-enforce the business case for security and resilience (assuming more convincing is even required). A second is aligning capability requirements with research agendas and product/solution development. The Security sector (either directly or through CNI clients) can understand from the collaboration the areas and priorities for security capabilities – ultimately matching requirements to capabilities and eventually investments and commercial deployments that respond to precise needs. A third might be the advantage of spreading commercial and operational risk across a greater ecosystem. More eyes on the threat, a self-supporting ecosystem that’s more difficult to knock over in isolated actions.

    1. Systematic interfaces for common development of interoperability and security standards. This includes standardised information flow between entities and trusted, secure civil-military information-sharing interfaces overcoming IT and clearance barriers.

    Comment: This is often where tension and fatigue emerge. Depending on the size of the group and the complexity of the agenda, there may be reasons for close, real-time collaboration, including the exchange of data and shared governance of decisions. In complex collaborations this can demand new and standalone systems and protocols – in some cases spawning entirely separate collaboration entities, sponsored by the original partners but trading in their own right. At the other end of the spectrum, it can be relatively informal and require nothing more sophisticated than standard desktop IT and common sense. Different parties will have different expectations and risk tolerance. Therefore, finding a method of collaboration that doesn’t side-line the agenda is part of what a good secretariat and committed sponsors are installed to navigate. The aim is not to lose sight of the collaboration’s true purpose when interoperability and alternative standards present obstacles – some of this friction is inevitable when building systematic collaboration. Work through it.

    1. Rapid, multi-level information flow and dissemination of civil environment analysis, including improving reporting and information flow vertically and across levels of command, and shared threat assessments with critical sectors.

    Comment: Builds on the previous point, shifting the focus from how to share onto what to share. Environmental analysis and threat assessments are two examples; incident reports, controls and risk assessments could be equally relevant. The key is deciding what matters and to bring it to the table promptly, with the necessary approvals and redactions – swift and pragmatic, while still respecting the governance individual organisations require around such decisions. CNI teams are in many cases already producing threat assessments, drawing on commercial intelligence sources that government may already use, or on open sources that government already has access to. The tradecraft of building an intelligence-sharing fusion cell across the public and private sectors already exists (and worthy of an entirely standalone blog in due course); what it needs is the political and commercial backing to stand up, mature and persist.

    1. Designated contact points. Map and codify National civil-military organisational structures and points of contact.

    Comment: Straight out of the JOP playbook. The secretariat compiles and maintains the contact list and organisational structures the group needs to understand.

    1. Baseline CIMIC literacy in cross-domain areas (cyber, economic resilience, humanitarian dynamics).

    Comment: This takeaway from ACFC25 suggests that a broader cross-section from within the collaborating organisations needs to have a better understanding of the shared endeavour between government and CNI, what their contributions might be and how they stand to benefit. It stands to reason that awareness amongst principal actors such as Security (including cyber), Resilience, Risk and Operations will percolate across the organisation so that others such as Finance, Supply Chain and Public Affairs (for example) are also aware and contribute where relevant and necessary. The point, it seems, is that good end-end awareness avoids fragmented and competing initiatives, especially in large multinational organizations where Dept A and Dept B both pursue the same concept in different ways without knowing the other exists. Proper integration of the collaboration programme into corporate governance and reporting (together with solid Executive Committee sponsorship and support) will create the line of sight and accountability/responsibility to offset this danger.

    1. Integrate civilian actors earlier and more substantively into operational planning. Interaction is needed at the working level.

    Comment: This is possibly the culmination and high-point of successful collaboration, when participating organisations can effectively detach their staff to take part in detailed operational planning at other participating organisations (including secondments across the public-private sector divide). This implies that participating organisations all have a role in the operational plan and are able to commit their organisations to fulfil that role. Where such a role doesn’t exist or isn’t required, then the collaboration is no less successful. Shared situational awareness and intelligence insights of themselves may be useful and that may be the extent of what the parties need.

    Case Study: The UK Home Defence Programme

    The Cabinet Office’s Home Defence Programme (established in 2024 as a cross-government plan for the UK’s defence, security and resilience) runs in parallel to the collaboration challenge that ACFC25 describes. It exists to coordinate military and civilian effort, including civilian assistance to the armed forces in a crisis or period of hostilities.

    In July 2026 the Ministry of Defence confirmed it was progressing a parallel programme, aligned to the Cabinet Office Home Defence Programme, to facilitate a whole of society approach to defence and security. This resonates with ACFC25’s point about designated contact points and mapped organisational structures, since the coordination challenge is as much interdepartmental as it is civil-military. The Home Defence Programme centrepiece is Operation Albiston Shadow, a Tier 1, ministerial-led exercise planned for 2027 that will test the government’s home defence plans against hundreds of officials, from local responders through Crisis Operations teams to ministers themselves. This echoes the joint training and exercising exactly as ACFC25 recommends – treated as a standing commitment on the calendar, not an ad-hoc event.

    More striking still is where the Programme reaches for private-sector help. The Strategic Defence Review has proposed a “new deal” for CNI defence, rooted in partnership between Defence and private-sector operators, including a mooted Reserve-style “Home Guard” to protect strategic sites across energy, food, water, telecoms, medical supplies and transport. This echoes ACFC25’s recommendation to “integrate civilian actors earlier and more substantively into operational planning”, manifest in a live UK defence policy proposal where CNI operators are moving from information-sharing partners toward something closer to co-owners of the protection mission itself. Whether it survives contact with cost, governance and liability questions is exactly the sort of thing a JOP-style standing forum, sponsored at Executive Committee level, would be built to work through before the pressure of an actual crisis forces the answer.

    Conclusion

    The ACFC25 report calls for “…a mindset shift that recognises modern conflicts affect whole societies and that harm cannot simply be displaced”. This feels very in keeping with the mindset shift that Sir Ken McCallum was aiming for in his public comments.

    The ACFC25 report also concludes with a number of research questions, and one in particular seems especially useful for the broader question of public-private partnership for national security as a shared endeavour:

    “What is the most effective way to organise and govern engagement with the private sector (NATO, host nation, EU, or blended models) while avoiding over-reliance on single companies or platforms?”

    The possible danger is in looking for a binary delineation where private operators take responsibility for x-scope and the State takes responsibility for y-scope (or the balance). Behind this formula is the desire for specific parties to shoulder the responsibility (and accountability) for specific risks and mitigations because that’s how we believe risk is properly managed – leave no doubt about who is responsible (and accountable) because human nature will find room for manoeuvre (and precipitate errors) if there’s any ambiguity.

    By creating systems of co-operation and building trust, we begin to understand, to a reasonable degree, the level of delineation we need in order to plan and act. A beautiful RACI may attempt to sketch out the broad parameters and provide some orientation on who is responsible/accountable for what, but not everything can be resolved purely by a bureaucratic process.

    If ACFC25 sets out the conditions for good civil-military collaboration, the Joint Operational Plan described in my previous post is one practical vehicle for Civil-CNI partnership. A JOP-style forum (sponsored, resourced and meeting on a fixed cycle) is exactly the kind of standing structure that the Home Defence Programme’s own coordination challenge, and ACFC25’s research question about governing private-sector engagement, both point toward. The open question is whether that structure is built and matured before the next crisis forces it.

    References

    • Design Basis Threat and the Threshold Gap, Geopolitics and Critical National Infrastructure, Stephen Hermanson, 14 September 2026, 50years.blog
    • ACFC25 Final Report, NATO CIMIC COE, October 2025, cimic-coe.org
    • Annual CIMIC Foresight Conference 2026 Agenda, NATO CIMIC COE, September 2026, cimic-coe.org
    • The UK Government Resilience Action Plan: 2026 Implementation Report, Cabinet Office, 14 July 2026, gov.uk
    • What is a ‘whole of society’ approach to defence and security?, House of Commons Library, 2 September 2026, commonslibrary.parliament.uk

  • Design Basis Threat and the Threshold Gap

    Critical National Infrastructure

    Design Basis Threat and the Threshold Gap

    September 2026

    By Stephen Hermanson

    Introduction

    MI5’s Director General has issued a rare public “call to arms,” asking government, business and academia to treat national security as a shared endeavour. It’s hard to disagree in principle. However, critical infrastructure operators already work to a formal ceiling on what they’re expected to withstand alone — the nuclear sector’s “Design Basis Threat” concept, now used more broadly. Below that ceiling, the operator’s problem. Above it, the State’s. What happens in between, where nation-state-linked attacks are already landing, is a potential gap that deserves more attention. This blog looks at where that gap sits and why closing it will take more than another round of compliance legislation.

    National Security as a Shared Challenge

    The head of MI5 (the UK’s domestic intelligence agency, otherwise known as the Security Service) wrote: “… government, business, academia, and the public must treat national security not as the specialist concern of a handful of agencies, but as a shared national endeavour. Contending with rising State-backed aggression — whether sabotage subcontracted to criminals, or covert interference in our democracy, or destructive cyber-attacks on power stations — demands new laws as well as new tradecraft.”

    He continued: “In 2026, unlike 2001, many of the assets, systems and services under threat sit in private sector hands. This means many of the most critical decisions will be taken not in COBR (the Cabinet Office Briefing Rooms — a term adopted for the UK’s highest crisis and incident-management co-ordinating council) but in boardrooms. We need a new team of teams, preserving an open economy but cooperating across government, industry and academia, to close vulnerabilities and enable swift coherent action when crises hit.”

    Design Basis Threat and the Threshold Gap

    Design Basis Threat (DBT) is a formal description of the capabilities and attributes of potential adversaries (both external attackers and insiders) that a private critical national infrastructure (CNI) operator must be able to withstand.

    CNI operators are defining their security objectives, strategies for implementation and investment requirements based on a perceived threshold of threat that private sector organisations would be reasonably expected to withstand (spanning identify, deter, respond and recover). This threshold is typically considered to sit below the level of sophisticated State actors, who are considered to possess resources and capabilities that far outmatch any defences that private operators could either reasonably afford to maintain or bring to bear.

    In other words, private sector CNI is saying that it will prepare and respond to threats according to the capabilities that a private sector commercial operator could be reasonably expected to have and operate. For example, private organisations do not have law enforcement or other active defence mandates to collect intelligence and take courses of action that encroach on or compete with the remits of law enforcement, armed services or security agencies. Private organisations, for example, don’t operate armies, navies or foreign intelligence services. This level of capability is reserved for the State and when States deploy this level of capability against adversaries, the expectation is that the targeted State will respond.

    The latest call to action by MI5 (Ken McCallum) is that States and private sector CNI should respond simultaneously and in partnership. This seems perfectly reasonable and familiar to security professionals across the private and public sectors that already collaborate in many ways. Nonetheless, there’s still a sense that the gap between States intervening and the point at which private operators decide that States should intervene, leaves room for misunderstanding. It appears quite possible that Boardrooms will assume (and expect) that Governments will intervene (and know when to intervene) at the precise point at which the Boardroom has decided risk mitigation and risk tolerance have exceeded any further investments the business could be reasonably expected to make — especially where fiduciary duty and returns on investment no longer support shareholder interests.

    On the other hand, States are asking private operators to do more (and actively bridge the gap before State intervention is obvious). States are already setting rigorous security obligations for CNI operators. The effect, it seems, is for CNI operators to double down on compliance regimes that respond to the letter of the law or regulation, but not necessarily the spirit. Laws and regulations will typically require operators to “do everything necessary and proportionate to protect essential operations from state of the art threats”, but the interpretations of necessary, proportionate and state of the art leave room for debate. It’s accepted that CNI operators must be capable of understanding the specific threats to their operations and putting in place the basic hygiene measures to protect themselves from commodity and known attack vectors. It’s also accepted that States step in where it’s obvious that the threshold of war has been met.

    The area around the threshold, when it’s not as obvious either way, is where CNI operators and States may struggle to respond effectively. At this level, operators are at the limit of their capabilities and fall back on the Design Basis Threat paradigm, and States are only just noticing their threshold for intervention. At this level, States are not likely or able to understand the specific nuances and characteristics of the operator’s environment or risk profile. At this level, the operator has no protocol for introducing State intervention into their response.

    Instead, States seek to close the gap by introducing more security obligations through legislation, regulation, guidelines and standards. Operators in turn face more compliance and liability risks which consumes huge amounts of resources in governance and checking as opposed to implementing and protecting. Sprawling and complex corporate compliance regimes are trying to mitigate compliance risk — including the risk of misjudging the DBT threshold. Audits, assurance systems and reports are supposed to convince governments and regulators that somehow the Board has understood the correct DBT threshold and found the right level of investment to bridge the gap and provide a seamless hand-over when government has to step in to pick up the battle. If you’re thinking that this seems unlikely, then you’re probably correct.

    So, this latest call by MI5 seems to be another reminder that the DBT gap remains. The State’s security and defence apparatus is already under intense pressure and scrutiny. The politics of defence spending are on display in the mainstream media and politicians are wrestling with the challenges of finding the money for more security and defence capability. What’s not always on display is the discussion in Boardrooms about the affordability of security investments. The private sector is already making huge investments, driven by their own risk calculus and the added compliance burden. What’s not clear is whether Boards are minded to go further, and make more investments beyond the commercial business case, and in so doing support the State’s broader security and defence strategy. It’s expensive and the returns are measured at national security and societal levels. It’s probably difficult to put a precise number on the benefits that would be imparted to the private operator for taking the decision to “sponsor” national security goals. ESG reporting might seek to convey the philanthropic corporate contribution to national security and defence, but the practical financial return for shareholders always seems tenuous and difficult to trace.

    It seems that MI5 is saying that Boards can and should step a bit further into the DBT gap, but stop short, of course, of setting up private armies, navies and agencies that compete with the State. A bit more from robust corporate profit lines (in addition to taxes and other costs already levied by the State) seems necessary and possible (depending on the level of avarice that shareholders display). However, such extended contribution can easily be subsumed by an ever-growing compliance regime that begins to crumble under its own weight and complexity. Any additional corporate “contribution” should be ringfenced to look at how CNI operators and governments can properly agree on a system for partnership, collaboration and handover when threats and incidents approach the threshold area. The exam question that surfaces is what this operating model looks like and how it is sustained in such a way that Design Basis Threat caters for the full threat spectrum and is not simply a point at which private operators relinquish responsibility, but instead helps to mobilise State capabilities.

    Case Study

    In August 2025, Jaguar Land Rover (JLR) was hit by a cyberattack that eventually forced a total production shutdown, described as the most economically damaging cyberattack in British corporate history, with analysis by the Cyber Monitoring Centre (an independent, industry-funded body that assesses systemic cyber events) putting the cost to the wider economy at around £1.9 billion and JLR’s own losses running at roughly £50 million a week. A group calling itself “Scattered Lapsus$ Hunters” claimed responsibility, but investigators subsequently assessed the attack as the work of Russian-linked actors, with the question of Kremlin direction or tacit backing still unresolved. This offers a good example of the attribution ambiguity that sits at the DBT “threshold” (is this criminal, or State-backed aggression by another name?).

    The State response wasn’t an explicit COBR-led national security intervention. Instead, the intervention came as a £1.5 billion government-backed loan guarantee to keep JLR’s supply chain solvent. This economic instrument arrived well after the fact, once the Board’s own resources and the commercial case for further private investment had been exhausted. This portrays the “gap” in action — a private operator absorbing a State-linked attack until it no longer could. There was no defined protocol for when or how the State would step in, and the eventual intervention came through the Treasury rather than through any framework built for the purpose. JLR is not technically classified as CNI, which reveals the threshold problem isn’t confined to CNI sectors, but extends to nationally significant private industry more broadly.

    State-backed aggression against CNI-adjacent targets is likely the norm rather than the exception. Richard Horne, CEO of the UK National Cyber Security Centre, disclosed in his annual RUSI lecture (17 June 2026) that the NCSC assessed state actors as likely responsible for roughly 75% of the ~200 “nationally significant” attacks it responded to over the preceding twelve months. This reinforces the framing from Ken McCallum at MI5.

    Recommendation

    A possible operating model and response to the earlier exam question that appears to have strong potential is an initiative that UK lead government departments are already exploring.

    Lead departments are using their convening power to bring government and industry parties together (including across national boundaries) for the precise purpose of finding a pragmatic solution to managing collaboration and handover in the DBT threshold phase.

    The concept manifests as a “Joint Operational Plan” for the express purpose of strengthening situational awareness and providing trusted channels for communications that don’t get hamstrung by the complex bureaucracies and protocols of government and industry crisis management and response.

    This informal and operational layer captures the moment at which security professionals are sensing a shift and noticing the need for extended collaboration (or at least posing early questions). It provides the space for trusted relationships to form and conversations to test the ground. These channels could be very useful at steering parties to look at the right areas and seeding the ground for structured collaboration.

    References

    • MI5 chief warns Britain faces greater danger now than on 9/11, The Independent, 11 September 2026, independent.co.uk
    • NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK’s critical systems, NCSC, 17 June 2026, ncsc.gov.uk
    • International Atomic Energy Agency, National Nuclear Security Threat Assessment, Design Basis Threats and Representative Threat Statements, IAEA Nuclear Security Series No. 10-G (Rev. 1), IAEA, Vienna (2021)
    • UK Export Finance (UKEF) support for Jaguar Land Rover (JLR), Department for Business & Trade, 26 September 2025, gov.uk
    • UK Export Finance Contingent Liability: Jaguar Land Rover, Hansard, 29 October 2025, hansard.parliament.uk
    • Statement on the Jaguar Land Rover Cyber Incident, Cyber Monitoring Centre, October 2025, cybermonitoringcentre.com

  • Technology and Regulatory Risk in Telecoms and Defence

    Critical National Infrastructure

    Technology and Regulatory Risk in Telecoms and Defence

    By Stephen Hermanson

    August 2026

    Introduction

    Summer recess is often a time for reflection and 2026 heatwaves in the UK provided ample opportunity to escape to an air-conditioned library or shaded deckchair to think more broadly about the security of critical national infrastructure (CNI). I found myself searching for perspective, and whilst stepping back to gauge the wider picture I came across a piece in The Telegraph about Germany’s support to the UK nuclear programme.

    Further reading about the UK’s Defence Nuclear Enterprise (DNE), or what some might refer to as the Defence Industrial Complex, revealed some interesting parallels and differences to other critical sectors. I decided to explore the comparison to understand more about the technology risk and whether other CNI sectors such as Telecoms offered any insights for DNE.

    For example, the UK’s replacement warhead programme (Astraea) is often discussed as a physics programme. That framing is incomplete as Astraea is also a technology-dependent programme in the same sense that telecoms, energy and data infrastructure are – reliant on semiconductors, high-performance computing, and increasingly AI-assisted tooling, all sourced through supply chains that are now openly contested ground in UK-EU-US technology policy and in State cyber campaigns.

    Telecoms has already had a painful and public reckoning with technology-partner risk. If we conclude that DNE has equivalent Critical National Infrastructure status, then it’s worth asking how DNE can navigate inevitable public policy interventions that seek to respond to very similar technology and supply chain risks.

    DNE as CNI – not a special case

    The UK National Protective Security Authority’s current CNI sector list places DNE explicitly within the Defence sector, alongside the Ministry of Defence, the National Armaments Director Group, and the three Services. That designation is fairly intuitive and the Government’s own framing of DNE as a “National Endeavour” reinforces the point. The £15 billion committed to the sovereign warhead programme this Parliament firmly establishes Astraea as a critical national infrastructure programme as opposed to a niche defence project.

    The point is not that DNE and Astraea are newly vulnerable. It’s that both also face state-linked supply chain compromise, concentration risk in a shrinking pool of trusted technology vendors, and dependency on compute and components whose provenance is increasingly a matter of public policy rather than private procurement. Telecoms, data infrastructure and energy have all had to build publicly regulated responses to these threats. DNE’s assurance architecture has historically been built around a different question (safety and proliferation).

    Astraea’s digital pivot: why compute sovereignty is now a programme risk

    Astraea will be the first British warhead certified without a live nuclear test, in line with the UK’s Comprehensive Test Ban Treaty commitments. In place of live testing, certification rests on the UK Atomic Weapons Establishment’s (AWE) digital and experimental infrastructure, which recreates the extreme temperatures and pressures found at detonation, and powerful compute, which underpins the modelling and simulation work behind the design. That is a structural change from earlier warhead generations. It means the compute and simulation layer isn’t a supporting IT function sitting behind the “real” programme. It’s directly part of the certification chain. A disruption, compromise or capability gap in that layer is a programme risk, not simply an IT risk.

    This is terrain that the UK’s technology-sovereignty debate is wrestling with. On semiconductors, the EU’s own justification for its Chips Act 2.0 is blunt: dependency on a small number of overseas manufacturers and designers has become “a potential source of geopolitical leverage”. AWE’s procurement of advanced electronics and electromechanical devices (for arming, fuzing and firing systems and other non-nuclear components that sit outside treaty commitments) may draw on specialised, low-volume, high-assurance components from overseas manufacturers and designers. Supplier assurance systems such as the Defence Cyber Protection Partnership will have an increasingly essential and scrutinised role.

    On AI and compute, the UK sovereignty debate has moved beyond theory. In mid-2025 (around London Tech Week) the UK government commitment to scale compute capacity twenty-fold by 2030. In September 2025 the UK-US Technology Prosperity Deal was framed around $30bn in US investment. In January 2026 a cross-party Early Day Motion signed by 45 MPs warned that government services and “critical infrastructure” have become dependent on a small number of hyperscale cloud providers. The AI-assisted design, simulation or manufacturing for Astraea or its successors will inherit that same dependency question, layered onto the existing export-control regime that governs the W93/Mk7 (US warhead programme) relationship with Astraea.

    As for cybersecurity, AWE’s own risk profile changed materially when it was brought back under full Ministry of Defence control in 2021. The Future Materials Campus, Mensa and Pegasus builds are large, long-duration, digitally intensive capital programmes – precisely the profile that state-linked supply chain campaigns elsewhere in CNI have targeted during construction and commissioning.

    The telecoms precedent: categorise, mandate, diversify

    Telecoms has already run this playbook. The Telecommunications (Security) Act 2021 gave government a legal mechanism (“designation notices” and “designated vendor directions”) to formally categorise a supplier as high-risk and mandate its removal on a defined timeline. Crucially, that mandate was paired with funding to strengthen supply chain diversity in the telecommunications infrastructure market. Diversification was not left to market forces alone, and included a £250 million 5G Supply Chain Diversification Strategy, a Telecoms Diversification Taskforce, and sustained government backing for Open RAN as a route to a more competitive vendor base.

    What stands out for DNE purposes is government’s own candour about the trade-off this created. In its own words at the time, removing high risk vendors “brings with it a resilience risk as we become more dependent on the remaining suppliers”. Diversification wasn’t treated as a one-off vendor ban; it was treated as a resourced, multi-year programme explicitly designed to stop one dependency risk from simply concentrating into another. The regulatory architecture reflected that: Ofcom was given an ongoing security-monitoring duty over the sector, informed by the National Cyber Security Centre’s (NCSC) technical risk assessments, rather than the security question being left inside general market regulation.

    Where the analogy holds and where it breaks

    The telecoms model transfers well to everything in Astraea’s technology stack that is not treaty-bound, such as semiconductor and electronics supply chains, other non-nuclear components, the compute and AI tooling for the certification pathway, and the cyber assurance of contractor and construction ecosystems.

    However, the analogy breaks down at the core of the Astraea programme. Telecoms diversification worked because alternative vendors genuinely existed and new entrants would eventually appear. Astraea’s core dependency, the shared Mk7 aeroshell and its parallel development with the US W93 programme (governed by the 1958 Mutual Defence Agreement and the Polaris Sales Agreement), has no equivalent alternative. It is singular by treaty design, not by market failure, and it cannot be diversified.

    Nonetheless, it’s still possible to apply the diversification logic in other layers that surround the treaty. This distinction is worth making because it changes the mitigation strategies for DNE technology resilience and for specific programmes such as Astraea.

    Recommendations: old questions, new tools, and a role for ONR

    This isn’t a new line of inquiry. Writing for RUSI in January 2021, Dr Matthew Harries set out five themes where Parliament should press for clarity about what would become the Astraea programme, and included these questions: “What are the implications of dependence on US decisions, especially those relating to the W93/Mk7 programme? What is the backup plan in case of any disruption?”

    Since 2021, the technology sovereignty and cybersecurity debates offer DNE a template for technology assurance and hardening that sits outside the treaty relationship, even where the relationship itself remains structurally “unhedgeable”.

    Harries’ broader recommendations for routine Defence Committee sessions (in private where appropriate) with the Nuclear Warhead Capability Sustainment Programme and scrutiny of AWE’s post-nationalisation governance can allow technology and supply-chain resilience to become an explicit and standing part of the agenda as opposed to building entirely new scrutiny mechanisms and architecture.

    That instinct, to use what already exists rather than build something new, should guide the regulatory answer too. The obvious risk in reaching for a Telecoms Security Act-style regime for DNE is regulatory and assurance burden: a new designated-vendor apparatus, modelled on Ofcom’s role, stacked on top of an already complex safety and security architecture that DNE answers to. That architecture already has a natural home for this work. The Office for Nuclear Regulation regulates nuclear security, safety and the protection of sensitive nuclear information and industrial control systems at AWE sites, working in partnership with the National Cyber Security Centre. ONR does not regulate warhead design itself (that responsibility sits with the Defence Nuclear Safety Regulator) but, its site-level cyber and information assurance remit already reaches into relevant parts of AWE that technology-sovereignty risk actually touches.

    Rather than layering a new Ofcom-style vendor-designation regime onto DNE, the more proportionate route is to extend ONR’s existing cyber security and information assurance function (in partnership with NCSC and the Ministry of Defence’s own Defence Cyber Protection Partnership) into a formal technology assurance role for programmes such as Astraea. That keeps the assurance function inside a body that already holds the necessary clearances, sector trust and working relationship with AWE, rather than asking a new structure to build all of it from scratch while duplicating work ONR is, in large part, already resourced to do. The question for Parliament, in Harries’ terms, shouldn’t only be whether Astraea is on schedule and on budget; it should be who is accountable for assuring the technology, compute and AI supply chains the programme now quietly depends on, and whether that accountability sits with a body equipped to exercise it without adding a second regulatory layer to an already heavily regulated enterprise.

    References

    • Germany in talks to help fund Britain’s Trident nuclear deterrent, The Telegraph
    • National Protective Security Authority, “Critical National Infrastructure,” npsa.gov.uk
    • GOV.UK, “A National Endeavour: Nuclear as part of the Defence engine for growth”
    • AWE, “The UK’s Defence Nuclear Enterprise: Driving Growth, Security and Innovation,” awe.co.uk, May 2026
    • Wikipedia, “Astraea (nuclear warhead)”
    • European Commission, “Proposal for the Chips Act 2.0,” digital-strategy.ec.europa.eu
    • Council of the European Union, Chips Act 2.0 documentation, 3 June 2026
    • GOV.UK, “AWE – Advanced Electronics and Electromechanical Devices: Competition Document”
    • Computer Weekly, “Breaking the stranglehold: Responses to data sovereignty risk,” April 2026
    • GOV.UK, “Roadmap to remove high risk vendors from telecoms network,” November 2020
    • UK Parliament, Written Statement HCWS610, 30 November 2020
    • GOV.UK, “Ex-BT boss leads task force to attract new vendors to UK telecoms”
    • Matthew Harries, “The UK’s New Nuclear Warhead: Issues for Parliament,” RUSI Commentary, 11 January 2021
    • Office for Nuclear Regulation, “Cyber Security and Information Assurance specialism,” onr.org.uk
    • Institute for Government, “Office for Nuclear Regulation,” explainer, accessed January 2026

  • The First 90 Days: Building a Threat Intelligence, Security Public Policy and Government Relations Team from First Principles

    Introduction

    By Stephen Hermanson

    A sample 90-day plan — tested in action — when embarking on building a new threat intelligence, public policy and government relations team for critical national infrastructure.

    By no means perfect, and certainly not the only model. I simply offer it as a reference having been through the journey first hand.

    For context, this was a blank sheet — building something from first principles. We inherited some structure and process but, for the most part we decided to leverage the rare opportunity to start afresh.

    The scope was security (cyber, physical and people). We stood in relative isolation at the start, and other teams were building alongside us too. Steady integration and consolidation with Corporate Affairs, Strategy, Risk and others would follow.

    It Begins

    You’ve passed the interview, been offered the role and you’ve arrived in post. Most people in this situation will have a plan in mind and the 90-Day plan, modelled to a large extent on new political appointments and administrations, seems de rigueur.

    You’re conscious that it’s critical national infrastructure and there needs to be evidence of a methodical and considered plan to orientate and understand the business, the people, the history, the risks, the politics, the funding, the external threats, the commercial partners, the commitments and technology you’ve inherited and the list goes on — you get the idea.

    You may be fortunate enough to have an induction plan. If so, bolt the plans together and leverage the induction to get early agenda time with the stakeholders you’ll be working with. It’s not uncommon in these early days and weeks to rattle through a raft of introductions whilst juggling early tasking and deadlines.

    Invest time in these early introductions, don’t rush them. Have an agenda or plan, even a simple one such as “What are you working on, what are you expecting from me, what decisions sit with you?”. Most importantly, don’t disappear into the trenches. Schedule follow-ups as weeks and months down the line, you’ll likely have more (and smarter) questions. If it feels like heavy lifting, then it’s likely one or both sides isn’t sure what the relevance is. Understanding the quid-pro-quo, regardless of the personalities and agendas at play, is super important.

    For Threat Intelligence, Security Public Policy and Government Relations, you’re trying to discern priority intelligence requirements, priority policy dossiers and priority government relationships. The aim is to support business agendas and provide authoritative counsel and intervention on matters of security and resilience.

    Understanding how business stakeholders use and respond to intelligence and policy assessments will usually need a few iterations. It’s possible to encounter arm-chair experts that believe the daily media brief is sufficient to keep abreast of the issues and risks. The plan is designed to get into the guts of the business and focus very quickly on what’s important and where to add value.

    The Plan

    Some of this includes traditional administration and set-up (a check-list of sorts). Bear in mind that some elements may fall into place automatically and in some cases it’s pre-determined and not open for review (observations and suggestions can come later).

    Much depends on whether you’re building from scratch or arriving in an arena that’s already mature. The main purpose is to understand each of these elements and how they combine, interact and shape your agenda and strategy.

    I’ve kept this intentionally compact and it doesn’t pretend to provide an exhaustive manual. Some elements are the subject of detailed study and volumes of guidance. It’s simply the sketch I start with when embarking on a new role.

    Role

    Role
    Comms and logical accessYou have credentials and permissions to relevant desktop systems, channels and groups.
    Devices and physical accessYou have relevant physical access and devices required.
    System/Application accessYou have access to relevant reporting, tooling and 3rd party services.
    RecruitmentReview and sign-off on new/existing role profiles and funding if you’re hiring.
    Battle rhythm & reportingAgree timing and agendas for 1-1s, team calls and the content/structure of weekly/monthly reporting packs with direct reports, peers and manager.
    Clearances/VettingTransfer or apply for relevant national security vetting if required.
    Corporate policiesKnow where to find corporate policies such as Security, Travel, Expenses Hospitality, Communications and Procurement. Understand them. Now is the time to ask and clarify.
    Induction trainingYou’re aware of the relevant courses you need to complete such as Anti-Trust, Security and Health & Safety. Get them out the way.
    Delegation of Authority (DoA)Check circumstances and thresholds for DoA both up and down.
    Important contactse.g. Security Operations Centre, Media Team, IT Helpdesk, ExCo PAs, Committee Chairs & Secretariats.

    Team

    Team
    Introductions & role profilesMeet the team, understand their roles, what they’re working on, how they prefer to collaborate, build rapport.
    Objectives & Strategy (current FY)May need drafting in a greenfield scenario. Either way, review it and get to grips with the scope, the risks being addressed, and dependencies. How is achievement measured and how is the team performing?
    Key stakeholdersIdentify internal and external customers, providers (inputs) and influencers. Are requirements understood and reflected in objectives and strategy?
    PoliciesWhat policies (if any) does the team own or contribute to? What level of assurance does the team provide?1
    Products/ServicesPurpose, audience and cadence. What did the last round of feedback say? Is it clear how they are being used and to what effect?
    Diary (Meetings/Events/etc)Where do you need to be (calls, meetings or events) and what are you (your team) expected to report or contribute?
    Executive Committee (ExCo) / Board papers and timetablesWhat contribution or insert is required and who participates in the drafting and reviews to ensure it’s ready by the deadline. Review previous inserts.
    Funding, Budgets & Financial PlanningHow are your people and operations funded? What’s the opex/capex ratio and what suppliers and framework agreements apply? What did the last efficiency challenge require?
    Business CasesAre there any business cases in progress or needed to support objectives and strategy? What’s the governance process and who decides?
    Incident HistoryDepending on the nature of the role, it’s useful to understand the incident or event history and findings from post incident reviews (and whether new/amended risks were introduced).
    External MonitoringHow do you understand the external landscape, collect and process data to provide meaningful and timely intelligence that’s packaged in the right way, and continue to calibrate the lens and partners used to maintain situational awareness. Specifically, what are your intelligence requirements and why?
    CertificationsDoes the team require and/or maintain 3rd party certifications such as ISO2/CAF3 in relation to policy, processes or technology?
    ToolingWhat specific systems/services are in play (beyond general purpose corporate IT and advisory), what do they provide, and when did the last service review with the vendor take place?
    PerformanceWhat are the standing KPIs and targets? Do they make sense and how is the team performing? Has an external benchmarking exercise been conducted and when would this be useful to repeat?

    Internal Stakeholders

    Internal Stakeholders
    Operating model and RACIHow are you expected to work and collaborate with your immediate function and broader organisation.
    ExCo sponsor/sWho represents your agenda at ExCo and how do they prefer to be briefed? An absence of clear ExCo patronage is cause for priority investigation and clarification.
    GovernanceUnderstand the various Steering Committees, Board Committees etc that you’re expected to attend and support, and the last set of notes and actions for each.
    Commercial partnersUnderstand current supply chains relevant to your objectives and strategy — contracts, spend, deliverables, RFPs, etc.
    Strategic programmes & investmentsWhat big bets is the organisation making and how does this influence your priorities. This includes mergers and acquisitions (past, underway and planned).
    Corporate narrative & strategyLook over the latest Annual Report and the Public/Media lines to calibrate your objectives, priorities, tone and narrative. Understand how you tie into the corporate purpose and mission. Who approves public positions and external comms.
    Corporate Risk RegisterPay close attention to the headline corporate risks such as Security & Resilience, Trade Controls & Sanctions, Emerging Technology, Regulation etc. What is the threat assessment calling for. Are your objectives responding to risk? What risks does your ExCo sponsor own and how does your role support mitigation or avoidance. Absence of any link to risk is cause for priority investigation and clarification.
    Critical assets, locations and dataUnderstand what you’re protecting and where risk will manifest. Understand physical/geographical layout, logical/systems layout, data sets and where they are hosted.
    Regulatory reportingLook over previous submissions and understand the timetable and governance for future returns. Do your objectives map to any compliance obligations? Does your role provide any support to regulatory aims/asks?
    Market structure, supply chain and ecosystemUnderstand the sector and market/s — customers, revenue, commercial model, competitors, and supply chains.

    External Stakeholders

    External Stakeholders
    Industry counterpartsScout for equivalent or similar teams, understand their messages, evidence and stance. Make contact.
    Stakeholder MapUnderstand relevance, relationship, priorities and access. Build stakeholder profiles.
    Events & PlatformsUnderstand purpose, agenda, attendees, your message and funding.
    Engagement TrackerBuild a system to maintain records, actions, follow-ups, and consistency.
    Engagement PlanDecide who, why, when, where and the message required. Who will engage (role and seniority) and prepare talking points.
    Government & Agency contactsUnderstand the role, agenda, priorities and relationship with relevant government stakeholders. Make contact, build trust.
    Regulatory contactsUnderstand the role, agenda, priorities and relationship with relevant regulatory stakeholders. Who owns the relationship?
    Industry Associations / Interest GroupsUnderstand the purpose, agenda, attendees, message, anti-trust and funding.
    Standards BodiesUnderstand the role, influence and agendas. Who attends?

    Conclusion

    These are the headlines from a longer list. Feel free to contact me if you’d like to get into the detail and swap insights, and I’m always happy to receive ideas on useful elements to add.

    In summary, no plan survives contact with reality. The plan is quickly subsumed by formal top-down objectives and strategy.

    If nothing else, understand the team (morale, insights and challenges), operations (scope, threat, risk, controls and events), governance (decision making, reporting, compliance, opex/capex, commercial partners) and strategy (public affairs, communication, reputation).

  • Report from the Chatham House London Conference 2026: The Weight of Expectation on Middle Powers

    By Stephen Hermanson

    A Return to Chatham House

    It was a pleasure to return to the Chatham House London Conference last week (9 July 2026) – a key fixture on the geopolitical and international relations conference circuit.

    As in 2025, the scorching weather provided a fitting metaphor for the geopolitical climate, where temperatures continue to rise. As ever, Chatham House delivered a meaningful and effective event, navigating the weather, logistics and agenda with customary grace and efficiency.

    It was good to see a good spread of private sector attendees and those I spoke to in the margins were all assessing the likely impact of geopolitical outcomes and how to plan for resilience.

    The immediate backdrop to the conference in the days before, and reminder of the first and second-order stakes for organisations of all kinds, was the NATO Summit, continued breaches of the ceasefire between the US and Iran, the ongoing conflict in Ukraine and precarious condition of the US-China relationship.

    Middle powers (a central theme from 2025) are asking how to move forward from here, and how to make and re-make alliances, rules and norms to respond to conflict and US/China hegemony.

    Middle Powers and the Search for a New Framework

    A desire, tinged with anxiety and stubborn determination, for collations of middle powers (defined as effectively everyone else excluding the US and China) to unite with common cause to make meaningful progress against climate, inequality, migration, pandemics, proliferation1 and prosperity goals dominated the atmosphere. The tone revealed visible pressure and urgency to find a framework to pursue and maintain collective security through a patchwork of bilaterial agreements, and alliances such as NATO, the EU and Commonwealth. At the same time, there was a palpable sense that no one was entirely certain how this could be achieved. Some international structures would need to remain, some rebuilt, others created. No-one was saying that the existing order had to be entirely scrapped and nor could it continue without fundamental change – the answer, as ever, sits somewhere in between.

    Case Study: International Law

    International Law is an example of an established global framework that is currently under assault from misinformation and populism, that presents the rule of law as an obstacle instead of a safeguard by selectively ignoring and mis-representing the facts. Each assault on frameworks such as international law hollows out the confidence and trust in systems of alliances which are so important to the cause of collective security.

    NATO’s New Architecture and the Question of Trust

    News from the NATO summit was broadly positive – a commitment to Article 5 (including from the US) and a new architecture: to transform the alliance for war in the 21st century2, strengthen the EU-NATO political and military partnership to impose co-ordinated military and political effects, ensure clarity about what the alliance is defending (values and norms for the most part) and put revamped partnerships with the defence industrial base at its centre (leveraging private sector capital and pace). This is a significant transformation, and we heard NATO has a looming deadline. As things stand, Europe and NATO don’t own the clock – Russia does.

    A dilemma, that received widespread acknowledgement, is public grasp of the threat and appetite to invest in hard power. Given the outcome of discretionary interventions in Iraq and Afghanistan, many European societies are sceptical. Taking the UK as an example, the government’s rhetoric at the 2026 Munich Security Conference isn’t filtering into the Defence Investment Plan – which is subject to intense debate about the pace and scale of investments required for UK capabilities and contribution to NATO.

    Political and societal will to divert funding from areas such as welfare into Defence, requires society to trust that it’s necessary, and trust that investment choices are relevant and efficient. Efficiency has not always been evident when news of vastly expensive, overspent and delayed defence procurement initiatives filter into the media with disconcerting regularity. Worse still, many of these capabilities are for wars in the 20th century and sit awkwardly against the new architecture and paradigm for the 21st century that the UK Strategic Defence Review is reaching for.

    The issue compounds as societal trust underpins national resilience. As trust and resilience degrade, we enter a spiralling cycle that takes us still further from the credible deterrent (capable, confident and ready and willing to fight) that ultimately diminishes the likelihood of open conflict and existential demise.

    The new defence architecture is alert to the question of trust by responding to below threshold threats such as cyber and disinformation with an integrated strategy. In a scenario where Russia is able to pivot away from Ukraine (in the form of a settlement, ceasefire or obfuscation), the full weight of a mobilised Russian war economy and military apparatus could be directed at Europe. The consensus is that Europe is not ready for this scenario and would simultaneously be sequestered to enforce a settlement in Ukraine that diverts some of Europe’s best capability to that theatre, leaving gaps elsewhere. The gaps that Russia could likely exploit are small targets that probe the boundaries of US appetite to support a NATO response for small and insignificant (yet symbolic) pieces of European territory.

    Middle Powers, the Global South, and the Contest Between Washington and Beijing

    This context makes a strong case for collective security. There’s a lot resting on NATO’s transformation and alliance with the EU. Nonetheless, we’ve heard that NATO and the EU can’t stand alone and that Middle Powers need to expand and remake coalitions that respond to the changing global order.

    However, the North-South divide (and even divisions between Western allies) was on stark display in Ukraine. Europe stood by Ukraine on the assumption that the Global South would follow. The Global South has been and remains broadly ambivalent. This highlights the challenge facing the middle powers paradigm of collective security. It requires expedient alliances, recognition and tolerance for contradictions, and ruthless pragmatism in the face of dogma. All the while, middle power democracies will need to explain to their societies the need and purpose of the alliances they participate in – confronting prickly ideological, political and cultural differences. The unspoken disquiet in the room is whether there’s sufficient stakeholder capital to overcome (or overlook) sometimes profound differences in pursuit of a set of middle power alliances that can remake a new global order. It seemed that the experienced heads in the room were quietly confident that diplomacy and international relations can find a way. History tells us that it’s unlikely to be elegant, and the tradecraft to manage ambiguity and contradictions will need to be adept given the polarised geopolitical discourse we see today.

    Middle power coalitions may seek to leverage the institutions already available that have perhaps fallen out of fashion due to the bureaucracy and malaise that has infiltrated over decades. Afterall, our world is connected and no party has the luxury of retreating into blissful isolation. A new role for private sector stakeholders and in particular global technology companies is mooted – and precisely the reform that could unlock the defence-industrial partnership so essential for NATO, and unlock other features to make the new system of alliances and institutions more effective and efficient.

    Middle powers and private sector interests need to make a joint case, find ways to agree (on objectives, funding and resources such as energy), put aside differences (even ideological) and show how interventions create wealth and value in ways that have been increasingly absent as the current international order has declined. It’s possible to imagine a coming together in this way that resembles, perhaps unfairly, a kumbaya3. Pragmatism will need to do a lot of heavy lifting and progress will require battle-hardened CxOs, Boards, investors, diplomats, politicians and civil servants. However, there’s something else on the field of play that decides, is ever present and almost certainly looking to play a role – the US and China.

    We heard about China’s vision for a multi-polar world order – a remaking of the current global order to reform (as opposed to replace), and place China in a commanding position as a benevolent hegemon and rule-maker in the vacuum created by the current US approach – upending decades of established order since the Second World War. The decline of the current order perhaps started much earlier through military misadventures, financial crises, trade inequality and dare I say the European peace dividend that created an apathy towards hard power that we’re now realising is rather difficult to recover from.

    The prevailing view is that China is using an intentional trade surplus to ensure leverage, and influence the paradigm that emerges from the current world order. This paradigm will meet the middle power coalitions coming in the other direction and China will likely seek to reassure middle powers by charting a course that reverses the relative decline in global institutions as opposed to creating an entirely new order. It looks a lot like the benevolent role the US was seen to occupy (and many believe and hope can still occupy) during its tenure (some say hegemony) of the system. China sees a space to enter and offer a stabilising influence compared to current conditions precipitated in large part by the current US administration. One analogy offered is that China would “move into the house” as opposed to tearing it down4.

    So, it appears the success of middle power coalitions is predicated on the benevolent “house master” playing the role of referee, and the competing house masters (the US and China) rubbing along adequately. If so, then middle powers will need their best game to put aside differences and find a way of cohering and organising the coalitions that have such a heavy burden of responsibility thrust upon them.

    What This Means for Your Business

    At this point you’re possibly saying thank you for the contemporary history and reminder of the geopolitical tussles but, what does it mean for my business. Books continue to be released on this precise question, you’re likely to encounter many arm-chair experts (internal hubris is an important danger to be alert to), and you won’t need me to lecture you on the general points.

    However, stay engaged, and better still appoint a team to keep abreast of geopolitics and decipher how your organization might respond if it needs to. Even if first order implications might seem obvious (and sometimes they aren’t entirely obvious), second order implications can still surface risk. Even if mitigations are unnecessary and you decide to tolerate or bypass the risk (assuming you can in a global supply chain), use this team to inject rigour into the risk assessment and instil confidence that decisions are based on good intelligence, strong analysis, co-ordination with stakeholders (in government and industry), and record keeping of choices and actions can stand up to scrutiny over the medium to long term.

    Understand your red-lines and boundaries of pragmatism. As States try to reconcile differences to find solutions, you should have a clear stance on the trade-offs and compromises your organisation must tolerate to remain constructive and keep a seat at the table. This includes the arguments and narrative to substantiate value judgements in the face of opposition that is almost inevitable when expedient choices are necessary. As governments need to explain to societies the evidence for difficult choices, investors and other stakeholders will also expect credible explanations of red-lines and decisions your organisation arrives at.

    Understand your position relative to your customers, competitors, supply chain, lead government department and broader government strategy. This includes your position relative to the US and China and whether that surfaces any contradictions or ambiguities that undermine your stance. Understand how your mitigations or risk tolerance support or contradict stakeholder positions. Use your geopolitical team to study the long game and understand the real-politik and national security interests that may require a new calculus.

    If you’re in the defence industrial base or broader defence ecosystem, then the NATO reforms will clearly be an important agenda to follow. If you have a China supply chain, it’s worth bearing in mind that you’re part of the underpinnings of the China trade surplus that’s so important to the influence that China brings to reform of international relations and governance. You can argue the same is true for the US and simply substitutes a concern about trading US dependencies with China dependencies and vice versa. Either way, it’s useful to understand where you stand relative to the US and China, and to the EU Technology Sovereignty Package and ICT Supply Chain Toolbox in order to make informed decisions about partners, technology choices and operating models.

    AI Governance as a Litmus Test

    The remaking of a new global order with China and/or the US as benevolent house masters for middle power coalitions comes at the precise moment when global governance of Artificial Intelligence (AI) is front and centre of international debate. AI may offer a useful litmus test on the broader success of efforts to remake global governance systems. As you look at AI, ask whether the global dialogues are producing anything. Monitor how early initiatives such as the AI Safety Institute in the UK collaborate and secure agenda space as more initiatives come on stream such as China’s proposed World AI Co-operation Council. Watch for the role that the private sector takes and how States are integrating the private sector into governance, and above all accountability and responsibility for outcomes, safety and security. Ask what your own incentives and interventions might be, whether it’s commercial, ESG or something else.

    Footnotes

    1. Including nuclear, conventional arms and dual-purpose technology such as AI.
    2. Refer to the UK Strategic Defence Review for an example of the model required.
    3. A state of harmonious unity, especially one characterized as being naively idealistic and lacking meaningful substance.
    4. Seemingly confirmed by a recent CCP white paper (see the references below).

    References

  • The role of Public Policy

    How 2nd Line Assurance and Public Policy share a common experience

    By Stephen Hermanson

    I recently came across a very insightful piece on Risk Management and Assurance by John Sinden (Vodafone Group). I recognised the context and situation immediately, which has lessons for Public Policy too.

    Public Policy teams are facing similar challenges, so allow me to borrow from John Sinden’s excellent framing to illustrate the point.

    There’s a moment most people in a Public Policy role may recognise. You’re in a meeting, the business is moving fast, decisions are already forming, timelines are tight — then you speak up.

    Not to block. Not to control. But to ask what contribution is being made to government and regulatory agendas, what public policy and regulatory barriers might dilute or negate business outcomes, what intelligence should we gather to assess the likelihood and impact, what political incentives are we responding to, which parties and alliances are supporting and opposing our plans, what asks would we place on government or regulators, what evidence can we offer to substantiate our case, what solutions or mitigations might we propose, what narrative are we using to convey a holistic corporate position, what are the trade-offs (for us and others) if the business plan doesn’t succeed.

    You get the gist — how can we test and prepare the ground politically, diplomatically (for international considerations such as global supply chains and multinational customers) and how do we provide researched and proportionate public policy recommendations to achieve outcomes that matter.

    You don’t have a mandate to write or decide the business strategy or opine on how the business should operate. You’re not truly “in” the business. But you’re not separate either. You sit somewhere in the middle — close enough to understand, but distant enough to challenge — and provide the voice of government, regulators, communities and geopolitics at the table (and explain the merits of the business plan to these same stakeholders and other stakeholders as may appear).

    This may also mean dealing with hostility, disinformation and misunderstanding. Public Policy teams will want to get ahead of the arguments with a clear, accurate and timely narrative that can bring parties together and resolve differences. Where opposition remains, what strategy is required to manage this politically and through institutions that could influence the debate.

    And every day, you’re trying to get that balance right. The Public Policy intent is rarely what people think it is.

    It’s not about creating barriers, being pedantic or playing politics.
    It’s about making decisions stronger.
    It’s about helping teams see around corners.
    It’s about avoiding the conversations no one wants to have “later”.

    Too often, Public Policy teams are required to fight a rearguard action when it suddenly transpires that the business plan is facing political opposition, legal/regulatory constraints or barriers on trade. Politics and geopolitics can change suddenly and unexpectedly. Be that as it may, there are respected and established principles for taking into account the political, geopolitical and economic environments to understand the risks that might present themselves. Public Policy teams will be applying this lens to help the business navigate these waters. This may require policy change and the political appetite to support it. Some of this may need months of persistent and careful engagement to frame arguments, coalesce allies, build independent evidence and devise compromises. When Public Policy teams ask questions, they are thinking ahead to this moment and calculating what is essential to understand now.

    Security and defence sectors are particularly sensitive to this. Where the business plan, political and policy risk, and economic stakes touch on national security considerations, the stakes get higher still. Public Policy teams will take a calm, measured and evidence-based approach when activating relationships and access to warn of political or policy missteps that might have unintended consequences — in extreme cases causing harms to both industry and national security. Security Public Policy is increasingly on the agenda as governments seek to respond to national and economic security objectives. This cadre in the Public Policy team will understand the stakes, the trade-offs and the formula for charting a way through.

    When delivery pressure is high, challenge can feel like friction. When momentum is building, pause can feel like delay. When you hold the line, it can feel like you’re pushing back rather than helping forward.

    And so, Public Policy teams walk a constant tightrope:

    • Be commercial, but don’t dilute standards
    • Be close, but don’t lose objectivity
    • Be pragmatic, but don’t become irrelevant
    • Be firm, but don’t become “the police”

    It’s not an easy role. And often, the better you do it, the less visible it is.

    • The political and public policy risk that doesn’t materialise.
    • The external stakeholder issue that gets fixed early.
    • The narrative that gets sharpened before it lands.

    Those rarely get called out but, that’s where the real value is — bringing clarity, perspective, and calm thinking when it’s needed most. When that balance is right, Public Policy teams are no longer seen as the people who slow things down. We’re the people who help things navigate the political and public policy sphere — which no critical national infrastructure business can ignore.

    Over the last two and a half years my previous team and I designed and built Security Influence — an integrated Threat Intelligence, Government Engagement, Business Engagement and Public Policy team to provide the Security Public Policy cadre.

    Some lessons from the journey:

    • Strategy before tactics. Is this the fight to have at this time and place (and if so, how would we elect to fight and what resources are available to sustain it — including the political will internally). What does the strategy look like when modelled with an analysis of competing hypotheses? The purpose is to double-check assumptions, objectives, constraints and resist the temptation to respond until the threat/risk is clear.
    • CxO patronage. This provides reliable, regular and trusted access to the Executive Committee (ExCo) and Board, confidence to speak truth to power, and space to play the long game. If/when you decide to activate, you’ll need the ExCo to follow you over the parapet.
    • Also create a strategic communications and engagement plan for internal stakeholders. Public Policy teams will be expert at designing and implementing external communications and engagement plans. However, you’ll need to bring everyone in the business with you (don’t assume the merits and achievements are obvious to everyone).
    • Step outside the bubble. We spent at least 25% of our time engaging externally, beyond the organisation and sector. Perspective, context and comparison count for a lot but, internal communications and engagement are essential to package the message (so what; and then what), and CxO patronage provides the access and agenda space.
    • The Public Policy mandate overlaps with Corporate/External Affairs, Strategy, Risk and Corporate Communications. In the end, some parts were absorbed by these functions and other parts remained with us. Pin down an operating model and RACI as soon as you can (and test it in practice and with ExCo). Keep sight of the holistic view (golden thread) which is often lost when the model is over complicated or contested. See my blog for an entry on the special alliance between Security, Corporate Affairs and Compliance. This can easily be extended to incorporate Strategy and Risk.
    • Technology, Security and Operations will have subject matter experts that will often need to support content reviews, consultation responses and participate in engagements. This access needs to be reliable, authoritative and sustained. The biggest danger is a bottom-up approach that meets general resistance such as AI can do this, external agencies can do this, the SMEs can do it themselves, there’s no point as we can’t influence outcomes, this is not our fight, and so forth. Be prepared for this. If the ExCo isn’t batting for it, then reset.
    • Sceptics are inevitable. Resist the pressure to reduce everything to metrics. Measures of value in government relations and public affairs are often more nuanced. What counts is business appetite to engage (and belief in the Public Affairs mission and purpose), business appetite to play the long game (and invest in policy research and think-tanks) and ultimately the level of risk tolerance and knowing when that threshold is near. Public Policy is a social science — certainties are rare and your biggest critics will be those that struggle with ambiguity and the probability yardstick.

    References

    Sinden J. June 2026. LinkedIn.

  • A Year in Geopolitics

    19 June 2026

    By Stephen Hermanson

    Even a year in geopolitics might be considered a long time. At the Chatham House London Conference on the 20 June 2025, I reported on considerations for private sector critical infrastructure. A year on, I’ve returned to reflect on what’s changed.

    Part 1: Report from the Chatham House London Conference 2025 (20 June 2025)
    Part 2: Reflections a year on

    Part 1: Report from the Chatham House London Conference 2025

    By Stephen Hermanson

    Si vis pacem, para bellum

    This annual fixture is a good opportunity to take the pulse alongside others of a similar breed who are trying to chart and navigate the security threats stemming from geopolitical tension. As ever, a stellar line up and credit to Chatham House for a solid event in the unexpected heat atypical of the British summer.

    I stepped away reflecting mostly on the second plenary; Middle Powers: Reforming or remaking the Global Order? The panel presented a convincing case for the emerging role of Middle Powers (also recognising the definition of Middle Powers is varied and contested). On stage the representatives seemed aligned and capable. However, how does this pan out in reality where, for example, the G7 continue to pursue their interests, deals and spheres of influence.

    Who would be ready to act as referee and enforce the rules-based order the Middle Powers have in mind? The new concept for the Global Order extolled by Middle Powers (and a central pillar of China’s narrative and message to this camp) is self-determination for nations and a voice at the table (including setting the menu and eating the food as Ambassador Dino Patti Djalal expressed it).

    Middle Powers argue that the G7 lacks the capacity to find a consensus on the future Global Order, and Middle Powers have their own agency and can find a way through. I’m uncertain how this plays out with a G7 that’s wrestling with itself and others, potentially brushing aside the beginnings of a Middle Powers consensus and momentum.

    I couldn’t quite identify from the Middle Powers the appetite (political will) and resources (economic trade-offs) to see their vision of a Global Order prevail in competition with the G7, and to intervene to enforce their rules-based order when competition for resources and standards of living brings states into conflict. Put bluntly, I’m not convinced that Middle Powers would mobilise 3% of combined GDP to invest in Defence in a way that would allow them to prosecute a war against aggressors to the Global Order; least of all any of the G7.

    For the UK we heard that society has to recognise the quid-pro-quo necessary for the investments required to implement the insurance policy of the Strategic Defence Review. Middle Powers will have to do the same in my mind. Perhaps they are, and that’s commendable. The hard truth however (usefully articulated by Lt Gen Ben Hodges in the third plenary), is that many, including the UK and Europe, have done little to evidence the ability to prosecute a war to enforce the Global Order since the Second World War.

    For consensus to hold and the possibility of a clear signal to aggressors (covert or overt) it seems to me we should dust off the old adage – si vis pacem, para bellum. War is already upon us according to many. Diplomacy will play a part of course and the Corporate world has a role too. Let’s make it count.

    Part 2: Reflections a Year On

    By Stephen Hermanson

    Action this day

    It’s clear, a year on, that Middle Powers are struggling to make sustained investments in Defence and Security that exceed 3% of GDP (at least in the near to medium term). The private sector is investing in security too, although I’m yet to locate reliable numbers on the level of private sector investment in security as a percentage of market capitalisation – hoping this might offer a gauge to assess the relative scale of private and public sector investments. It seems to me these investments (public and private) ought to be co-ordinated and prioritised to prove and scale the best solutions in a timely way, especially amongst the Middle Powers that we hear must work together for the benefit of a future global order.

    Take the UK, for example; a Middle Power by most definitions but, also a G7 (and UN Security Council) member. This speaks to the broad definition of Middle Power and therefore the increased challenge of co-ordinating a consensus from a larger group of diverse members which themselves, the UK included, are wrestling with internal political and funding challenges.

    Recent comments by high profile figures such as ex-NATO Secretary General Lord Robertson and General Sir Richard Barrons, are sobering evidence that the UK Strategic Defence Review has not precipitated the transformation required despite the passage of a year. The subsequent resignations of the UK Defence Secretary and Armed Forces Minister add to the sense of unease.

    The MoD seems to be mounting a concerted defence of its programme to bring forward vital investments in areas such as drones. The private sector is investing heavily too, and here I’m sensing a potential gap in public-private co-ordination of investments to decide on the capabilities required and plans to scale and operationalise new technologies.

    The market is being trusted to surface the best solutions, which is fine but, are we confident the required capabilities will emerge in time? From where we’re stood now, it’s difficult to be entirely confident but, nor am I noticing a meaningful consensus on industrial policy amongst Middle Powers. In the UK, whilst we await the Defence Investment Plan and Defence Readiness Bill, the UK Research, Development & Innovation strategy will need to do a lot of the lifting.

    Winston Churchill’s “ACTION THIS DAY” label is one of the more enduring symbols of the Second World War. The labels were prepared by his staff and applied as part of office procedure, though the underlying impulse – his personal insistence on speed and his low tolerance for delay – will have given rise to a system that could cut through bureaucracy and hierarchy. It certainly feels like the same urgency and directness is needed now to bring Defence investment, in the UK at least, to where it needs to be.

  • Adrift on the Open Veld – drawing parallels with geopolitics today

    Book Review

    By Stephen Hermanson

    Adrift on the Open Veld – Deneys Reitz – Stormberg 1999
    ISBN 978-0-6202-4380-3

    12 June 2026

    I find it curious that throughout my primary and secondary schooling in South Africa (culminating in 1993) I can’t recall ever encountering this high-profile figure in the syllabus or in general conversation; and I suspect the authorities at the time felt the Reitz narrative painted a rather uncomfortable portrait of South African political history.

    Therefore, it was fascinating to find this author (recommended by an ex-Royal Navy colleague I’ve discovered has a knack for uncovering some gems – thank you Richard G). I decided to tackle all three volumes – Commando, Trekking On and No Outspan. Fortuitously it also coincided with a rare visit to South Africa to see my elderly mother. So, the scene was set for a sentimental journey.

    At the outset, it’s worth mentioning that many of the names and places that would feel very familiar to someone born and growing up in South Africa, would likely feel a bit obscure to others. This doesn’t detract from the story, and when we hear about the author’s role on the Western Front during the First World War, readers that are familiar with towns and villages in Belgium and north-west France will find themselves on familiar territory. Apart from the desire to reach for a map to help with orientation from time to time, the stories about geography and places don’t require intimate knowledge of the environment.

    This review will not re-tell or summarise the story, which accomplished reviews have done far better than I could attempt. The curious amongst you can easily obtain a synopsis from other sources, and possibly a favourite AI model could do quite a good job too. My reflections focus on what stood out to me on the question of geopolitics, over 100 years after the author’s accounts.

    Despite the passage of time, the backdrop was very familiar to anyone surrounded by the history of empire, commonwealth and the world wars. Also, the story of my parents and grandparents is a story of migration across the British Empire in the late 19th and early 20th centuries until the end of the Second World War. That’s a complicated story of British, German and Swedish heritage that requires an entirely separate analysis, which I’m sure you’ll thank me for sparing you.

    Allow me to share some observations and thoughts that characterise my conclusions following the read. I’m keeping this compact as this review (and apologies for not using the classic book review formula) is not pretending to be an exhaustive analysis which I’ll leave to academics. In summary, I noticed some things that might leave you wondering whether you’re reading the latest morning papers over eggs and bacon.

    • A global tussle between super-powers (The British Empire and Germany in this context) playing out in far off lands through proxies and expeditionary forces.
    • Strategic and systemic advantage in technology (such as horses to mechanisation) and scale (early globalisation) that ultimately renders all short-medium term tactical gains largely academic (in reference to the Boer cause in this context but, also feels close to home when considering the prospects of some current campaigns to arrest or marshal emerging technology).
    • The ceaseless march of technology and national/tribal identities as disruptive forces, often working in tandem to amplify effects (in this context the great tapestry of indigenous peoples in South Africa and interaction with equally diverse European cultures). Different groups rubbed along well enough and co-existed quite comfortably albeit with inevitable skirmishes from time to time. Despite conflict – and sometimes significant conflict – repair and restoration seem to prevail.
    • Access to resources such as land (for livestock and agriculture in this context), critical minerals (gold and diamonds in this context) and energy (coal and oil in this context). In some respects, the books make the world seem like a smaller place but already, the race for resources was responding to growing populations and middle classes that increasingly enjoyed the benefits of innovation and the natural resources needed to sustain them.
    • How swiftly alliances can shift and the pragmatism of realpolitik revealing how erstwhile opponents can find common cause (having fought for the Boers, the author explains in a fascinating account how he came to command a British battalion during the First World War). The books include a vivid account of post-war politics and how the deprivations of war, the challenge of government (as opposed to opposition), and shifting global orders strengthen and fracture alliances.
    • The manner in which people moved around the world (mostly by sea at that stage) and settled temporarily (and sometimes permanently) in countries that simply absorbed them (perhaps this was the privilege of a certain set with the right connections, backgrounds and funding). Nonetheless, the books give a strong sense of a world before passports, visas, and border controls as we know them. People travelled back and forth between Africa, Europe and North America in ways that would seem impossible now.

    Any of this sound familiar?

    Even the passage of 100 years or more doesn’t rule out clear parallels to the current geopolitical manoeuvring which we see playing out around us today. It would be nice to look at how previous generations navigated similar challenges and to understand where mistakes were made to avoid them in future. I’m sure scholars are doing this already and there’s no shortage of advice for international relations practitioners.

    The only certainty it seems is that the balance of power is shifting constantly, that in the moment it’s difficult to discern how the balance will play out, and the long game is very important. This is where institutions as opposed to personalities count. Where trusted institutions come under threat, or become jaded and inefficient, it’s incumbent on the prevailing generation of public-private partnerships to renew and revitalise their purpose and scope.

    Effective and robust institutions are born of political will and good policy choices informed by Public Policy tradecraft and International Relations. It seems to me the latter is having a rather rough patch at the moment (and more reason for organisations to build a meaningful response to prepare for the world that is emerging –

    “That gap is the problem. Different teams follow different sources. Few organisations have anyone responsible for geopolitics, let alone accountable for it. Boards are often briefed only once an issue has become urgent or a risk has become material. The result is fragmented understanding: leadership teams working off different assumptions, risks recognised too late, second- and third-order effects missed entirely, and major commercial decisions made without a common picture of what is actually happening.”

    Bruckard D. 2026

    The former will need to accept that despite the very polished and proficient policy analysis produced by the latest AI models (useful as that is), it’s the relationships and access that count –

    “AI is not simply changing public affairs. It is making clearer what has always mattered most – influence. When content is easy to produce, decision-makers have to rely more heavily on their sense of which voices are credible. A well-drafted document can be produced quickly. A trusted relationship based on mutual understanding cannot.”

    Cook G. 2026

    Relationships and access are as essential now as they were for Deneys Reitz.

    References

    Reitz D. 1929 and 1943. Adrift on the Open Veld – Deneys Reitz – Stormberg 1999. ISBN 978-0-6202-4380-3

    Bruckard D. 2026. Are you the “geopolitics person” at work? A simple way to help your organisation stay on top of geopolitics. https://www.geopoliticaldispatch.com/p/are-you-the-geopolitics-person-at

    Cook G. 2026. What AI Reveals About The Real Value Of Public Affairs. https://garystephencook.substack.com/p/what-ai-reveals-about-the-real-value

  • Cybersecurity

    Government Regulation over Market Incentives

    By Stephen Hermanson

    Public policy interventions in the form of security regulations need to be careful, surgical and consider harms that may arise from poor interventions

    4 June 2026

    Context

    “Last week at the World Economic Forum’s annual cybersecurity conference in Geneva, ISA President Larry Clinton and Joe Levey, President and CEO of Sophos, debated Hans De Vries (ENISA) and Megan Stifel (Institute for Security and Technology) on a question central to global cyber policy: Is cybersecurity best driven by market incentives or government regulation?” [ISA 2026, LinkedIn].

    “In a first for the WEF, the session used a true debate format with opposing sides rather than a conventional panel. The audience response was striking. Before the debate, participants favoured government regulation over market incentives by a 2:1 margin. By the end, the audience had nearly reversed course, expressing greater confidence in market incentives by the same margin.” [ISA 2026, LinkedIn].

    “The results speak for themselves: the more a sophisticated global audience engages seriously with the intersection of governance and technology, the clearer it becomes that the traditional regulatory model is a poor fit for the cybersecurity challenges ahead — especially as AI accelerates the speed and complexity of the threat environment.” [ISA 2026, LinkedIn].

    Introduction

    I was fortunate to contribute to this 2016 publication – The Cybersecurity Social Contract by the Internet Security Alliance [ISBN 9780692755037], so enjoyed seeing this debate and the outcome.

    Public policy interventions are designed to correct market failures. The question at hand is whether markets can produce good and appropriate cyber security outcomes. Therefore, public policy intervention in the form of security regulations needs to be careful and surgical.

    This reminded me of an assignment during a recent course at The London School of Economic and Political Science (LSE) in 2023, which I summarise in this article.

    Strategy to bring the issue to the policy agenda

    Policymakers may struggle to understand the causal relationships between better cybersecurity, market incentives and regulation. To reach the policy agenda it would be necessary to explain how a seemingly healthy cyber security market with many existing standards and regulations, alongside many established global players generating good levels of competition, innovation and resilience, would need intervention.

    Traditional risk assessments (likelihood vs impact) are guiding policymakers on the scope, timing and nature of possible interventions compared to competing priorities on the public policy agenda.

    For many countries cyber security is central to national resilience, and risk assessments are mature and routine. However, an assessment of the harm that may arise from poor public policy interventions is often missing. This can orientate policy makers and create better public resonance – important for a technical issue that’s prone to fast-moving issue-attention cycles.

    Stronger resonance is useful as it broadens the assessment of policy interventions to include other countries and jurisdictions. This includes ideological arguments (values & norms), technical/scientific arguments (risk assessments) or competitive arguments (economic & strategic autonomy).

    The agenda setting power is centred on national security agencies (with technical/scientific arguments) and political groups (with ideological arguments). Both groups use their levers of power to intervene through new or existing laws and incentives.

    This creates a competitive agenda setting process and prominent role for policy entrepreneurs seeking to align the problem, solution and politics. In the example of cybersecurity, the problem and political streams align naturally, but the solution stream may fall into and out of alignment quite suddenly as solutions are complex, and likely to see punctuated decision making as stakeholders realise that incremental decision making hasn’t kept pace with the policy issue.

    Factors to ensure successful policy interventions

    Cybersecurity is a complex policy issue with stakeholders across government, regulators and industry. Implementation requires extended intervention over years across different areas of the economy, and consensus on success metrics (how to know when security has reached an optimal level).

    Resource constraints and dependencies in this example are sensitive to funding (as intervention will require both private and public investments in financial, human & material resources) and co-ordination (spanning a wide group of stakeholders across the private and public sectors). As more actors become involved during implementation, having target groups and bureaucratic agencies take part in subsequent agenda setting rounds can help to mitigate implementation issues. Government convening power will play a vital role to ensure a good platform for cooperation between several different groups.

    With a prominent role for Industry as an agent for implementation (industry acting almost as street level bureaucrats in this example), the principal-agent dynamic will require a contract that balances Government monitoring and control with private corporate goals and fiduciary duties.

    Best approach for evaluation and possible constraints

    Evaluation should test a previously agreed hypothesis with a sample group in order to establish whether intervention is having a meaningful impact.

    An independent body will offer the best mechanism for stakeholders to join in a common evaluation project that builds trust in the evaluation process and findings (bearing in mind the information asymmetries and differences in interests between stakeholders). In this case the recommended form of evaluation is a cost–benefit analysis as this type of evaluation can compare the inputs and outputs of the intervention to assess its economic effectiveness. Economic effectiveness is likely to have a disproportionate influence in how cybersecurity objectives are achieved and maintained over the long term (and secure further political attention that may be needed as the policy cycle continues).

    Bounded rationality will place a significant constraint on policy makers given the duration and complexity of the interventions in this example. The use of experimental design for the impact evaluation can help to address policy maker bias (subject matter, beliefs systems or ideologies) and avoid situations where evaluation is used to justify political positions.

    References

    Bachrach, P. & Baratz, M.S. 1962. Two faces of power. The American Political Science Review, 56(4):947–952. DOI: https://www.jstor.org/stable/1952796.

    Cairney, P. 2012. Understanding public policy: Theories and Issues. London: Red Globe Press. Dahl, R.A. 1957. The concept of power. Behavioral Science, 2(3):201–215. DOI: https://doi.org/10.1002/bs.3830020303.

    Downs, A. 1972. Up and down with ecology – the “issue-attention” cycle. The Public Interest, 28(Summer):38–50.

    Howlett, M., Ramesh, M. & Perl, A. 2009. Studying public policy: policy cycles & policy subsystems. Rev. 3rd ed. Toronto: Oxford University Press.

    Kingdon, J. 2013. Agendas, alternatives, and public policies. 2nd ed. United States: Pearson Higher Education.

    Cobb, R., Ross, J. & Ross, M.H. 1976. Agenda building as a comparative political process. The American Political Science Review, 70(1):126–138. DOI: https://doi.org/10.1017/S0003055400264034.

    Hogwood, B. & Gunn, L.A. 1984. Policy analysis for the real world. Oxford: Oxford University Press.

    Lipsky, M. 1980. Street-level bureaucracy: dilemmas of the individual in public services. New York: Russell Sage Foundation.

    Bovens, M., ’t Hart, P. & Kuipers, S. 2006. The politics of policy evaluation. In The Oxford handbook of public policy. M. Moran, M. Rein & R.E. Goodin, Eds. Oxford: Oxford University Press. 319–335.

    Weiss, C. 1999. The interface between evaluation and public policy. Evaluation, 5(4):468–486. DOI: https://doi.org/10.1177/135638909900500408.