Why recovery speed is the new measure of security, AI agents are the new insiders, and physical AI is the next frontier of operational technology security.
Cybersecurity is entering a new phase. As artificial intelligence becomes more autonomous, intelligent systems move into physical environments, and cyber incidents continue to disrupt business operations, organizations must rethink how they define and manage digital risk.
These developments were prominent themes at GovWare 2026, held October 13 to 15 in Singapore as part of Singapore International Cyber Week. As a leading cybersecurity conference and exhibition in Asia, GovWare brings together government agencies, policymakers, cybersecurity practitioners, technology providers, and business leaders to exchange insights on emerging threats and the technologies shaping the industry’s future. Its international reach makes it a valuable platform for understanding how cybersecurity priorities are evolving across markets and sectors.
Drawing on my experience at GovWare, three lessons stood out. First, organizations must assume they will be breached, and how quickly they recover will increasingly define effective security. Second, AI agents are already causing security incidents, introducing new dimensions of identity and access management. Third, physical AI is building on the lessons of operational technology (OT) security, extending digital risks into the real world. Together, these lessons show where cybersecurity is heading next and why security strategies must evolve alongside technological innovation.
- Assume You’re Already Breached: Recovery Speed Is the New Measure of Security
Every organization will eventually be breached; the real question is how quickly it can recover. Strengthening defenses, detecting threats, and stopping attacks before they cause damage remain essential, but no set of defenses is impenetrable. Organizations that measure security only by the attacks they block leave themselves exposed to the operational and financial consequences of incidents that get through, and the longer recovery takes, the greater those consequences become.
The data shows why recovery speed matters. According to IBM’s 2025 Cost of a Data Breach Report, organizations took an average of 241 days to identify and contain a breach, including restoring services. The global average cost of a data breach was US$4.44 million. Although this represented a 9% decrease from the previous year, the findings demonstrate that breaches continue to carry significant financial implications.
These figures highlight a critical distinction: preventing an incident and limiting its impact are related but different objectives. Even with strong security controls, organizations need the ability to detect compromises, contain threats, restore critical services, and maintain business continuity.
This calls for a more integrated approach to cyber resilience. Security teams must work alongside business continuity, risk management, legal, and financial teams to establish recovery plans, clarify accountability, and assess the potential consequences of disruption. Organizations should also regularly test incident response procedures to understand whether their recovery capabilities will hold up under real-world conditions.
Ultimately, a mature cybersecurity strategy is measured by how quickly and effectively an organization can withstand disruption, recover operations, and maintain stakeholder trust. As breaches become a question of when rather than if, recovery speed will increasingly define what effective cybersecurity looks like.
- AI Agents Are the New Insiders: Identity Must Extend Beyond Humans
As AI agents become capable of exchanging information, coordinating tasks, and executing actions with less human intervention, they introduce a new layer of complexity to cybersecurity.
Unlike conventional applications that primarily respond to user instructions, agentic AI systems can interact with tools, access resources, and initiate actions within their assigned permissions. When multiple agents operate together, a compromised or manipulated agent could influence downstream decisions and potentially affect interconnected systems.
Incidents are already occurring. A 2026 Cloud Security Alliance study commissioned by Zenity found that nearly half (47%) of organizations experienced a security incident involving an AI agent in the past year, while 53% reported that AI agents had exceeded their intended permissions. When incidents occurred, 58% of organizations said detection and response took five hours or longer. Only 16% expressed high confidence in their ability to detect AI agent-specific threats. These findings show that agent adoption is outpacing the controls needed to govern it, and that security gaps could become increasingly consequential as AI systems gain greater autonomy.
The OWASP Top 10 for Agentic Applications further identifies risks associated with autonomous AI systems, including identity and privilege abuse, insecure inter-agent communication, and cascading failures.
These developments require organizations to rethink how they establish and maintain trust across their technology environments. AI agents need verifiable identities, clearly defined permissions, and appropriate restrictions on the actions they can perform. Applying the principle of least privilege, which limits each agent to the access necessary for its role, provides an important foundation.
Organizations must also establish monitoring and audit mechanisms to trace agent activity, identify anomalous behavior, and contain compromised systems. Human approval should remain a deliberate control for high-impact actions, particularly those involving sensitive data, financial transactions, or critical operations.
As agentic AI adoption expands, cybersecurity frameworks must account for non-human identities and the relationships between autonomous systems. Securing individual agents is only part of the challenge; organizations must also understand how trust, permissions, and failures can propagate across an interconnected network of agents.
- Physical AI Is OT Security’s Next Frontier, and the Risks Are No Longer Theoretical
AI is increasingly moving beyond digital applications into physical environments through robotics and connected intelligent systems. At GovWare, seeing robots in action made this transition tangible, illustrating the potential for physical AI to transform areas such as security, logistics, and critical infrastructure.
However, when intelligent systems can influence physical processes, cybersecurity risks take on an additional dimension. A compromised digital application may expose sensitive information or disrupt a service. A compromised robot or connected operational system could also interfere with physical processes, interrupt operations, or create safety concerns.
This is not an entirely new security challenge; OT security is its precursor. The US National Institute of Standards and Technology (NIST), in its Guide to Operational Technology Security, emphasizes that OT systems interact with the physical environment and must be secured while accounting for their unique performance, reliability, and safety requirements. The threat to these systems remains persistent: Fortinet’s 2025 State of Operational Technology and Cybersecurity Report found that 50% of surveyed organizations experienced one or more OT intrusions in the past year. Physical AI builds on this foundation, adding autonomy and mobility to systems that already bridge the digital and physical worlds.
The risks are already materializing. In September 2025, security researchers disclosed “UniPwn,” a critical Bluetooth vulnerability in Unitree’s G1 and H1 humanoid robots and Go2 and B2 quadrupeds that could give attackers root-level control of affected robots. Because the flaw could be exploited wirelessly, the researchers warned it was ‘wormable’: a compromised robot could automatically find and infect other robots within range, effectively creating a robot botnet. IEEE Spectrum described it as the first major public exploit of a commercial humanoid platform, a clear signal that physical AI is already an active attack surface.
The implications extend across the technology ecosystem. Connected devices, embedded software, communication networks, control systems, and AI models must be considered together. A vulnerability in one component could undermine the reliability or security of the wider environment.
Securing physical AI therefore requires closer collaboration between cybersecurity teams, robotics developers, OT specialists, and safety professionals. Organizations must assess risks before deployment, secure communication between systems, manage software updates, and establish safeguards that prevent unauthorized actions from creating unacceptable physical consequences.
Security also needs to be considered throughout the technology lifecycle rather than added as a separate layer after deployment. This includes testing systems under realistic operating conditions, establishing safe failure mechanisms, and ensuring that human operators can intervene when necessary.
As AI gains greater influence over physical environments, the scope of cybersecurity must expand accordingly. The lessons learned from securing OT provide a starting point, but protecting autonomous, mobile, and connected machines will require organizations to safeguard not only digital assets, but also the physical processes and people connected to them.
The Future of Cybersecurity: Building Trust Across an Interconnected World
These three lessons share a common theme: cybersecurity is expanding in scope as technology becomes more autonomous, interconnected, and embedded in everyday operations.
Cyber resilience requires organizations to assume compromise and measure success by how quickly they recover. Agentic AI is already generating incidents and raising new questions around identity, permissions, and accountability. Physical AI builds on the long-standing challenges of OT security, extending them into environments where digital vulnerabilities can have real-world consequences.
For organizations, the challenge is to capture the benefits of these technologies without overlooking the risks they introduce. This requires security strategies that evolve alongside innovation, combining preventive controls with rapid recovery capabilities, stronger AI governance, and security-by-design principles.
For cybersecurity providers, these lessons point to opportunities to address emerging needs across AI security, identity and access management, OT protection, and cyber resilience. The ability to help organizations manage risk across both digital and physical environments will become increasingly important as adoption accelerates.
Taken together, the lessons from GovWare 2026 show that these challenges cannot be addressed in isolation. Resilience, AI agent governance, and OT and physical AI security increasingly interact and influence one another. As organizations embrace more autonomous and connected systems, the future of cybersecurity will depend not only on how effectively they protect their data and networks, but also on how well they secure decisions, safeguard physical operations, and sustain trust when disruption occurs.
