Cyber security company NCC Group has published the latest edition of its Global Cyber Policy Radar, which examines how governments are changing cyber security policy in response to AI, emerging quantum technologies, and geopolitical tensions. The report finds diverging national approaches to cyber defence, supply-chain security, and organisational resilience, and argues that businesses can no longer treat cyber security in isolation from these wider developments.
AI in national cyber defence
As governments incorporate AI into national cyber defence, the report says organisations face new questions about trust, access, and sovereignty. In the UK, the National Cyber Security Centre and the Department for Culture, Media and Sport have announced the National Cyber Shield, aimed at delivering sovereign cyber defence capabilities. Singapore and Australia are also incorporating AI into their national cyber strategies. The report says organisations should consider how sovereign restrictions could affect their global operations.
The report also notes that governments are moving from guidance on post-quantum cryptography towards implementation expectations, and says organisations should consider how quickly they can accelerate their post-quantum preparations. Supply chains are another focus: the UK's Energy Sector Cyber Security Strategy reflects growing attention to suppliers further down the chain, and the report recommends supplier mapping, ownership monitoring, software bills of materials, and stronger third-party assurance.
Geopolitical disruption and age assurance
NCC Group describes geopolitical disruption as a persistent operating condition that boards should manage as part of everyday governance, including by assuming possible exposure to state-linked activity and testing recovery plans in advance. The report also covers age assurance, noting the UK's commitment to a minimum age of 16 for certain social media platforms and the EU's KIDS Act, which sets a minimum age of 15 for opening a social media account.
Katharina Sommer, Director of Government Affairs at NCC Group, said rapid technological change and geopolitical fragmentation mean organisations must make decisions before the final shape of policy is clear, and that this uncertainty is not a reason to pause resilience work. She added that understanding strategic dependencies and preparing for disruption should become an ongoing part of governance rather than a response to a crisis.
