I read Richard Horne’s recent speech on the state of the UK’s cybersecurity landscape, and I have to say, it was one of the more sensible, thought-provoking, and refreshingly direct assessments of our industry I’ve heard in a long time.
Horne is the UK’s National Cyber Security Centre (NCSC) CEO. NCSC is the UK’s technical authority for cybersecurity.
He started with an unusual analogy. The 1998 film “Sliding Doors”.
For those who haven’t seen it, the film follows two versions of a woman’s life. In one, she catches a train. In the other, she misses it. One seemingly insignificant moment changes the course of her future.
Horne’s point? We are at a “Sliding Doors” moment in cybersecurity.
And I think he’s absolutely right.
For years, we’ve talked about cyber threats becoming more sophisticated, more frequent, and more damaging. Now AI has arrived, and suddenly everyone is talking about an entirely new era of cyber risk.
But here’s what struck me most about his speech: AI isn’t necessarily creating new vulnerabilities. It’s making the vulnerabilities we’ve ignored for years easier to discover, faster to exploit and possible to attack at an unimaginable scale.
Think about that for a moment.
We’ve spent decades building increasingly complex technology environments, often on foundations that were never designed to support what we now expect of them.
End-of-life infrastructure. Unpatched systems. Devices nobody knows exist. Access granted because it was convenient rather than necessary. Operational technology (OT) connected to networks without adequate visibility or protection.
As Horne described it, we’ve been getting away with “tech on the cheap”. And now we’re building the AI revolution on top of those very same foundations.
He compared it to the Leaning Tower of Pisa. An extraordinary structure built on foundations that simply weren’t strong enough.
It’s a brilliant analogy.
Go deeper: Join our webinar: “Exposed OT, Real-World Consequences: Is Our Food and Water Supply at Risk?”.
OT in the Spotlight
The bit that really resonated with me? OT.
Horne specifically called out the systems that control our physical world. Electricity. Water. Manufacturing. Heating. Refrigeration. Industrial processes.
Systems that don’t traditionally sit within the IT security conversation but increasingly sit on the very same connected networks.
We’ve seen the consequences recently with refrigeration systems being disrupted across Europe. And yet, how many organisations still treat OT security as somebody else’s problem?
How many know exactly what’s connected to their networks, what those devices are doing, whether they can be trusted and, crucially, what happens when something goes wrong?
You cannot secure what you cannot see. And simply seeing it is no longer enough.
Where Forescout Fits in All of This
This is where I find Horne’s speech particularly interesting. Because at Forescout, we’ve been talking about these challenges, investing in the technology, and helping customers address them for years.
Long before AI became the headline of every cyber security conference. For over 25 years, our journey has been built around a relatively simple belief: Every connected device matters. Every connection introduces potential risk. And every organisation needs to understand what is connected, what it’s doing, and whether it should be trusted.
We’ve spent years helping organisations discover and classify devices across IT, IoT, OT, and IoMT environments. Identifying exposures, understanding behaviour, and providing the ability to control, segment, and contain threats before they become business-wide incidents.
And that journey continues.
From network visibility and control to exposure management, threat detection, dynamic segmentation, and automated response.
It’s no longer just about knowing what is on your network. It’s about understanding the activity, the context, the risk, and the trust associated with everything connected to it.
And increasingly, changing the speed at which organisations can respond.
That’s the foundation we’ve been building. Not because AI suddenly made it fashionable, but because the fundamentals of cybersecurity have always demanded it.
Learning from “Sliding Doors”
Horne finished with a powerful observation. There may come a day when the choices available to us have passed. The doors have closed, the train has left, and the conversations are no longer about what we should do, but what we should have done.
That should resonate in every boardroom.
We don’t have a shortage of cybersecurity technology. We don’t have a shortage of warnings, research, or evidence. What we sometimes lack is the willingness to act before something goes wrong.
AI will undoubtedly change our industry. It will accelerate both attackers and defenders. But it won’t magically fix weak foundations, unknown assets, or poor operational decisions.
The organisations that succeed won’t necessarily be those investing the most in AI. They’ll be those that have built the strongest foundations upon which to use it.
At Forescout, we’ve been on that journey for more than a quarter of a century. And there’s still a huge amount more to do.
The doors are still open.
The question is whether organisations choose to get on the train. Or wait until it’s too late.
Explore Forescout’s OT Security solution and Forescout Vistaro™ platform.
Richard Horne NCSC Annual Review 2026 Speech: FAQ
Q: What is this speech and when was it given?
A: It is the speech given by Richard Horne, CEO of the UK National Cyber Security Centre (NCSC), on 3 November 2026 at Nova South, London, to launch the NCSC Annual Review 2026: The State of the Cyber Nation. The review covers the NCSC’s tenth year, from 1 September 2025 to 31 August 2026.
Q: What is the central message of the speech?
A: Horne argues the UK is in a “Sliding Doors” moment, a point where seemingly small decisions shape the future. The choice is whether organisations and the nation reinforce their technology foundations now, before crises force action, in a world of increasingly capable AI.
Q: Why does the speech reference the film “Sliding Doors”?
A: The film’s theme is that seemingly inconsequential moments and decisions can alter the trajectory of a life. Horne uses it as a metaphor for the choices the UK now faces on cyber security, and closes by urging the audience to be the generation that “got on the train”.
Q: Does AI create new types of cyber risk?
A: Horne says the immediate cybersecurity risk from AI is not new. AI has not invented new ways to attack. Instead, vulnerabilities that have been tolerated for too long can now be discovered and exploited at a scale and pace that was once unimaginable.
Q: What does Horne predict for the coming months?
A: He says there is a real prospect of an unprecedented rise in the number of cyber incidents in the coming months, driven by AI-enabled discovery and exploitation of existing vulnerabilities and by weak technology and operational foundations across organisations and supply chains.
Q: Why does Horne compare the situation to the Leaning Tower of Pisa?
A: The tower is famous because it was built on flawed foundations that could not bear the weight placed on them. Horne uses it to warn that AI is being built on the same weak technology and operational foundations, and that society must reinforce them so it does not build a “digital Leaning Tower of Pisa”.
Q: What does “tech on the cheap” mean in the speech?
A: It describes decades of under-investment in technology. Examples given: keeping end-of-life systems running for another year, postponing needed upgrades as a cost efficiency, suppliers failing to invest in security by design and default, not investing in technology across its lifecycle, granting access for convenience rather than necessity, buying services on price alone without asking whether they are resilient or secure, and not putting monitoring in place to detect failure.
Q: What are the “fundamentals” Horne says organisations must get right?
A: He describes cybersecurity fundamentals as technology and operational fundamentals. He points to the foundations championed through Cyber Essentials and calls them fundamental requirements, not desirable features, for resilient businesses in an AI-enabled world.
Q: What does the speech say about operational technology and physical systems?
A: Systems that automate physical processes, such as electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls, are not seen as traditional IT and are not built on strong foundations. Their resilience and security is even more overlooked in investment decisions. Horne cites the disruption of refrigeration units across Europe as an example of this exposure being exploited.
Q: Who does Horne say is responsible for improving UK cyber resilience?
A: He says everyone has a stake: every person, every organisation, technology providers and frontier AI labs. He warns that leaders who do not make different choices now may later have to explain to investors, shareholders, employees, customers, suppliers, families and friends why they failed to act despite knowing the consequences.
Q: Which threat actors and threats does the speech mention?
A: Russia, through campaigns that deliberately fall below the threshold of armed conflict as part of hybrid warfare; Iran, which continues malicious cyber operations globally, including against the UK and individuals seen as a threat to the regime; criminals conducting “smash and grab” ransomware attacks that threaten to publish stolen data to extort victims; and China.
Q: What does Horne say about China and AI?
A: He says China highly likely has the intent and is best positioned to use AI for operations against UK critical national infrastructure and other strategic targets. He describes its activity as the most sophisticated and sustained cyber challenge the UK faces.
Q: How does Horne describe AI’s role for attackers?
A: AI is a set of machine processes that may never mean harm, but in the hands of hostile actors it can act as a force multiplier, increasing the speed and scale of adversary operations.
Q: How can AI help cyber defence according to the speech?
A: Horne says AI has the potential to be one of the greatest opportunities in cyber defence because it allows vulnerabilities to be found and fixed faster than ever. He notes that major technology providers are fixing hundreds of vulnerabilities in a single update and that the Linux Kernel Project patched more than a thousand vulnerabilities in the previous month.
Q: What specific actions does Horne want organisations to take?
A: Invest urgently, without delay, in replacing end-of-life technology; make critical physical systems inaccessible to attackers; adopt passkeys as the norm; and treat security and resilience as a fundamental requirement rather than an afterthought.