Large industry events at the NEC always provide a useful snapshot of what organisations are struggling with in practice. Beyond the busy show floor, the theatre sessions offered direct insight into where security and operations teams are focusing their attention today.Â
The day began with a clear message from Stellar Cyber: most organisations still invest heavily in prevention, but their real weakness is in detection and response. Security teams are often buried under alerts from disconnected systems, making it easy to miss early signs of an incident.
Their recommended approach was straightforwardconsolidate telemetry through Open XDR so data is correlated into a single incident view. This reduces noise, improves visibility, and shortens the time it takes to understand and contain a breach.
Later, Ben Turner from LRQA outlined how Adversary-in-the-Middle attacks are undermining traditional identity controls. Attackers no longer need to break MFA; they intercept the authenticated session itself.
The takeaway was simple: MFA alone is no longer enough. Organisations need phishing-resistant authentication such as FIDO2/WebAuthn, along with device and session checks built directly into the identity flow. The architecture must provide protection even when users slip up.