On November 12, 2026, I spent the day at HSBC Cyber Innovation Day, listening to board members, security leaders and investors talk about AI, faster attacks and how enterprises recover. The thread through almost every session was one we hear from customers: once a problem is found, how quickly does it get fixed, and can anyone show that it was?
Here's what stood out, with a source wherever a fact needs one.
How the business handles the risks of frontier AI models is moving up the board agenda, and several speakers said building board-level understanding of AI is still a priority. The practical request was to tie AI strategy to the corporate plan and show how individual security tools work together.
Machine identity came up as an endpoint issue rather than only an identity one. The advice was to connect endpoint controls, and the risks they address, to the governance layer, so leadership can see how those controls support oversight.
One panel focused entirely on what happens after a security team identifies an issue. CISOs and their teams face constant demands, and their ability to prioritize and carry out fixes decides how much exposure remains.
Three points from that discussion apply directly to device teams:
The recovery discussion made a related point. Attackers can operate at scale, so recovery plans need to cover how to restore services safely and how to verify that restored systems are fit to return to use.
Cyber Essentials requires high-risk or critical security updates to be applied within 14 days of release (NCSC requirements for IT infrastructure), and certain higher-risk UK public contracts require Cyber Essentials, Cyber Essentials Plus or equivalent controls (UK procurement guidance).
Deploying the update is only half of that test. The other half is being able to show which in-scope devices received it within 14 days and which are still outstanding, with a reason and an owner for each.
Regulation is moving in the same direction. The Cyber Security and Resilience (Network and Information Systems) Bill, which aims to strengthen cyber resilience for essential services including healthcare, drinking water and energy, has completed its third reading in the Lords, with the Commons still to consider Lords amendments (UK Parliament).
The closing panel asked whether existing enterprise security architectures can handle today's risks while legacy systems still need protecting. The panel's view was that security products should fit into the platforms and workflows enterprises already use, so teams can adopt new technology while applying the controls the business expects. Governance should define the risks the business is willing to accept and turn those decisions into controls teams can apply.
For organizations that run Microsoft Intune, that platform is already in place. The work is keeping it current as the volume of updates rises, and producing the evidence that leadership and auditors ask for.
Devicie works through Intune. It prepares and tests new versions of supported applications so they stay on current publisher versions, while your team controls the rollout, and it reports both what is ready and what is installed. Reporting refreshes daily, so you can see which devices are current and which still need attention.
If you want to see where your own environment stands, start with a free Intune Health Assessment. And if you were at the event and want to compare notes, reach me at devicie.com/contact.
Request your free Intune Health Assessment
Steve Arlin is Senior Director, EMEA, at Devicie.