Category: UK
-
Reflections from the 2026 GZERO Summit in London on whether a Middle Powers coalition can overcome the prisoner’s dilemma of breaking ranks, what variable geometry would need to succeed, how the US and China see it, and five practical steps for business.
-
Critical National Infrastructure Civil-Military Cooperation September 2026 By Stephen Hermanson Introduction My previous blog (Design Basis Threat and the Threshold Gap) about the MI5 Director General’s call for government, business and academia to treat national security as a shared endeavour generated significant interest. Given the level of traction, there appears to be more appetite for…
-
MI5 has called for national security to become a shared endeavour. But CNI operators already work to a formal ceiling on what they must withstand alone — Design Basis Threat — and no one has a protocol for the gap above it, as the Jaguar Land Rover attack showed.
-
The UK’s Defence Nuclear Enterprise is Critical National Infrastructure facing the same technology and supply-chain risks telecoms has already regulated for. Comparing the Astraea warhead programme to the Telecommunications (Security) Act 2021 playbook, this post argues for extending the Office for Nuclear Regulation’s existing remit rather than building a new regulatory regime.
-
A practical, tested 90-day framework for standing up a new threat intelligence, security public policy and government relations team for critical national infrastructure — covering role administration, team fundamentals, and internal and external stakeholder engagement.
-
Reflections from the 2026 Chatham House London Conference on the weight of expectation now resting on middle powers, NATO’s new architecture, the US-China contest for global order, and what it means for organisational risk teams.
-
Public Policy teams occupy a structural role not unlike 2nd Line Assurance in risk management — close enough to understand the business, distant enough to challenge it. Drawing on John Sinden’s framing, this post explores the tightrope, the value, and the lessons from building a Security Influence function.
-
Drawing on a WEF cybersecurity debate and public policy theory, this post examines how to bring cybersecurity regulation to the policy agenda, ensure successful interventions, and evaluate outcomes.
-
How a dedicated Security Public Policy cadre connects SecOps, Compliance and Corporate Affairs to shape — rather than react to — legal and regulatory change.
-
A framework for assessing the organisational impact of the UK security and resilience legislative agenda, using the Cybersecurity & Resilience Bill as a worked example across nine strategic lenses.
