Periodic risk assessments are no longer enough when AI is accelerating both business operations and cyberattacks. Armis from ServiceNow says resilience must instead be continuous, requiring organisations to understand their technology environments as they change.
Alex Mosher, GVP, Cybersecurity and Risk, and President of Armis from ServiceNow, treats visibility as only a starting point. He connects cyber risk with business impact and explains why faster recovery depends on decisions made before an incident.
What cyber resilience changes are needed as AI reshapes attacks and defences?
AI is changing the economics of cyberattacks. It is helping organisations put new ideas into practice more quickly and automate more processes, but it is also enabling attackers to scale their operations and adapt more quickly. As a result, resilience can no longer rely on periodic risk assessments. It needs to become a continuous discipline.
This shift is happening quickly. ServiceNow’s “Enterprise AI Maturity Index 2026” found that Singapore’s AI maturity score rose from 34 to 53 in a year, putting it above the global average. The broader implication is that AI is moving from experimentation into everyday business operations, and resilience strategies need to evolve alongside it.
Cyber resilience requires an understanding not only of traditional IT assets, but also of cloud infrastructure, operational technology, connected devices, applications, identities, and AI-enabled systems.
Organisations need more than visibility. They need the context to understand how assets interact, which systems support essential business operations, and where exposures could have the greatest impact. This understanding must be paired with the ability to prioritise risks, contain incidents quickly, and recover effectively from disruptions.
AI can help organisations identify patterns, set priorities, and respond more effectively. Resilience, however, depends on understanding the environment, knowing what matters most to the business, and having tested containment and recovery processes ready when needed.
Which cybersecurity risks do enterprises underestimate?
The most underestimated risk is the gap between the environment organisations think they have and the environment in which they actually operate.
Over time, most enterprises have accumulated a growing mix of connected technologies, third-party services, operational systems, cloud resources, and digital workflows. The rise of agentic AI is adding to this complexity through the rapid growth in machine identities. Using dozens of fragmented tools makes it difficult to see or secure the connections among these technologies and systems.
The challenge is not simply to add another tool, but to understand how assets, identities, and systems connect to one another and how those connections create exposure. A vulnerability may not be critical on its own, but it can provide a pathway to sensitive systems or data.
Organisations therefore need to look beyond vulnerability management and consider exposure across their entire environment.
Ultimately, the risk lies in what organisations cannot see or connect. As environments become more complex and autonomous, security teams need a clearer view of how risks across assets, identities, and systems combine and where they could provide an entry point for a larger incident.
What factors help organisations recover quickly from cyber incidents?
The biggest difference is preparedness. Organisations that recover quickly have typically done the hard work before an incident occurs. They understand which services are most important to the business, which systems support those services, who is responsible for the relevant decisions, and how recovery efforts will be prioritised if something goes wrong.
During a cyber incident, uncertainty is often the greatest obstacle. Teams must determine the scope of the issue, identify affected systems, understand dependencies, and decide what should be restored first. Organisations that already have this information can spend less time investigating and more time executing their response.
Recovery involves much more than restoring technology. Prepared organisations have tested recovery plans, validated backups, clearly assigned decision-making authority, and agreed processes for determining when systems can safely return to production. They understand which services need to be restored first based on their importance to the business, and they can verify that restored environments remain secure.
Although every organisation’s circumstances are different, the broader lesson is consistent: Organisations that prepare, test, and practise recovery before a crisis are better positioned to recover quickly when an incident occurs.
How can boards measure whether cybersecurity investments reduce business risk?
As cybersecurity becomes more closely tied to business resilience, many boards are looking beyond traditional security metrics and asking a more fundamental question: Are we becoming less exposed to disruption?
Answering that question requires moving beyond activity measures, such as vulnerability counts, alert volumes, or the number of security tools deployed. Although those metrics can help security teams manage day-to-day operations, they do not always provide a clear view of business risk. More useful measures assess whether critical assets and services are becoming less exposed, whether the organisation is improving its ability to detect and contain incidents, and whether it can recover effectively from disruption.
Consistency is equally important. Boards benefit from using a common framework and the same set of indicators over time. When risk is reported through a shared language and reliable data, boards can more easily identify trends, assess progress, and make informed decisions about priorities and investment.
As organisations expand their use of AI, governance is becoming more important. Boards will need confidence that formal processes for testing, auditing, and managing AI risk are developing alongside its use in business operations.
Cyber reporting should ultimately connect technical risk to business impact. It should help leaders understand not only what is happening across the organisation’s technology environment, but also how well it can manage risk, maintain trust, and continue operating during disruptions.
Beyond quantum computing, what will shape enterprise cybersecurity over the next few years?
Rather than one technology, the greatest impact will come from three related developments: AI, the convergence of cyber and physical environments, and the concentration of risk in interconnected ecosystems.
The first is the rise of AI agents and other non-human identities operating inside enterprise environments. AI agents are already in use, although autonomous, multistep workflows remain at an early stage.
The second is the convergence of IT and operational environments. Manufacturing systems, healthcare technologies, critical infrastructure, building systems, and connected devices are becoming increasingly integrated with enterprise networks and business processes. As these environments converge, cyber incidents are more likely to have direct operational consequences, making cybersecurity as much a business continuity issue as a technology issue.
The third is the concentration of risk in interconnected ecosystems. Organisations increasingly rely on networks of platforms, suppliers, service providers, and software dependencies. These relationships can improve efficiency and support innovation, but they also allow disruptions to have effects far beyond a single organisation.
Across all three developments, security teams will need a deeper understanding of relationships within their environments. Knowing what exists will not be enough: Organisations will need to understand what can take action, what it can access, how systems connect to one another, and which business processes could be affected if something goes wrong.
Together, these developments require organisations to look beyond securing individual technologies in isolation and understand how cyber risk can affect operations and the wider business.
