Cloud & Cyber Security Expo London: Exploit Validation, AI Acceleration and the Changing Shape of Cyber Risk
Written by Rebecca Uffindell Wed 4 Mar 2026
Day 1 of the Cloud & Cyber Security Expo Keynote Theatre examined how AI is reshaping both attack methods and defensive strategy. Rather than centring solely on tooling or threat volume, speakers repeatedly returned to a more foundational issue: how organisations validate real-world risk in environments increasingly shaped by automation.
Across discussions on exploit validation, AI-driven phishing and infrastructure-level transformation, a shared pattern emerged. As attack capabilities accelerate, defensive models built primarily on assumption, scoring and static controls are being reassessed.
From Vulnerability Metrics to Proof of Exploitability
Keith Poyser, VP EMEA at Horizon3.ai, started with a challenge to traditional security measurement.
“CTEM doesn’t fail because it lacks data. It fails when it lacks truth.”
He argued that many organisations remain focused on vulnerability counts and CVSS scoring without confirming whether those weaknesses are exploitable in live environments. In this context, raw vulnerability data can create confidence without clarity.
“Vulnerability to us is noise. Exploitability is what we think you should be focused on.”
The operational strain on security teams reinforces this concern. Alert volumes remain high, patching cycles extend, and prioritisation becomes increasingly complex. Executive stakeholders, meanwhile, continue to ask a more direct question: “Are we safe? Can we be breached?”
Horizon3.ai’s approach centres on autonomous, production-safe penetration testing conducted directly in operational environments. Rather than modelling probability, organisations test actual attack paths.
“Don’t tell me that I’m secure. Show me that I’m secure.”
Credential abuse surfaced as a primary compromise vector, with Poyser citing median compromise times across Microsoft Entra ID, AWS and domain infrastructure environments. The emphasis was on evidence-based validation replacing theoretical exposure scoring.
His operational recommendation reflected that change: “For every Patch Tuesday, there should be a pen test Wednesday.”
The AI Supercycle and Infrastructure Implications
Nigel Abraham, Customer CTO UK&I at Nokia Europe, expanded the conversation beyond organisational boundaries, describing current developments as an “AI supercycle.”
“This is not hype.”
Abraham framed AI as a structural transformation across connectivity, compute and national infrastructure planning. Rather than existing purely at the application layer, AI demand is reshaping networks, data centres and edge environments.
“You can say it isn’t being touched here.”
Capacity constraints within hyperscale facilities and latency requirements for inference workloads are driving renewed interest in edge infrastructure. Networking performance has become central to AI enablement, with 400Gb interconnect speeds increasingly common among major operators. Optical networking is extending into access layers, and data centres are now recognised as critical national infrastructure in many jurisdictions.
Security implications extend accordingly.
“Trust nothing.”
Zero trust architectures, optical-layer encryption and quantum-safe networking were presented as responses to expanding attack surfaces. Abraham also acknowledged that adversaries are adopting automation at pace.
“Whatever we’re doing, are we doing enough? My assertion is we’re not doing enough.”
In distributed and hybrid environments, automated monitoring and AI-assisted defence are becoming structural requirements rather than enhancements.
When Reality Lies: AI-Driven Phishing and Deepfakes
James Dyer, Head of Threat Intelligence at KnowBe4, focused on the human layer of attack evolution. Phishing volumes have increased significantly.
“Phishing has grown 700%.”
Dyer attributed part of that growth to generative AI tools, describing ChatGPT as “fuel on the fire.” Attackers can now automate reconnaissance, personalise phishing lures at scale and deploy phishing kits with minimal technical friction.
“You cannot patch a human.”
One campaign attributed to a Russian-linked group tracked as “Obsidian Vulture” began with 7,000 polymorphic phishing emails designed to overwhelm security operations teams. Once distraction was achieved, targeted credential harvesting followed.
“Credentials are everything.”
The campaign included browser-side keylogging, cookie harvesting and AI-powered voice calls requesting multi-factor authentication codes. Dyer demonstrated an AI-driven phone agent interacting in real time, illustrating how phishing now spans multiple communication channels.
“Attackers are incredibly persistent.”
AI-powered personalisation reduces the manual effort required to tailor attacks. Public profile scraping, breach database cross-referencing and contextual message generation can now be achieved through prompt-based workflows.
AI vs AI: A Converging Reality
Although the sessions addressed different layers of cyber defence, they converged on a shared observation: AI is accelerating both offensive and defensive capabilities.
“The future of cyber warfare and conflict is AI vs AI. It’s humans by exception,” Poyser noted earlier in the day.
Across identity systems, infrastructure architecture and human communication channels, attack surfaces are expanding while automation increases on both sides.
Day one positioned exploit validation, architectural resilience and adaptive defence as practical responses to this shift. Autonomous penetration testing, quantum-secured networking and AI-informed phishing defence represent structural adaptations rather than incremental improvements.
The overarching conclusion was measured. Measurement alone does not guarantee security. Validation, visibility and adaptability are becoming central to resilience in AI-intensive environments.
As AI reshapes infrastructure and human interaction alike, cyber defence is evolving from static protection toward continuous verification.
Written by Rebecca Uffindell Wed 4 Mar 2026