Security has entered a new phase. For two decades, cyber defence was organised around a familiar picture: users on one side, systems on the other, with passwords, networks and endpoints forming the main line of protection. That picture is now inadequate. By 2026, software agents can draft messages, negotiate with services, write code, operate business tools and trigger real-world actions with limited supervision. The old question was who gets in. The new one is what, once inside, is allowed to act.
That shift matters far beyond large companies and state systems. Individuals, one-person enterprises, charities, schools, clinics and local institutions are increasingly reliant on software they do not control, models they did not train and supply chains they cannot fully inspect. Their exposure is growing even as their capacity to absorb shocks remains thin. In that environment, security cannot be understood as a specialist function bolted on after growth. It becomes a condition of autonomy: the practical ability to continue operating, deciding and recovering under stress.
The central security problem is no longer unauthorised access alone, but unauthorised agency.
Why this category matters now
The category of Security & Resilience matters because the threat surface has expanded in two directions at once. First, digital systems are becoming more capable of initiating action. Secondly, dependency chains are becoming longer and less legible. A single workflow may rely on an identity provider, a cloud platform, open-source packages, external APIs, a foundation model, a vector database, a browser extension and a payment rail, each with its own governance, update cycle and failure modes. No single compromise is required for harm. Misalignment, ambiguity or brittle integration can be enough.
The result is a distinctive form of fragility. Traditional security programmes often assume that attacks exploit known software weaknesses or stolen credentials. In agentic systems, harm can also arise from prompt injection, poisoned retrieval data, model inversion risks, insecure tool use, over-privileged connectors, manipulated outputs and automation loops that execute faster than human review. Some of these resemble old vulnerabilities in new packaging. Others are genuinely architectural: the risk emerges because the system has been designed to translate natural language into action.
Small actors face the sharp edge of this change. Large institutions can build dedicated red teams, legal controls and layered oversight. Individuals and small organisations cannot. Yet they are often the first to adopt automation because it lowers labour costs and extends reach. This asymmetry makes resilience a democratic issue. If only the largest actors can use advanced automation safely, power will centralise further.
From confidentiality to continuity
Cyber security has long emphasised confidentiality, integrity and availability. Those principles still apply, but the ordering is changing. For many users in the agentic era, continuity becomes the decisive test. Can the organisation keep serving clients if its assistant generates false instructions. Can a researcher verify provenance when a model summarises compromised material. Can a clinic continue basic operations if an automated scheduling layer fails unpredictably. Can a family recover digital identity and records after account takeover.
Continuity is a sterner measure than prevention because it assumes imperfection. It accepts that some systems will fail, some vendors will be breached and some automations will behave in ways designers did not anticipate. This is not a counsel of despair. It is an engineering stance. Aviation, public health and critical infrastructure learned long ago that mature systems are not those that never fail, but those that fail in bounded, observable and recoverable ways.
Applied to digital life, that means security must include backup operating modes, offline fallbacks, auditability, reversible transactions, staged permissions and clear human override. It also means resisting a comforting fiction: that smarter models will remove the need for such controls. Capability may reduce some classes of error while increasing the scale and speed of others.
The rise of delegated power
The central security problem is no longer unauthorised access alone, but unauthorised agency.
The most important feature of agentic systems is not that they generate language. It is that they compress intent into execution. A user states a goal; the system interprets it, gathers context, chooses tools and acts. This is powerful because it lowers friction. It is dangerous for the same reason.
Delegation has always been a security question. An employee given administrator rights, a supplier granted network access or a payment system trusted to settle transactions all create exposure. Agentic software extends delegation into domains once mediated by slower, more visible human judgement. It can send, buy, file, publish, alter and authenticate. When these powers are bundled together, the blast radius of a mistake or manipulation widens rapidly.
Least privilege for machines
The classic answer to delegated risk is least privilege, but it must be applied more rigorously to agents than to humans. A human user may improvise responsibly when context changes. A software agent may follow local logic into a global error. Tool access should therefore be narrow, time-limited and purpose-specific. Payment authority should be capped. Data access should be segmented. Sensitive actions should require explicit confirmation or dual control. Logs should capture not only what happened, but which instruction path and external context led there.
These disciplines are mundane, which is precisely why they matter. Security failures are often narrated as moments of exceptional cleverness by attackers. In practice, many begin with ordinary over-entitlement.
Supply chains have become decision chains
Software supply-chain security is no longer only about malicious packages or compromised updates, though those remain serious concerns. In AI systems, the chain now includes training data, model weights, retrieval corpora, plugins, agent frameworks, orchestration layers and evaluation suites. Each component can shape outputs; several can shape behaviour. Provenance becomes both more important and harder to establish.
This has two consequences. First, institutions need a sharper distinction between components they trust, components they tolerate and components they can replace quickly. Secondly, dependency management must include behavioural dependencies, not merely technical ones. If a model provider changes defaults, content filters or tool policies, downstream workflows may alter without any code breakage. An organisation may remain operational in the narrow sense while becoming substantively less reliable.
For smaller institutions, the challenge is practical rather than philosophical. They need systems that can be inspected at the level that matters for their risk. That does not mean every user must read source code or reproduce training runs. It means they should know which services are mission-critical, what data exits their boundary, how updates are introduced, where logs reside and how to substitute a dependency in a crisis.
Resilience begins with the assumption that some systems will fail, some models will hallucinate and some dependencies will be compromised.
Model attacks are governance attacks
Prompt injection is often described as a technical quirk of language models. It is better understood as a governance problem. If a system cannot reliably distinguish trusted instructions from untrusted content, then the boundary between policy and environment has collapsed. Retrieval poisoning, hidden text attacks and malicious documents exploit this collapse. So do social techniques that induce users to grant broader permissions or trust polished but unverifiable outputs.
The same applies to output reliability. Hallucination is not simply an accuracy issue when generated text can trigger workflows, influence compliance decisions or shape public communication. A wrong answer in a search box is irritating. A wrong answer delivered as an action recommendation inside a production system can be operationally significant.
Resilience begins with the assumption that some systems will fail, some models will hallucinate and some dependencies will be compromised.
This is why evaluation cannot be confined to benchmark performance. Institutions need situational testing: what happens when the model is rushed, contradicted, deprived of context, fed adversarial material or asked to summarise legally sensitive documents. In other words, resilience demands testing the social and procedural environment around the model, not just the model itself.
Identity is becoming infrastructure again
When agents transact on behalf of users, identity regains central importance. Not identity as a marketing asset or profile graph, but as a control surface. Who authorised the action. Under what policy. With what scope. For how long. Can that authority be revoked. Can a third party verify the provenance of a request without seeing more data than necessary.
Weak identity design creates a cascade of risk. Account recovery becomes an attack vector. Shared credentials turn into untraceable authority. Cross-service logins become concentrated points of failure. Synthetic media complicates voice and image-based verification. Meanwhile, many ordinary users remain dependent on a handful of platforms for authentication, communication and storage, magnifying lock-in during incidents.
A sovereignty-minded approach does not imply self-hosting everything or rejecting federated services. It suggests diversification, strong authentication, hardware-backed credentials where feasible, compartmentalised accounts and carefully designed recovery procedures. The goal is not maximal control in the abstract, but recoverable control in practice.
The limits of automation in defence
There is a temptation to answer machine-scale threats with machine-scale defence and to imagine that autonomous defenders will neutralise autonomous attackers. Some defensive automation is plainly necessary. Detection, anomaly triage, patch management and policy enforcement benefit from speed and consistency. Yet over-automation can create its own brittleness. Systems that quarantine aggressively may disrupt legitimate operations. Automated classifiers may bury subtle incidents beneath false confidence. Escalation chains can become opaque exactly when clarity is needed.
Defensive design therefore requires a distinction between rapid assistance and unreviewable control. The most robust organisations are likely to be those that automate the repetitive, preserve human judgement at key thresholds and make exceptions legible rather than silent. This is slower than the mythology of full autonomy suggests, but more compatible with trust.
Resilience is not redundancy alone
Redundancy matters, but it is not the whole of resilience. Multiple cloud regions do not solve a bad identity architecture. Extra backups do not help if restoration paths are untested or encryption keys are lost. A second model provider may reduce vendor concentration while increasing operational complexity. Real resilience lies in the relationship between technical safeguards, institutional habits and decision rights.
Graceful degradation
One of the most underused ideas in digital design is graceful degradation: the capacity of a system to deliver a reduced but safe service under stress. For a one-person business, this might mean that if automated fulfilment fails, orders can still be taken and confirmed manually. For a school, it may mean that if a cloud platform is unavailable, attendance, safeguarding contacts and parent communications remain accessible through a secondary channel. For a public-interest newsroom, it may mean separating publishing from analytics and adtech so reporting can continue during third-party outages.
Graceful degradation is culturally difficult because it appears inefficient in periods of calm. It creates friction, duplicate processes and apparent under-utilisation. But the absence of slack is often just hidden dependency.
The institutions that endure will be those that can keep operating when automation becomes unreliable.
The geopolitics of dependence
Security & Resilience also has a geopolitical dimension. AI capability, semiconductor supply, cloud concentration and cross-border data governance are shaping who can set terms for digital life. The EU AI Act, GDPR, the OECD AI principles, NIST frameworks and national cyber agencies are all attempts, in different ways, to establish norms for trustworthy systems. Their details vary, and they will continue to evolve. The broader point is that security is no longer separable from questions of jurisdiction, procurement and institutional bargaining power.
For smaller actors, geopolitical concentration appears in ordinary operational form: whether a service outage in another jurisdiction can halt local activity; whether a sanctions change can disrupt access to tools; whether evidence needed for an investigation sits under foreign legal processes; whether model behaviour shifts due to policies made elsewhere. Sovereignty, in this sense, is not autarky. It is the ability to choose dependencies knowingly, minimise irreversible lock-in and retain options when external conditions change.
A realistic defensive agenda
What follows from all this is not panic, and not a fantasy of perfect security. It is a more disciplined agenda. Treat agents as privileged software, not cheerful assistants. Limit permissions by default. Separate observation from action. Demand provenance for critical inputs where possible. Keep audit trails that support reconstruction, not just compliance theatre. Test recovery, not just prevention. Prefer architectures that can be inspected, substituted or paused without organisational collapse.
Equally important, leaders should recognise that security posture is shaped by incentives. If teams are rewarded only for speed, they will route around controls. If small institutions are sold complexity they cannot staff, they will outsource judgement along with infrastructure. If regulation focuses only on frontier capability while neglecting deployment practices, many harms will occur in implementation rather than invention.
The institutions that endure will be those that can keep operating when automation becomes unreliable.
What sovereignty means in practice
In this publication, sovereignty does not mean isolation. It means retaining meaningful power over identity, data, compute, money and biological information even when using networked systems and external providers. In security terms, that translates into four practical tests. Can you see what your systems are doing. Can you limit what they are allowed to do. Can you verify where critical information came from. Can you recover without begging a single gatekeeper for permission.
These tests are deliberately modest. They do not require every institution to become a cyber fortress. They require enough competence and design discipline to prevent dependency from turning into subordination. That distinction will matter more as agentic software becomes woven into administration, commerce, care and education.
The category ahead
Security & Resilience, then, is not a narrow beat about breaches and malware. It is the study of how societies, institutions and individuals remain governable under conditions of digital complexity. It covers model security, supply-chain trust, identity systems, operational continuity, safety engineering, standards, governance and the political economy of dependency. It is defensive by design, because the aim is not domination but durability.
The strategic challenge of the next decade will not be whether machines can act. It will be whether people and small institutions can delegate to them without surrendering the conditions of self-direction. Security is where that question becomes concrete. Resilience is where it becomes survivable.
