Nova Blue Technologies - How Defence Can Harness AI Without Creating New Risks
In this episode we talk to David Collins OBE at Nova Blue Technologies, to explore some of the fastest-moving challenges facing defence and critical industries.
We discuss whether AI is democratising offensive cyber capabilities faster than organisations can respond, how human error continues to underpin many successful breaches, whether cybersecurity awareness training needs a complete rethink, and how defence companies can harness AI without creating new risks.
Find Out When New Episodes Get Released: https://www.millilux.io/mailing-list
Production, Design & Artwork: HIATUS ↗ The Defence Design & Communications Agency
Find Out More: https://www.nova-blue.com
You Might Also Like:
-
00:00:01 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Hi, welcome to the Future Frontiers podcast from Millilux.io.
00:00:05 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
In this episode, we talk to David Collins, OBE, at Nova Blue Technologies to explore some of the fastest moving challenges facing defence and critical industries.
00:00:13 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
We discuss whether AI is democratising offensive cyber capabilities faster than organisations can respond, how human error continues to underpin many successful breaches, whether cyber security awareness training needs a complete rethink, and how defence companies can harness AI without creating entirely new risks.
00:00:44 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Hey Dave, thank you so much for joining us on the Milux podcast.
00:00:48 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Thanks for having me.
00:00:50 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I realise it's probably a very busy day for you as we're in a while before September kicks off again.
00:00:56 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So I guess really, could you give us like a really concise one minute introduction to yourself, please?
00:01:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, sure.
00:01:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the bulk of my career thus far spent in the Royal Air Force.
00:01:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I served in the UK Royal Air Force for 18 years.
00:01:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I started off as a communications electronics engineer officer, and then that sort of transformed into the cyberspace profession.
00:01:16 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So that was where I finished up.
00:01:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And as with any military career at that length, across a number of different areas, so frontline units, so I commanded the RAF cyber defence and network operations wing, spent time in operational headquarters, bit of time in the intelligence world.
00:01:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I had a brief diversion as a posture interpreter attached to the Royal Marines, but that's an entirely different podcast, I think.
00:01:37 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
That's a different discussion.
00:01:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Because that's a bit of a damage, but and then left the military coming up on two years ago now.
00:01:46 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And when I left, I joined a company called Nova Blue Technologies.
00:01:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So that's a small cyber security company, Anglo-Canadian company, but largely based in the UK.
00:01:56 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And our kind of core interest is in
00:01:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
defence and national security, although we do work in other sectors.
00:02:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And our main thing we do is this idea of cyber security as a service where we take the cyber security problem off people's hands, we work as their cyber security team embedded.
00:02:13 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So we don't just advise, we do, we get hands on keyboards and do the work.
00:02:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that's everything from kind of technical stuff, but also we can support compliance and policy and process.
00:02:24 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, brilliant stuff.
00:02:26 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Fantastic.
00:02:26 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Well, I mean,
00:02:27 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
One thing that always kind of jumps out to me, I'm really excited to get kind of specialist experts like you on the podcast because you bring a level of knowledge that is very hard to find, I think, in the civilian world.
00:02:36 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And I often have friend conversations with mates in the Marines now and actually one of the conversations that always comes up is actually there's always a bigger interest now in the comms signal specialisation rather than 10 years ago when I left.
00:02:49 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It was seen as a very different beast.
00:02:52 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But you can see the demand in the civilian sector now and all across defence for that cyber knowledge, that communications, that signals.
00:03:00 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And it's a much more attractive specialisation, I think, for the military now.
00:03:06 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So yeah, it's always good to get experts like yourself on the podcast.
00:03:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And if I just reflect on that briefly, throughout my military career, one thing I found really interesting was, when I joined, it was very much I was an engineer, professional engineer, got a degree in electronic engineering, was a chartered engineer, and it was very much seen as a, supporting role.
00:03:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
By the time I left, my last job was as the chief of staff in
00:03:30 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
what's now the Defence Cyber and Electromagnetic Force Headquarters, a two star operational headquarters.
00:03:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it was very much treated as that.
00:03:37 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
The two star commander sat around the table with the component commanders from land, air, maritime and then space as well.
00:03:43 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, we were at that table as the cyber defence kind of component very much as an operational activity, not a supporting function to the others.
00:03:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that's one of the things I've sort of tried to take forward into civilian life is, this isn't about technology.
00:04:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's about operational risk, business risk.
00:04:05 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And these things affect every facet of business.
00:04:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's not just a sport for the technologists.
00:04:12 Speaker 3
Yeah, for sure.
00:04:13 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, I think I'm just going to go one further there, as I can see, as we can see with Ukraine at the moment at the last
00:04:18 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Five years is actually is arguably, I'm going to put this out there, is it probably land, land and maybe maritime actually take us a slight step further back from the table actually, and cyber cyber is the one kind of taking the prime position in it because everything now stems off cyber rather than being its own sort of separate components, so I kind of seem like a almost like a whole 180 in terms of the domains.
00:04:44 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But I realised time is against us this morning, so I'm going to roll into my first question if that's okay.
00:04:48 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And ask you for your take on NATO and Europe's rearming efforts right now, please.
00:04:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, I mean, there's a lot in that, isn't there?
00:04:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
That's another whole podcast on its own.
00:04:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I guess, I mean, I'm going to avoid the obvious kind of transatlantic debate because there's been so much said about that.
00:05:05 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I don't think I need to say more about that.
00:05:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think what I would reflect on is
00:05:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
As I look at conversations that we're having professionally, but also just, reading the press and seeing what's going on, I think nations in Europe are starting to wake up to the fact that there is a real threat.
00:05:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
My worry is, do we understand what that threat actually is and how it's going to manifest itself?
00:05:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So on one hand, there's a lot of reliance on traditional platforms still, you know, big capital projects, you know, like the big fighter jets or warships or whatever,
00:05:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
which have their place, but are they the most pressing challenges?
00:05:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I don't know.
00:05:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Maybe not.
00:05:46 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think the other thing at the other end of the spectrum is I do think there's a danger we learn the wrong lessons from Ukraine.
00:05:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, you know, there's so much rich seam of learning that we can do and, you know, not forgetting that the Ukrainians are paying for European security with their blood at the moment, you know, that we can't get away from that.
00:06:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
but they're also teaching us at the same time.
00:06:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
We've got to learn the right lessons.
00:06:11 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
For me, the biggest single thing that we need to learn and therefore we need to factor into the rearming across NATO and Europe is the pace of innovation and adaptation is the battle winning capability.
00:06:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, yes, the focus is on drones at the moment, and I think that will be, various forms of autonomous and uncrewed platforms will clearly be decisive on whatever battlefield in whatever domain, and that includes cyber in that, by the way, you know, agentic cyber, which we're going to talk about later on, but actually it's
00:06:43 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
The key thing for me is the ability to adapt quickly, to field new capabilities quickly, to change what's there.
00:06:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that's the thing I think we've been really bad at across NATO and Europe.
00:06:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think we're going to have to get better at if we've got any chance in the future.
00:07:02 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Real quick, if you want to hear when new episodes and articles are released, be sure to sign up to our newsletter at the Mililux website or find a link in the show notes below.
00:07:10 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Otherwise, back to the episode.
00:07:13 Speaker 3
Yeah, for sure.
00:07:14 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'm talking to you right now from Northern Europe, Northeastern Europe, should I say, another kind of Nordic area, and actually we kind of see the scale of change at a phenomenal pace.
00:07:25 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
they're kind of digging tank traps, setting out drone system, comes drone systems, comes to US systems, and really adapting to this changing world that we're now living in.
00:07:35 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But yeah, thanks so much for your take on it.
00:07:38 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
That's fascinating.
00:07:39 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Agreed.
00:07:41 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It does.
00:07:42 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
We had Perry from Mits Capital on the last podcast and he echoed something largely the same is that Ukraine at the start we were, you know, we were giving lots of weapons, lots of training and now actually it seems that's the script has been flipped now where actually we're gaining more from them in terms of the current operating environment than we're able to kind of like bring to the table for them.
00:08:04 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So it's, yeah, it's a fascinating time.
00:08:08 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
We're here to kind of talk about kind of cyber AI and the confluence with defence.
00:08:12 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So, I mean, AI is making phishing malware reconnaissance faster and more convincing than ever.
00:08:19 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Do you think defence companies are underestimating how AI is democratising offensive cyber right now?
00:08:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, I mean, 100%.
00:08:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
because it's a really complex problem to get your head around because of so many facets to it.
00:08:33 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I think I'd take that a step further.
00:08:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I'd say it's not actually just defence companies.
00:08:38 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's critical infrastructure, logistics, I mean, even retail, manufacturing.
00:08:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, two things on that.
00:08:47 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
First of all, well documented last year, some big
00:08:52 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
really impactful cyber attacks.
00:08:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I don't need to tell you and your audience about that.
00:08:56 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I think the thing I find really interesting in this space is it come back to Ukraine again.
00:09:00 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So look at what's happening right now and the recent shift in Ukrainian tactics to attack retail and logistics.
00:09:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And of course, the defense industrial base being attacked on both sides as a critical target.
00:09:14 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Now, clearly that's a kinetic war.
00:09:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
That's a conventional war.
00:09:17 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Missiles are flying.
00:09:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
factories, warehouses are being destroyed physically.
00:09:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Take that into where we are in UK and wider Europe.
00:09:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Okay, the missiles aren't flying now and hopefully they won't be any time soon.
00:09:33 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But those same targets, those same capabilities being tested every day in cyberspace.
00:09:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So
00:09:41 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
the ability of an adversary to undermine the defence industrial base, absolutely, but also logistics, just that way of life, from things like, if all the supermarkets were shut down simultaneously, how long would it be before we were having a real disruption in day-to-day life?
00:10:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then what would that do at a level of decision making in governments?
00:10:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What,
00:10:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What crisis would that be masking somewhere else?
00:10:12 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And so I think this idea of kind of national resilience with the defence industrial base has got an absolutely critical part to play in that, both in terms of how it supports that national resilience, but also the resilience of defence companies themselves.
00:10:26 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I think there's definitely a wider picture here.
00:10:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think again, I think we can learn from what's happening in Ukraine on that front.
00:10:34 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, for sure.
00:10:35 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And I'll tell you what, when you're saying then that you reminded me actually of the time during COVID when, for example, toilet rolls were, there was panic buying of toilet rolls and pasta and all sorts of staples.
00:10:48 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And it reminded me of that actually is that you could use AI to mask, like you said, that there's grazing activities whereby the attack on the supermarket isn't necessarily the main thing.
00:11:01 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It's there to mask
00:11:02 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
and distract from the actual other main thing, which is going on the Ukrainian battlefield or perhaps incursions into NATO airspace or, et cetera, et cetera.
00:11:15 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It's easy to see how you can now compound them together to say, right, in order to make this thing successful, we're going to do a big faint distraction in cyberspace and, you know, and then simultaneously somewhere else and somewhere else.
00:11:28 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So it's almost that conventional
00:11:32 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
chain is now getting longer, more sophisticated, more advanced, and also from a legal perspective, I'd say harder to quantify as conflict, as you know, as illegal, because it tiptoes this line.
00:11:45 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
You know, we've had experts from kind of GCHQ on the podcast a few episodes ago who spoke about the use of kind of like, you know, rogue agents in across Europe or people who are just, you know,
00:12:01 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
in need of money, and then we'll start doing doing a tax for hire, so it's there's a real, and I think more and more so the British public is kind of waking up to this now, as the messaging is getting sharper and more acute, I'd say, in international media, so it's good that you got people like you to be able to kind of like say, This is how this would help other things happen, you know, and how we have a slide into a much murkier space.
00:12:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think, I mean, I do think, I think you're right in terms of the messaging.
00:12:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I do think, I do think that the political climate or the information, environment is so challenging now because trust is such a big issue.
00:12:47 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And, I'll talk about trust probably later when we think about what we can do about some of these things from a digital and cyber security point of view, because digital trust is absolutely critical.
00:12:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But more broadly, just human trust.
00:13:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
what message are people hearing, receiving?
00:13:04 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Where are they getting that from?
00:13:05 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What do they trust?
00:13:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What do they believe?
00:13:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And ultimately, kind of who benefits?
00:13:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
That's the question I always ask myself when I see these stories is, who benefits if, I don't know, we're all getting distracted because Nigel Farage is running a by-elect against a dustbin.
00:13:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, like, okay, you know, there's a kind of brilliant British zaniness about that, but ultimately,
00:13:30 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
if that's distracting people or, whatever story might be being pushed, whether it's about migration or whether it's about, the cost of living or whatever else, manipulating that message.
00:13:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I would have sound like a conspiracy theorist or tinfoil, but I think the reality is it is so much easier now to have those kind of effects and impacts.
00:13:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What's harder is to
00:13:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
get to the truth, get to an understanding of where these things have come from, what they're driven by, as I say, who kind of benefits.
00:14:03 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So it's a really, it's a really difficult, a really difficult challenge, I think.
00:14:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And ultimately, you know, what do people care about?
00:14:13 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Well, individuals probably primarily care about, you know, what's the price of fuel at the pump or what's the price of supermarkets.
00:14:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Businesses are going to care about what are the things that are going to mean they can advance their business or whether the threat's going to be
00:14:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And when you aggregate all that picture up and then sort of bring in a government level, I think there's a real challenge there to sort of join those things together and help people understand what the linkage is between the war in Ukraine and the price of fuel or, what's happening in the Middle East and,
00:14:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
just cost of living stuff, and then what do we do about it?
00:14:52 Speaker 3
For sure.
00:14:53 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And I was thinking I'd love to get you on the podcast actually in the future with one of our speakers from the GCHQ community.
00:15:01 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I think you guys would be a really interesting kind of conversation around different steps in terms of, you know, in defense.
00:15:11 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I just want to pivot slightly back into AI again, because I realize it's going to be quite a main theme.
00:15:17 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
There's a lot of information out there to suggest that breaches begin with human error, that gap in the fence metaphor, so to speak.
00:15:25 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
As AI generated phishing becomes more impossible to separate from real communication, do you think cyber security needs to rethink and adapt to this changing threat environment?
00:15:37 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think it does.
00:15:38 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think there's a couple of aspects here.
00:15:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So first of all, this is a well-documented thing where human vulnerabilities are often the ones that are the easiest to attack.
00:15:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So looking back at the Marks and Spencer attack, for example, last year, already touched on that.
00:15:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Ultimately,
00:15:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
The starting point for that was not any kind of sophisticated cyber attack.
00:16:03 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It wasn't some super sophisticated digital capability.
00:16:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It was a human talking to another human and conning them, convincing them to do something they shouldn't, which was to give out his credentials.
00:16:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But you know, the art of a human con man
00:16:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's not a new thing.
00:16:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
This is not a new concept.
00:16:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And for as long as people have been able to communicate with each other, I would argue they've been deceiving each other.
00:16:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And those who've been good at it have made out extremely well over the years.
00:16:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So we mustn't forget that kind of human element is often the start of the chain.
00:16:41 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's definitely something about equipping people to kind of combat that threat.
00:16:47 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So
00:16:49 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
moving on from the traditional thing of spot a phishing e-mail by looking for the grammatical mistakes or the, weird kind of identifiers that might be in that whatever.
00:17:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think, clearly the world has moved on from that now.
00:17:04 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it's those days are largely kind of gone.
00:17:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So what it then becomes about is helping people to ask questions, to think critically, to verify, come back to that trust point I made earlier.
00:17:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
rather than just trying to spot a phishing attempt.
00:17:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, there's some well-documented examples now, for example, of people being convinced either through an e-mail conversation or even through what looked to be a completely legitimate video call like we're doing now to, you know, to transfer, you know, X million pounds out of the account because they thought they were talking to the CFO and actually they weren't.
00:17:41 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It was a deep fake.
00:17:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the only real way you can combat that is by arming people
00:17:49 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
to ask questions, to verify, putting processes in place that money doesn't get transferred unless it's XYZ.
00:17:56 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But this is really difficult because people are going to feel under pressure.
00:17:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
If you've got what you think is the CEO or whoever jumping up and down at you saying it's absolutely critical you do this thing now, then people are going to be under pressure.
00:18:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So arming people to be ready for that and just understanding what is possible
00:18:14 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think is a big first step in that.
00:18:16 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So that's one aspect of it.
00:18:18 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I do also think that we need to recognize and be kind to people and recognize this is really hard.
00:18:26 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And even people who are really aware of this, who are very switched on to what can be done, can still fall victim to it.
00:18:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Because ultimately, humans have lapses, tired or distracted, or just
00:18:42 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
get conned, if it's going to happen.
00:18:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, going back to kind of air power thinking of the 1930s, I would say this is a former Royal Air Force officer, but the idea that the bomber will always get through and therefore it becomes about defence in depth, layered defences, assuming that, as you say, that there will be a gap in the fence and somebody's going to get through it again.
00:19:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What do you do then?
00:19:04 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So this is where
00:19:05 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Your defense in depth is absolutely critical because if that first step does fail and the human is compromised and gives away those credentials, okay, well, what else is in place then to manage that risk?
00:19:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So how are you controlling access?
00:19:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
How are you managing and checking identity?
00:19:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
How are you ensuring that
00:19:30 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
data or files or information can't be accessed by people who shouldn't access it or people don't have administrative privileges when they shouldn't.
00:19:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's a lot that can be done to build layered defences.
00:19:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And yes, there's always the chance that the holes in the Swiss cheese will align and that somebody will get all the way through and that's going to happen.
00:19:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And AI is going to make that easier.
00:19:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But
00:19:56 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But the combat to that is by making the holes as small as possible and putting as many layers in place, recognising that one or more of your defence mechanisms might fail.
00:20:07 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So you know, we're always interested to hear from organisations that want to contribute their thoughts to our articles.
00:20:12 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
If this is you, send it to the e-mail newsletter to stay up to date on what we're working on.
00:20:16 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
There's a link in the show notes.
00:20:18 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Otherwise, back to the episode.
00:20:21 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, So you're saying kind of a two-pronged approach.
00:20:24 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So making people more aware that these attacks happen regularly, scrutinizing communications, then also ensuring that organizations themselves are more sophisticated in terms of their network access, their privileges, their data protection, their processes on, for transactions, for example, on, they've got multi-factor
00:20:50 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It sounds silly saying it out loud, but having multi-factor authentication set up in various places, and actually that kind of defence in depth where actually you then start to overlap those gaps in the Swiss cheese metaphor, so that actually it makes it as hard as possible.
00:21:09 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Actually, somebody will try and just go somewhere else.
00:21:12 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'm guessing they'll probe, they'll check, they'll test, they'll check, and then if they're if they're if you're making it too hard for them, then they'll presumably just go to someone else.
00:21:20 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
else and another organization.
00:21:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And also if some of your controls do fail, then you've got other things to fall back on.
00:21:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And a lot of those things are really foundational, right?
00:21:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
They're not, those aren't like super advanced, agentic threat detection tools or, the whizziest
00:21:42 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
your kind of AI-powered SOC or whatever, a lot of these are foundational things that people should have in place.
00:21:49 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So you mentioned multi-factor authentication, but it still remains one of the best defenses in terms of protecting identity.
00:21:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Now you've got, you know, not all multi-factor authenticators equal.
00:22:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So, you know, things like text message or phone call based, you know, are so easy now to overcome.
00:22:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
pass keys are, the sort of latest recommended.
00:22:12 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I know there's some stuff come out even the last couple of days about some vulnerabilities.
00:22:16 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's always been this cat and mouse thing.
00:22:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But ultimately, I think using, the foundational technology that's available is a really good starting point.
00:22:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And something any business, but particularly those in this kind of defence sector who are at an increased level of threat, should be thinking about.
00:22:34 Speaker 3
Yeah, for sure.
00:22:35 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And I think you go back to our earlier conversation about kind of the supply chain isn't necessarily you wouldn't necessarily attack the organisations that are the most sophisticated to, kind of like get into that network.
00:22:47 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I guess you probably you probably go for those a bit further down the tail, for example, and get in through the supply chain because then you obviously affect everything that's a bit further upstream.
00:22:55 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So I think in some ways it's almost the SMEs that have got more to worry about than those who are, you know, front of house in the defence sector.
00:23:04 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Definitely, agree with that.
00:23:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I mean, the supply chain risk is one of the big themes of cybersecurity in the last couple of years.
00:23:11 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So who have you granted access to or who could feasibly get access to your system but are outside of your immediate security bubble?
00:23:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then how do you control that interface?
00:23:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So again, come back to the Marks and Spencers, you know, that was an outsourced
00:23:26 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
IT help desk that created that vulnerability.
00:23:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
it wasn't it was an internal team that's that their third party IT help desk gave away that information and then they that allowed somebody to get into the core system.
00:23:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So how are you managing?
00:23:42 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
your third-party risk and that supply chain is going to be really interesting.
00:23:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that sort of leads on to some of the defence compliance stuff that we might talk about a bit later and how that kind of flows down through the chain, through the primes and into the SMEs.
00:23:59 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, for sure.
00:24:01 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Well, I think it would be it would be not to kind of like at least acknowledge something big that's happened over the last kind of like a week or two when it comes to kind of AI and cyber security, and that is
00:24:10 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
kind of the agentic attacks we've seen over, especially over the last kind of seven days.
00:24:16 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
We've seen how they can discover and exploit security weaknesses autonomously, and actually we saw where ChatGPT agentic model broke out and attacked Hugging Face, another company, and
00:24:31 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
reports following on from that suggested the same was Anthropic as well.
00:24:34 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So kind of the agents are kind of breaking free, so to speak.
00:24:38 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But how do you think defense organizations should balance the opportunities and risks that come with autonomous kind of cyber agents?
00:24:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, I mean, so some of that kind of links to what we've just previously discussed.
00:24:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the principles of how you defend are still true.
00:24:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What has changed is the pace and the scale.
00:24:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the pace at which the
00:25:00 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
the agentic attacker can operate, a machine speed, not human speed, but also the scale of being able to deploy multiple parallel agents, which if you were doing that in human terms, you'd be talking about hundreds of experts operating together on a single target.
00:25:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So it's
00:25:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
it has massively increased the scale and pace of the threat.
00:25:26 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the Huggy Fest example you just used, I think they recorded something like 17,000 individual actions that the agents had taken against their infrastructure.
00:25:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But the point still stands that if you have laid defences, if you are verifying before allowing access, if you are assuming compromise at various layers, then
00:25:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
then you can protect your key information, you can ensure that those things that you really need to protect remain protected.
00:26:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So if we keep looking at that example, yes, they were breached, but I've not seen anything yet that suggests there was actually any major impact of that.
00:26:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
No customer data was leaked, no
00:26:13 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
intellectual property, as far as I know, was accessed.
00:26:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So yes, they were inside Hugging Faces systems, absolutely, and shouldn't have been.
00:26:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But if that impact is managed, then to an extent, that's sort of expected.
00:26:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, you're never going to stop everything.
00:26:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So therefore, it becomes about having those layers in place.
00:26:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
The other thing I'll just sort of spin on this bit slightly is thinking about how
00:26:42 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Agentic AI is used inside systems as well, because I think that's another really important facet of this.
00:26:47 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And of course, when you get such big stories that make such an impact that are on the front page of BBC News, there's a danger that becomes then the focus of everything and you kind of forget about other things.
00:27:00 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I think there's something really important here about how organisations
00:27:05 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
are using agentic AI themselves and how they're introducing those risks internally.
00:27:11 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So effectively, you're doing the job for the attacker and you're creating a vulnerability inside your system.
00:27:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think there's something really important about being deliberate and mindful about what AI capabilities you're introducing and what you give them access to.
00:27:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Again, fundamentally, the principle I'd use here is
00:27:33 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
treat them as untrusted.
00:27:34 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
if you brought a brand new employee into your organization where you hadn't built trust, you hadn't necessarily vetted them maybe, and also you hadn't verified that their outputs were going to be accurate, so new intern or graduate, whatever joining the team,
00:27:52 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
you're not going to give them access to the crown jewels on day one, nor are you going to trust everything they produce on day one and just send it out to your clients or whatever.
00:28:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You're going to verify, you're going to check, you're going to build trust over time, you're going to compartmentalize so that they can just get access to the bits they need to.
00:28:12 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
why would we not do that with the robot that's inside the system as well?
00:28:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think there's something really important that people, and again, on a practical level, people can do, which is, things like separating identities so that AI agents are not operating using the same identity as a human.
00:28:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So by that, I mean, literally creating separate accounts in your systems so you can grant access in a more granular level to
00:28:37 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
the AI agent.
00:28:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And you can also audit it and check, what's kind of been happening and verifying the outputs of those agents before they go into your workflow, whether that's code or whether it's, customer facing product or whatever it might be.
00:28:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But just effectively having that mental model of, okay, this is an untrusted, unverified actor
00:29:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
inside our systems, and we need to treat it as such, and yes, build trust over time, but also recognise that you're never going to never going to have that complete trust because you don't know what's inside the inside the box.
00:29:15 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, that it brings brings to mind the old airlock analogy, where you would, you know, you wouldn't obviously grant access straight into like the crown jewels, but you'd have an airlock system where actually your airlock kind of like firewall system actually where things are
00:29:31 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
breaches can be compartmentalised.
00:29:34 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, and I like the other metaphor about it kind of being referred to almost like a new employee is that you wouldn't just open up everything to kind of a new employee until they can build trust and shown that over time.
00:29:46 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So, I agree that's quite a good strategy for kind of how companies might bring in on the future, especially when the pace of defence is moving very, very quickly right now is that you can think
00:30:00 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
You could put out, you could do a lot more workload using agents, but first we have to make sure that actually it's safe to use them inside something so sensitive like defence.
00:30:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, absolutely that.
00:30:11 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think, you know, there's lots of, again, this is not new conceptually.
00:30:16 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think this is the danger with technology and particularly technology that
00:30:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
that is so impressive that it basically looks like magic.
00:30:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But it's just evident with us, every new technological advancement has kind of baffled and bamboozled people until they've kind of normalized it.
00:30:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think, again, just the pace at which that development is happening.
00:30:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But the concept of building trust or how do you grow an organization?
00:30:43 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
For example, if you outsource a function, okay, well, who are you outsourcing it to?
00:30:49 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What have you given them access to?
00:30:52 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What information have you given?
00:30:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
This is pre-AI days, just in a more general sense.
00:30:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think there's lots of mental models that we can use.
00:31:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think it's important to just take those mindful steps and think about what we're giving access to rather than
00:31:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
a conversation I had with someone recently who said, hey, look, I'm testing this new kind of AI assistant platform that's going to capture everything I'm doing and then, you know, give me summaries of my day and then help me capture the actions.
00:31:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I was like, great, how's it doing that?
00:31:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What's it got access to?
00:31:23 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Oh, it's just recording my screen.
00:31:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's recording everything that's on my screen at any time and then turning that into, you know, kind of actions.
00:31:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I'll be like, yeah, I don't think that's a good idea.
00:31:38 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
so the temptation is there to test out the wizziest new tool.
00:31:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And organisations absolutely should do that.
00:31:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I mean, we are heavy users of Claude in our business.
00:31:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it has transformed the way that we operate.
00:31:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's transformed the way that we manage our knowledge, the way that we structure some of our kind of processes and workflows.
00:32:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But we have to absolutely have kind of trust and verification at the heart of that.
00:32:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
and really think about, what have I asked, what question have I asked here, and how am I using the information I've got back?
00:32:16 Speaker 3
Yeah, for sure.
00:32:16 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, you have to excuse the laughter in the background there.
00:32:20 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'm just thinking back to an earlier podcast that we had on data sovereignty with another former army officer.
00:32:27 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And we're just thinking then about how the kind of lack of understanding about kind of who owns data, you know, especially when it comes to
00:32:35 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Sorry, a screen recorder which is capturing everything that you're talking about and then who is a recipient of that and who owns that data that they've just they've created from it.
00:32:46 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It's exciting and terrifying at the same time and this seems to be like a theme I kind of bring across every podcast right now.
00:32:55 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But anyway, from your experience, how can defence organisations turn strong cyber maturity into genuine advantage when bidding for defence contracts or working with defence?
00:33:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, that's a really good question.
00:33:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I mean, so the first thing is being completely transparent.
00:33:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Like I wish that there were a stronger signal here from MOD and the primes on this.
00:33:17 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, I think it would be great if this were an even stronger consideration in the process.
00:33:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Because the reality is that structurally, the way the system has been set up in terms of the MOD cybersecurity model is I still think there's not enough emphasis on this.
00:33:38 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's still possible for a company to
00:33:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
to submit effectively a non-compliant cybersecurity posture and alongside A cyber improvement plan to say how they're going to get there.
00:33:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I don't think there's a strong enough kind of feedback loop on that yet that is actually going to go around and check.
00:33:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I do think that's changing and that the momentum is gathering on this.
00:33:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So a couple of things that are important in this space, and I won't get down a massive rabbit hole on this, but I think it's important, is so when the MRD updated its cybersecurity model
00:34:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
December last year to version 4, which is now in force, there was a really important shift, which was the shift away from purely thinking about what they call defense identifiable information.
00:34:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, you can hear the capitalization of the acronym there.
00:34:23 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
As we know, anybody loves a good acronym.
00:34:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But into a broader consideration of operational organizational resilience.
00:34:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So if you're in the defense supply chain, can you
00:34:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
in the face of likely cyber attacks, carry on doing what you need to do and supporting the mission and how resilient are you.
00:34:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then there's risk profiles that go with that to say how resilient you need to be and how much risk is there.
00:34:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think that's a really important shift.
00:34:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that is now, you know, that is absolutely enforced and every contract now has this cyber risk profile attached which has implications for that.
00:34:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I think that what companies can actually do here is to be proactive.
00:35:04 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So if you're waiting for a clear demand signal and a contract that says cyber risk profile, you know, one, two, three, whatever, before you even start thinking about this, I think those are the companies that are going to struggle.
00:35:20 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think those organizations, they're going to try, you know, they're going to be rushing around
00:35:23 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
trying to put things in place that are not going to stand up to the test, that if they are checked and audited are not going to be valid.
00:35:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So things like the defence cyber certification scheme, which came along at the same time as the new cyber security model, I think gives companies opportunity to get ahead of the curve and to show a clear commitment.
00:35:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it doesn't have to be
00:35:47 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
really difficult.
00:35:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the higher levels of that scheme are challenging.
00:35:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And there's a big dialogue going on between the industry base and MOD, a kind of policy level about, have they got this right and what's the burden going to be and who's going to pay for it and all the rest of it.
00:36:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But if you draw it back to the kind of foundational levels, so the
00:36:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
The statement from Defence has been, we are asking, not telling, asking all Defence suppliers to achieve level 0 of the Defence cyber certification by 31st December 26.
00:36:21 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Now that's not going to be a contractual condition yet, but it is a show of the directors of travel.
00:36:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that is not a huge burden.
00:36:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So basically to get that level 0 certification, you need cyber essentials, which clues are the name.
00:36:34 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Everyone should be looking at cyber essentials because it's some really good foundational things.
00:36:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You need a GDPR kind of data protection policy, which again, I would argue everybody should have that in place.
00:36:46 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then you need effectively to be able to prove an element of cyber resilience.
00:36:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
That's things like, have you got backups?
00:36:52 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Have you got a plan?
00:36:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
in place for if something goes wrong, what are you going to do?
00:36:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's not a huge bar to get over.
00:37:00 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think that I would be advised, I do advise every organisation that is either in the defence supply chain or has aspirations of being in the defence supply chain, whether that's dual use, new companies, whatever it might be, whatever size, to get on that journey now and start working towards
00:37:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
DCC level 0 because that does two things for me is the controls that are in particular cyber essentials are genuinely good.
00:37:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, if you, it's always a starting point, don't get me wrong, you know, like I said, the clue's in the name, it's the essentials.
00:37:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's not, it's not.
00:37:35 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's not the finished product by any stretch of imagination, but it's a good start.
00:37:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's some good security stuff in there, like separating administrative accounts from regular user accounts, like ensuring multi-factor authentication is in place across all services.
00:37:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, good foundational, sensible things to do.
00:37:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But it also then gives you, know, the badge and the real show of intent.
00:37:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
that both makes it easier from a process point of view, but also I think demonstrates a kind of commitment and an understanding that cyber resilience is important.
00:38:07 Speaker 3
Yeah, for sure.
00:38:08 Speaker 3
Yeah.
00:38:10 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Some of those basic kind of like digital hygiene, like
00:38:16 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
What activities?
00:38:17 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I think it is something that kind of a lot of all companies should have, like I said, the very basics, and like I said, the clues entirely is essentials, which means is just that is a base minimum doesn't necessarily mean it's the targets to aim for, it's actually that's the very basis where you should be.
00:38:34 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So, yeah, it's useful for anyone studying out, I think, in defence or kind of business at large.
00:38:42 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I jump on to my kind of penultimate question though, because I realize time's against us now.
00:38:45 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So I think if you could change one thing about how defence organisations design their cyber security systems, what would it be?
00:38:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Can I have two?
00:38:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But they are late.
00:38:54 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, sure.
00:38:55 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, of course.
00:38:57 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And I think some of this we've already kind of covered.
00:38:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I'll just try and distill it down.
00:39:01 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So the first thing is like start early.
00:39:03 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, don't wait for that for the tender or don't wait for somebody to tell you you need this in place.
00:39:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And by starting early, I don't mean jump straight into trying to get like a certification or something.
00:39:14 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I mean, start doing some actual security, some fundamental things.
00:39:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So we've mentioned a number of these already, multi-factor authentication.
00:39:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Don't give admin privileges to everybody.
00:39:27 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Or, you know, just from the very start, if you're managing your own IT, take that deliberate step of creating yourself an admin account that has got
00:39:38 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
the admin privileges, but the only use when you need to have admin privileges, and then a day-to-day user account, which does not have any admin privileges, and that's what you're using every day, and that's the one that's going to potentially be phished or people are going to try to have malware.
00:39:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then if that does happen, then the blast radius is limited because it doesn't have admin privileges.
00:39:59 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Like anyone can do that themselves, and it's a good starting point.
00:40:03 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So starting early with some of those foundations, but also
00:40:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
recognizing that the complexity will ramp up pretty quickly.
00:40:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So that's one, is start early.
00:40:12 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then the second point is, thinking about that journey.
00:40:17 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So yes, the compliance bits are important and companies are going to focus on compliance because that's the thing that's going to get them over the line with the contract or a bit or whatever.
00:40:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But recognizing that there is a really important other reason to do this cybersecurity stuff.
00:40:34 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And that's because there is a real threat.
00:40:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
We've talked about it, I think, enough throughout the rest of this.
00:40:40 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
There is a genuine threat to the defence industrial base, which is more acute than other sectors because any business is a threat, right?
00:40:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Any organisation, individual is a threat.
00:40:52 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Criminals will try and extort anybody, you know, they'll try and exploit whatever they can.
00:40:56 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's that.
00:40:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
A lot of defence companies are operating with technology.
00:41:03 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So they've got valuable intellectual property or valuable ideas.
00:41:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's the espionage threat.
00:41:08 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
People might try and steal those ideas.
00:41:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And then there's a whole bit that we talked about earlier in terms of resilience and disruption.
00:41:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And a defence company sits absolutely at the centre of all three of those.
00:41:19 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So it's not enough to just look at this through the lens of this is a compliance exercise.
00:41:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
This has to be a broader
00:41:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
operational risk management exercise.
00:41:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So thinking in those terms and as organizations grow and change, as they come out of stealth or receive some funding or announce a new product or their capability gets deployed for the first time, all of those things materially change the cybersecurity calculus.
00:41:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And being aware and alive to that as organizations go through that journey is going to be really important.
00:41:56 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, for sure.
00:41:57 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'm just thinking about how many startups we talked to that both in stealth and kind of recently out of stealth and one of our regular conversations is, don't wait to start thinking about your own resilience because you need things like managed IT services, for example, your just having this stuff backed up is because at that moment you get traction in a market is your focus will be to keep pushing that traction up and it won't be the case of
00:42:26 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
build a strong foundation with which to, protect employees' livelihoods and your reputation and all of the income in five years' time.
00:42:36 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But it's absolutely vital, like you say, is that to get it all in place before actually then start scaling because you'll be you'll be thrown into kind of warp factor 5 and offer a trajectory of 1000 gazelles to use the older military adage.
00:42:51 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But yeah.
00:42:53 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And just on that, there's a couple of aspects to that.
00:42:55 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So one is a practical one, which is at the point at which you're maybe going to close that funding round or launch a new thing, is the time when you've got the least capacity to think about this stuff.
00:43:09 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
There's also like the technological reality, which is the earlier you start this, the easier it is to do.
00:43:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's much harder
00:43:17 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
when we go into an established company for us to go and unpick months or years of poor practice, but also culturally as well, how are you setting up that kind of organisational culture right from the start?
00:43:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And there's also a cost thing as well.
00:43:31 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So if you build this in early, it doesn't have to cost a huge amount.
00:43:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Trying to retrofit it later is almost always more expensive.
00:43:42 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I accept that there's like funding flows and people might not have
00:43:46 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
the funding right at the very start.
00:43:48 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But actually, if businesses can find a way of carving out a small amount of money, we've got a company we're working at the moment who, your classic kind of defence tech startup in that it was a chap, left the army, got his hands into cool tech, had a use case, recognised that this was important.
00:44:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So right at the very start came to us when he literally had a, you know, kind of a domain name and a Gmail account and that was sort of it.
00:44:16 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And we set him up with a secure environment to grow his business in, built that security provision right from the very start.
00:44:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
He's now our eight employees, I think.
00:44:28 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
He's got a couple of big contracts.
00:44:30 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
He's on the pathway to get all the certifications.
00:44:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it's just been so much easier process for everyone involved because we've been able to grow his cybersecurity posture with him as his team grows, as his business grows, as his posture and profile grows.
00:44:44 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's harder to do that as a retrofit and more expensive.
00:44:47 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, and I think you kind of look at the organisational cost that comes with, if you're trying to change a culture with, one to seven, 8 employees rather than 800 or, more is of course you're going to be, it's going to be a huge cost if you're trying to get
00:45:06 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
hundreds of people trying to do something differently in, it might be something that takes milliseconds every single day, but those milliseconds add up.
00:45:13 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And that's when you start to get kind of employee churn increase.
00:45:18 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
You start to get people who are probably like rebelling against it.
00:45:21 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
And yeah, agreed from the very start is the, you know, a stitch in time saves 9, I think is something my mother used to say, which actually just is, you know, something we apply to kind of business and
00:45:34 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
security policies like these as well.
00:45:36 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, definitely.
00:45:37 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I realized, just to jump on to my final question before I let you go, if that's OK.
00:45:40 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
If we're having this conversation in five years' time, what do you think we'll be talking about?
00:45:46 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I mean, honestly, who knows?
00:45:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, the world is so volatile, but also technology is moving so quickly.
00:45:58 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there are a whole range of
00:46:00 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
technologies that we could talk about.
00:46:02 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So I think, quantum is still a buzzword.
00:46:07 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think we still don't really know what it's going to mean.
00:46:10 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But at some point, that's going to start to make a difference.
00:46:13 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
It's going to start to make a meaningful difference.
00:46:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Clearly, the pace at which AI models are progressing from a technology standpoint, I think one of the big things in that is going to be
00:46:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
more at a kind of policy or kind of regulation level.
00:46:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there's a lot of discussion at the moment.
00:46:39 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
There's a really interesting kind of think piece called Europe 2031, which you don't know if you saw, which basically posits a scenario where we as Europe, and I do deliberately say we as Europe there.
00:46:50 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Again, that's a whole other podcast.
00:46:54 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
we as Europe don't do anything that alters the current trajectory of all of the centre of gravity for frontier AI is in the US and China.
00:47:06 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
You know, project forward five years, what does that look like and what does that mean?
00:47:12 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And it's a bit of a doomsday scenario, but in a scenario where we are so completely reliant on those two powers,
00:47:23 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
for all of the access to frontier models and the kind of underlying infrastructure, what does that mean for cybersecurity?
00:47:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What does it mean for national security and defence?
00:47:32 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
What does that mean for economic security?
00:47:34 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Because if all of the value is being created through the use of these frontier capabilities and we don't own them, then what does that mean for society?
00:47:45 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
So there are some really, really big questions.
00:47:49 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But I guess if we were
00:47:51 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
talking on a podcast about cybersecurity, I would like to think that some of the things I'll be saying would be the same, which is that some of the fundamental principles that have always applied still apply, which is defence in depth, verification of identity, controlling access, recognising that layers of your controls might fail, recognising that people will make mistakes,
00:48:15 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
But that's because it's really hard for them.
00:48:18 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think all of those things are still absolutely going to be true.
00:48:22 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I think which would be how that manifests, how they're implemented, and what the threats look like, they'll be different.
00:48:30 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Yeah, for sure.
00:48:32 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'll make sure we link to that document in the show notes as well, because that sounds like an interesting read.
00:48:37 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
But I think from an economic perspective, for sure, you can imagine just how if we don't keep up or we're not trying to develop, then essentially kind of the two big powers will kind of own all of the things which we come to rely on and which are going to be customers for everyone.
00:48:55 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So brilliant stuff.
00:48:58 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
I'm just going to finish off with a big thank you for giving up your time to kind of share your expertise with us and the audience around cybersecurity, AI, defence and the confluence of all three.
00:49:09 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
So Dave, thank you.
00:49:10 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
Thank you very much again for joining us.
00:49:12 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
We look forward to getting you back on the podcast in the next kind of 6 to 12 months and hopefully there won't be any huge changes or events that have taken place in that while anymore.
00:49:22 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It's more of just an update.
00:49:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
No, great.
00:49:24 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Well, thanks for having me.
00:49:25 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
I've really enjoyed the discussion.
00:49:26 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
Yeah, really happy to come back and have another chat.
00:49:29 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And yeah, who knows, I'll probably be proven completely wrong and it'll all be completely different.
00:49:34 David Collins OBE at Nova Blue Technologies, HIATUS x Millilux.io defence innovation podcast
And let's see what the next, you know, the next big headline-making story about the AI apocalypse is.
00:49:42 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
It was really great chatting with David.
00:49:43 Chris Shirley MA FRGS, Website Developer, Communications Specialist and Brand Designer at HIATUS _, The Defence Design and Communications Agency
If you want to find out more about what they're working on Nova Blue Technologies, check out the show notes below and we'll see you next time.
