Topic starter
06/11/2026 6:38 pm
TL;DR: Late-2026 cyber risk is being reshaped by AI-assisted social engineering, supply-chain exposure and tighter regulation, with third-party involvement now cited at 48% of breaches and up 60% year over year, according to Cowbell. The practical issue is no longer annual review cadence but continuous risk governance across the policy lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Cowbell: “Looking Horizon-Bound: Navigating Cyber Risk Through 2026 & Beyond”.
By the numbers:
- The Cyber Security and Resilience Bill 2026 mandates strict 24-hour incident reporting, according to Cowbell.
Key questions
Q: How should teams verify executive or vendor requests before approving them?
A: Teams should verify executive or vendor requests through a separate, trusted channel before approving them, such as a known call-back number, encrypted messaging on a registered account, or a workflow that requires dual approval.
Q: Why do third-party access paths create so much NYDFS compliance risk?
A: Because the regulation holds the institution accountable for delegated access even when a vendor or partner operates the system.
Q: What is continuous cyber risk governance?
A: Continuous cyber risk governance is the ongoing process of identifying, prioritising, tracking and evidencing cyber risks and controls as systems, threats and business changes occur.
Practitioner guidance
- Tighten verification on high-risk requests Require out-of-band confirmation for payment changes, password resets, new payees and vendor bank-detail updates before approval.
- Inventory third-party access paths Create a live register of MSP accounts, SaaS administrator roles, API credentials and support channels with named business owners.
- Shorten offboarding for external trust relationships Remove delegated access, dormant integrations and unused partner credentials as soon as the business need ends.
Bottom line: AI-assisted impersonation is making trust validation a core control problem for SMEs, not just a user-training issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI has changed the trust test, not just the spam filter. The security problem is no longer whether a message looks suspicious to a human eye, but whether the organisation can prove the request belongs to a legitimate workflow. That shifts the control burden toward stronger verification for payments, vendor changes and credential resets. Practitioners should treat synthetic trust as a governance issue, not a user-awareness issue.
A question worth separating out:
A: Organisations should prioritise identity and authorization capabilities when remote work, SaaS sprawl, and expanding tech stacks make access control the main pressure point. If the security problem is who can reach systems and data, identity-centric controls often deliver faster risk reduction than adding more perimeter-focused tooling or point products.
👉 Read our full editorial: Cyber risk is shifting toward AI, supply chains and regulation