Image credit: Pexels

From AI-powered threat detection and quantum preparedness to continuous monitoring and smarter security cultures, five industry leaders explain why staying ahead of cybercriminals demands a proactive, business-wide approach.

As cyber threats become more sophisticated and automated, traditional security measures are no longer enough to keep organizations protected. Artificial intelligence (AI), emerging technologies, and increasingly complex digital environments are changing how attackers operate, forcing cybersecurity leaders to rethink their defensive strategies. Staying ahead now requires advanced technology, continuous monitoring, skilled professionals, and stronger organizational accountability.

Five cybersecurity and technology leaders share how they are adapting their approaches to confront an evolving threat landscape while balancing business priorities and budgets.

Fighting AI With AI

For Lukas Apynis, Senior Cybersecurity Engineer and SOC Manager at NOD Baltic, artificial intelligence has moved beyond being a supporting tool. It has become an operational layer within the cybercriminal arsenal. The emergence of threats such as “Prompt Spy”, an Android malware controlled by Google Gemini, illustrates how AI can facilitate autonomous attacks with limited direct human involvement.

Apynis believes organizations must apply the same scrutiny to AI agents as they do to privileged users, examining their permissions, access controls, and capabilities.

“Those agents should be treated like almost a human being. They should be reviewed — their permissions, the access controls, their skills, what can they execute?”

However, he cautions against overstating AI’s independence, noting that human involvement remains significant.

“There is some kind of AI bubble still. Human involvement is still 60% needed, or 50% at least. We still need trained engineers who can use these sophisticated tools and take proper action.”

For Apynis, the response should be accelerated defense through intelligent automation.

“AI helps to spot anomalies where humans could take more time. So you basically have to fight with AI against AI.” 

Preparing for the Quantum Threat

At FNTS, VP of Security and CISO Don Pecha focuses on two emerging challenges. First is AI-driven attacks that evade traditional signature-based detection, and the second is the potential disruption quantum computing could bring to modern encryption.

Pecha predicts that the convergence of AI and quantum computing around 2030 could expose sensitive enterprise information on an unprecedented scale.

“Once the true quantum computer is enabled, and they are talking about a convergence where AI and quantum converge in roughly 2030, all the secrets across enterprises could be discovered overnight.”

His approach centers on documentation and accountability. FNTS uses a POAM (Project Application Operational Actions and Milestones) to identify vulnerabilities, record risks, and track remediation.

“We have a POAM — project application operational actions and milestones. What that does is it allows us to document everything that we find in our environment, identify the risk, and then over time document the progress.”

Pecha also makes the business case for investment by highlighting the long-term financial consequences of a breach.

“My peer likes to say we are a cost prevention center, because the current state of a breach, depending on your size, is at least $20 million. It is because of all the associated costs over four or five years.”

Moving Beyond Compliance Checklists

Rich Sowalsky, Partner and Risk Advisory Practice Leader at Centri Business Consulting, identifies another weakness. Sowalsky noticed that some organizations approach cybersecurity as a compliance exercise rather than an ongoing responsibility.

“Companies are treating cybersecurity as a check-the-box item or a compliance item — do a single assessment and put it on the shelf. That starts getting in trouble, because they are not actually keeping up with the risk landscape.”

Sowalsky advocates continuous, evidence-based monitoring. Security tools are insufficient unless organizations can show that alerts receive attention and lead to appropriate action.

“Can you demonstrate that your controls are actually there and operating effectively? Sometimes you say you have a cyber-monitoring system, but that system gives alerts on a daily basis. Are you actually taking those alerts and doing anything with them?”

For organizations facing budget constraints, he recommends achieving 90% of a best-in-class security program, where the cost-benefit balance is strongest. He also sees room for optimism because many attacks exploit preventable human weaknesses.

“The vast majority of attacks are not the zero-day that no one knew about. It is usually human controls that have fallen through. And that can be addressed. So that gives me hope.”

Closing the Gap Between AV and IT Security

For Denis Shapovalenko, CEO of DEKOM USA, staying ahead also means addressing vulnerabilities created by fragmented technology environments. Historically, audiovisual (AV) infrastructure operated under separate standards from enterprise IT, creating gaps in network management and security.

The shift toward integrating AV systems into enterprise IT frameworks, including appropriate networks, subnets, and VLANs, is helping eliminate those inconsistencies.

“AV was always a question of dual standards, where AV had their own standards and IT had their own, and there was always some kind of conflict or misalignment. Right now it is getting more and more centralized into IT, which is good because AV is being aligned with IT — including assigning AV equipment to the right networks, subnets, and VLANs.”

Shapovalenko identifies employee-targeted attacks as a major concern, particularly as AI-generated phishing becomes harder to recognize.

“Most of the risk comes from the human side — from phishing attempts, from manipulation of employees using emails, using messenger, using anything that is human-oriented. With the growth of AI, this has become significantly more difficult to distinguish and to explain to employees.”

He also breaks down security exposure across three stages. The initial design accounts for approximately 50% of risk. Configuration and commissioning contribute 30%, and ongoing support and maintenance account for the remaining 20%.

“The design phase holds about 50% of risk in everything, because the way the system is designed initially dictates how it will be supplied and installed later on. Configuration and commissioning — about 30% of the risk. And 20% goes to the support and maintenance phase, because that is where firmware and software updates happen, and those updates generally address security issues.”

Making Security a Business Enabler

Russell Moore, Senior Security Solutions Architect at Myriad360, highlights two challenges organizations cannot afford to overlook. One is shadow AI, and the other is gaps in software-as-a-service (SaaS) security.

Employees may use publicly available AI platforms to process confidential business information, creating the possibility of unauthorized disclosure.

“Even though leadership may not have an AI initiative at a business function level, chances are a large amount of their employee population is leveraging what is publicly available with AI, interacting with data that may have some level of confidentiality to it. There is a potential for unauthorized disclosure of customer information.”

Moore also warns against assuming cloud providers take complete responsibility for security.

“SaaS posture is a huge one. A lot of people have this misconception that if they go to the cloud or an as-a-service solution, security is just part of that. If you read the fine print, almost all these cloud solutions have a shared security model — and there is definitely a customer responsibility.”

He argues that security teams must move beyond simply restricting activity and become partners in business growth.

“Security cannot be an organization that just says no anymore. It has to be part of the organization that enables people to work in a modern workplace and enable modern features that are force multipliers for the organization, and balance the risk that comes along with it.”

Security Is a Continuous Process

For these five companies, cybersecurity is not a passive compliance exercise or a collection of defensive tools. Organizations aiming for uninterrupted growth must continuously reassess risks, integrate emerging technologies, strengthen human oversight, and ensure security measures keep pace with business operations.

Whether deploying AI to detect threats, preparing for quantum computing, continuously monitoring controls, or closing gaps between technology systems, these leaders are approaching cybersecurity as an evolving discipline.

The challenge is no longer simply responding to attacks. It is anticipating how threats will change and ensuring that people, processes, and technology are ready before attackers find an opening.