Caption: Niel Harper
In Brief
- Converging threats: Award-winning cybersecurity expert Niel Harper warns that cyberattacks are no longer just data breaches but physical safety events that demand a unified approach to risk.
- Breaking silos: Speaking ahead of AMCHAM’s 30th Annual HSSE Conference, Harper urges corporate boards to merge IT and HSE risk management through joint scenario exercises and clear accountability.
- AI and digital trust: Harper notes that while AI can bolster system resilience, it also introduces new vulnerabilities. He advocates for ‘resilience by design,’ ensuring safety, privacy, and ethical data use become default standards rather than compliance afterthoughts.
Niel Harper will be the feature speaker at AMCHAM’s 30th Annual HSSE Conference and Exhibition on the topic, “WHEN SYSTEMS FAIL: Resilience by Design: Leading Through Risk in an Intelligent, Interconnected World,” on Day Two, 28 October 2026.
AZP News Editor-in-Chief Prior Beharry (PB) sent seven questions to Niel Harper (NH), and the following were his responses:
PB: Your feature address at the upcoming Cybersecurity Conference is titled, ‘WHEN SYSTEMS FAIL: Resilience by Design.’ You note that today, a cyberattack can easily become a physical safety event. Can you give us an example of how these converging threats are changing the way organisations must look at risk?
NH: The clearest way to see it is through a building or a plant, for example, a data centre. Take a facility where access control, ventilation, fire suppression, and production equipment all run on networked systems. An attacker who compromises those systems is no longer threatening data. They can lock people in, switch off ventilation, or interfere with a safety interlock. The same incident is now a safety event, an operational event, a legal event, and a reputational event, all at once.
That changes how organisations must look at risk. For years, cyber risk sat in one risk register and physical and safety risk sat in another, owned by different people and reviewed by different committees. Attackers do not respect that boundary. At INTERPOL, I served on Quick Response Teams during national-level cyber incidents, where the job was to keep police operations running to ensure overall public safety. At JetBrains, I directed cybersecurity, physical security, and product security across 13 countries, and I saw how much sense it makes to treat them as one discipline under the ‘headline’ of operational resilience.
PB: Mr. Harper, congratulations on being the 2026 recipient of the ISC2 Harold F. Tipton Lifetime Achievement Award, which is considered the highest tribute in the cybersecurity industry. Looking back over your 20-year career, what does this recognition mean to you, and what has been the most drastic change in ‘digital trust’ since you first started?
NH: Thank you, and it is quite humbling. The Lifetime Achievement Award is a great personal accomplishment, but I’m conscious that I stand on the shoulders of many colleagues, mentors, and teams across banks, the UN, law enforcement, and the Internet community. The recognition belongs to them as well. It also reminds me that the work is never finished.
The most drastic change in digital trust is that trust has moved from being assumed to being earned and demonstrated. When I started, in telecoms and then audit and banking, trust largely meant a perimeter: if you were inside the network, you were trusted. Today the perimeter is gone. Data and services sit with third parties, in the cloud, and across borders, so trust must be verified continuously, through zero-trust architectures, third-party risk management, and independent attestation such as ISO 27001 and SOC 2.
The second shift is that trust is now a commercial and reputational asset. Customers, regulators, and boards expect evidence, not assurances. And with AI-generated content, it is becoming harder even to trust what we see and hear.
PB: You strongly advocate that resilience cannot be improvised; it must be designed into strategy, operations, and culture. For the executives and leaders attending your keynote, what is the very first step they need to take to break down the traditional ‘silos’ between IT, HSE (Health, Safety, and Environment), and the boardroom?
NH: The very first step is to put all the stakeholders, including board directors, around one table, focusing on a singular picture of risk, and to name a key executive accountable for it.
In practice, I would start with a joint scenario exercise. Pick a realistic event, such as a compromised building system or a supplier outage that stops production, and walk through it together: who decides, who is informed, what is shut down, who speaks to regulators and the public. Those exercises expose the gaps in ownership within a couple of hours. They show quickly where IT assumes HSE has it covered and HSE assumes IT does.
The second part is reporting. At ISACA, the Board and executive committee maintain a decision-ready view of risk rather than simply technical metrics, which helps the leadership reach consensus on critical investment faster. At Doodle, I sat on the Enterprise Risk Committee, which looks at the whole risk universe in one place. Resilience improves when risks are shared, not held in separate silos.
PB: Having led initiatives for massive global entities like INTERPOL, the United Nations, and Hugo, you’ve seen risk from a macro level. Are corporate boards today doing enough to understand cybersecurity, or is it still being treated as just an ‘IT problem’ rather than an enterprise-wide leadership issue?
NH: Progress has been real, but also uneven. Many boards now recognise that cyber risk is an enterprise and fiduciary issue, not an IT problem. Plenty of others still receive technical reports they cannot act on and engage only after an incident.
I see this from several seats. I’m a non-executive director at ISACA, where I have served as Vice-Chair of the Board and Chair of the Innovation & Technology Committee, and I advise the International Telecommunications Union (ITU) as a member of its Independent Management Advisory Committee. I also served on the World Economic Forum’s Cyber Risk & Corporate Governance Working Group, where we argued for cybersecurity as a board-level priority. Before that, I ran security at UNOPS, INTERPOL, Doodle, and JetBrains, so I’ve also been the executive presenting to boards.
What separates strong boards is not technical depth but the right questions: What are our most critical services? How long can we tolerate an outage? Who is accountable? Have we tested the plan? Boards that ask those questions, and perceive risk in commercial terms, are far better placed. I’d add that directors need ongoing education. I hold the CERT Cyber-Risk Oversight for Board Directors certificate from Carnegie Mellon, and I’d encourage every director to do something similar.
PB: I noticed you hold a certification in Effective AI Oversight from Carnegie Mellon. As artificial intelligence becomes deeply embedded in our interconnected systems, do you view AI primarily as a tool to help build ‘resilience by design,’ or as a new threat that makes systems more vulnerable to disruption?
NH: Both, and treating it as only one of them is the mistake. AI can strengthen resilience in terms of faster detection, triage and response, and better analysis of large volumes of logs from key systems. But it also expands the attack surface, through manipulated models, poisoned training data, data leakage, deepfakes, and attackers using AI to scale their own operations.
The difference between the two outcomes is governance. I completed the AI Oversight certificate because I believe in setting the tone at the top. In my own roles, I’ve built AI governance frameworks in practice. For example, at Hugo, I cover LLM training data pipelines, AI content moderation, and digital identity verification; and at Doodle, the framework included corporate use, product and architecture, and operations.
My view is that AI becomes a resilience tool only when it is deployed with clear ownership, strategic alignment, human oversight, rigorous testing, and supply chain scrutiny. Without that, it becomes one more thing that can fail in ways no one anticipated. Second, through realistic exercises and simulations, so that decisions under pressure are rehearsed, not improvised. Third, be clear about decision rights, so that in a crisis people know who decides and when to escalate.
I’ve seen this work at scale. At Doodle, I embedded a collaborative risk governance model into the corporate culture, which included annual cross-functional tabletop exercises. At Hugo, with more than 4,000 staff across several countries, security and privacy controls must work for frontline teams as much as for specialists and executives. Culture follows leadership. When executives take part in the exercises and reward people for raising concerns, the rest of the organisation follows.
PB: You’ve won the ISACA Technology for Humanity Award, and as a father of four, you clearly have a vested interest in the future of the digital world. Ultimately, what is your hope for how everyday individuals and organisations will experience safety, privacy, and data ethics in the next decade?
NH: My hope is that safety, privacy, and ethical data use become the default, not a premium feature or a compliance afterthought. I want people to be able to use digital services without having to be experts in security, and to trust that their data is handled fairly and that someone is accountable when it isn’t.
That hope is rooted in my work. The Technology for Humanity Award recognised me for work I care deeply about. At the Internet Society, I led an amazing team that trained more than 75,000 people across over 100 countries, and with the Aspen Institute’s Digital Equity Accelerator, I advised on frameworks to protect sensitive data belonging to refugees, indigenous populations, and stateless children. Those who are most vulnerable have the most to lose when data is mishandled, so they should be the first we design for.
As a parent, I think about the world my kids will inherit. I want them to grow up in a digital environment where privacy is respected, AI is used responsibly, and trust is built in by design. Getting there depends on organisations, regulators, technologists, and other stakeholders all taking responsibility, rather than assuming someone else will.
PB: Your keynote description mentions that a breakdown in human decision-making can rapidly escalate across an enterprise. How can companies build an adaptive culture where employees act as a strong line of defence, rather than the weakest link?
NH: People become the weakest link when the organisation makes it hard or risky to do the right thing. They become a strong line of defence when it is easy, safe and expected.
Three things matter most. First, make reporting safe so that people can flag a mistake, a suspicious message or a near miss quickly and without blame, because speed is what limits the damage. Second, through realistic exercises and simulations so that decisions under pressure are rehearsed, not improvised. Third, be clear about decision rights, so that in a crisis people know who decides and when to escalate.
I’ve seen this work at scale. At Doodle I embedded a collaborative risk governance model into the corporate culture, which included annual cross functional tabletop exercises. At Hugo, with more than 4,000 staff across several countries, security and privacy controls must work for frontline teams as much as for specialists and executives. Culture follows leadership. When executives take part in the exercises and reward people for raising concerns, the rest of the organisation follows.
