From finding to fixed: notes from HSBC Cyber Innovation Day

On November 12, 2026, I spent the day at HSBC Cyber Innovation Day, listening to board members, security leaders and investors talk about AI, faster attacks and how enterprises recover. The thread through almost every session was one we hear from customers: once a problem is found, how quickly does it get fixed, and can anyone show that it was?

Here's what stood out, with a source wherever a fact needs one.

Boards want to see how controls support oversight

How the business handles the risks of frontier AI models is moving up the board agenda, and several speakers said building board-level understanding of AI is still a priority. The practical request was to tie AI strategy to the corporate plan and show how individual security tools work together.

Machine identity came up as an endpoint issue rather than only an identity one. The advice was to connect endpoint controls, and the risks they address, to the governance layer, so leadership can see how those controls support oversight.

From finding problems to fixing them

One panel focused entirely on what happens after a security team identifies an issue. CISOs and their teams face constant demands, and their ability to prioritize and carry out fixes decides how much exposure remains.

Three points from that discussion apply directly to device teams:

• Incomplete knowledge of devices, software and services makes gaps in coverage harder to spot. The NCSC's Cyber Assessment Framework treats asset management as a principle in its own right (NCSC, principle A3).
• Speakers talked about security teams needing to operate at machine speed. The practical question is how quickly a team can go from knowing an application needs updating to deploying the new version and confirming that every affected device received it.
• AI is changing discovery. Google's Project Zero has documented an AI agent finding an exploitable bug in SQLite (Google Project Zero). One speaker noted that reliably turning a found bug into a working exploit is still harder, but more findings mean more fixes to deploy either way.

The recovery discussion made a related point. Attackers can operate at scale, so recovery plans need to cover how to restore services safely and how to verify that restored systems are fit to return to use.

For UK teams, the 14-day test

Cyber Essentials requires high-risk or critical security updates to be applied within 14 days of release (NCSC requirements for IT infrastructure), and certain higher-risk UK public contracts require Cyber Essentials, Cyber Essentials Plus or equivalent controls (UK procurement guidance).

Deploying the update is only half of that test. The other half is being able to show which in-scope devices received it within 14 days and which are still outstanding, with a reason and an owner for each.

Regulation is moving in the same direction. The Cyber Security and Resilience (Network and Information Systems) Bill, which aims to strengthen cyber resilience for essential services including healthcare, drinking water and energy, has completed its third reading in the Lords, with the Commons still to consider Lords amendments (UK Parliament).

Security that fits the platforms you already run

The closing panel asked whether existing enterprise security architectures can handle today's risks while legacy systems still need protecting. The panel's view was that security products should fit into the platforms and workflows enterprises already use, so teams can adopt new technology while applying the controls the business expects. Governance should define the risks the business is willing to accept and turn those decisions into controls teams can apply.

What it means for Intune teams

For organizations that run Microsoft Intune, that platform is already in place. The work is keeping it current as the volume of updates rises, and producing the evidence that leadership and auditors ask for.

Devicie works through Intune. It prepares and tests new versions of supported applications so they stay on current publisher versions, while your team controls the rollout, and it reports both what is ready and what is installed. Reporting refreshes daily, so you can see which devices are current and which still need attention.

If you want to see where your own environment stands, start with a free Intune Health Assessment. And if you were at the event and want to compare notes, reach me at devicie.com/contact.

Request your free Intune Health Assessment

Steve Arlin is Senior Director, EMEA, at Devicie.