Key Takeaways from the Jersey Cyber Security Conference 2026

Old defences don't stop new weapons, and that was the message of the joint Intergence and Sophos session at this year's Jersey Cyber Conference.

The talk opened with an image every islander knows: Mont Orgueil Castle standing over Gorey harbour. For centuries castles like it stood strong. Then cannons arrived, and thick walls were no longer enough. The presenters argued businesses face the same moment today. Attackers now have AI, automation and scale, and they come from every side at once: phishing, ransomware, insider risk, supply chain and AI-assisted hacking.

The question put to the room was blunt: does anyone here believe they are immune? Here are the six takeaways that stood out.

1. It's a question of when, not if

Four figures frame the threat, drawn from the UK Cyber Breaches Survey 2025/26 and the Sophos Active Adversary Report 2026:

A week of undetected access is plenty of time to map a network, steal data and stage an attack. Most victims don't have the skills on hand to respond once they find out.

2. Attackers work while you sleep

88% of ransomware attacks start outside normal working hours, according to Sophos's 2026 Active Adversary Report. That means almost nine in ten begin outside 8am to 6pm on a weekday, in the victim's own time zone.

The attacks cluster late at night and in the early hours, and many land at weekends. This is deliberate. Adversaries pick the moments when IT teams are least likely to be watching.

The challenge to the audience: when your security tool raises an alert at 3am on a Sunday, who actually responds? Having someone on call who can be phoned is not the same as having someone actively spotting and investigating suspicious activity.

3. MDR is about action, not just alerts

Managed Detection and Response (MDR) is a fully managed, 24/7 service run by specialists who prevent, detect and respond to attacks that technology alone can't stop. Many leaders confuse it with antivirus or a firewall. The difference is that real people act on what the tools find.

We broke it into three stages:

1. Detect. Continuous monitoring of endpoints, network and cloud, hunting for threats that antivirus and firewalls miss.
2. Analyse. Human analysts triage every alert, so you hear about real threats rather than noise.
3. Respond. Once a threat is confirmed, the team contains the attacker, neutralises the threat and restores normal operations, with a quoted target of under 38 minutes.

In the castle picture, MDR is the garrison: watchtowers, patrols and defenders around your crown jewels, your most important data, around the clock.

4. Proof under fire: Tendring District Council

When an attack hit London's councils in November 2025, Tendring was targeted too, and its MDR service identified and remediated the threat within two minutes.

Tendring, in Essex, serves around 157,000 residents. Like most councils, it faced a familiar set of pressures:

• A high-value target. It holds sensitive resident data and runs services people rely on.
• Fragmented visibility. Endpoints, Azure, network and Microsoft 365 each alerted in separate consoles, with nothing joining the dots.
• Too much noise. Low-value alerts buried genuine threats and slowed response.
• A 24/7 risk with a 9-to-5 team. Staffing a round-the-clock security operation in-house wasn't realistic.
• Assurance under scrutiny. It had to keep its top-tier 'EPIC' rating from CTAG, the Cyber Technical Advisory Group.
• Speed to protection. Every week without unified detection was a week of exposure.
  
  

Intergence deployed Sophos MDR across endpoints, Microsoft Defender, Azure, network and Microsoft 365, and the service was fully live in five days. Automation contains more than half of threats in under 90 seconds, and human analysts hunt for the rest.

The contrast with London was stark. Some services were still down two months later, and Kensington and Chelsea confirmed data had been compromised.

Over three months, the service at Tendring logged 2,808 new detections, 84 threat hunts, 132 new or modified rules and 261 hours of threat hunting. Tendring also kept its EPIC rating, scoring over 96%.

5. AI makes defenders faster, but humans stay accountable

Sophos's message was that agentic AI scales MDR, but designed badly it erodes the very talent it depends on.

The distinction they drew was between replacement and displacement. Replacement uses AI to swap out existing people or processes. Displacement puts human architects in charge of reinventing those processes with AI. Sophos argues for the second.

That changes where people sit in the loop. The old model had humans in every step. The new one has AI handling many steps, with humans as the accountability layer at the centre. To make the point, the presenters showed a 1979 IBM training manual: a computer can never be held accountable, so a computer must never make a management decision.

In practice, Sophos described AI working at three levels in its SOC:

• Features such as case summaries, command analysis and natural-language search.
• Assistants that act as a security analyst or threat hunter alongside the team.
• Agents that carry out threat hunting, investigations and quality checks.

The same AI also helps spot attacks such as stolen credentials, password spraying, Kerberoasting, DNS exfiltration and business email compromise.

6. Your own AI use is now part of the attack surface

The newest risk isn't only attackers using AI. It's your own staff using ChatGPT, Copilot, Gemini, browser plugins and autonomous agents, often without IT knowing.

Sophos introduced Sophos AI Defense to tackle this, built around three ideas:

• See. Discover every AI tool in use, including unsanctioned 'shadow AI', across endpoints, network and browser.
• Control. Enforce AI policy with role-based access and prompt monitoring, without slowing people down.
• Secure. Sanitise inputs, intercept risky outputs and stop sensitive data leaking through prompts.

It draws on signals from four layers: device and identity, the firewall, the browser, and the MDR team. AI incidents are then handled through the same response workflows as any other security event.

The practical lesson: before you can govern AI in your business, you need to know where it is being used and what data is going into it.

Questions to take back to your business

The castle walls still matter, but on their own they aren't enough. Four questions from the session are worth asking your own team:

1. If an attacker got in tonight, how long would it take us to notice?
2. Who is actively watching our systems at 3am on a Sunday?
3. Do our alerts from different tools come together in one place, or sit in separate consoles?
4. Do we know which AI tools our staff are using, and what data they're sharing with them?

If any of those answers are uncomfortable, it may be time to look at a managed detection and response service. Find out more about our MDR service here: https://www.intergence.com/cyber-security/managed-detection-and-response 

Statistics are as presented at the 2026 Jersey Cyber Conference, citing the UK Cyber Breaches Survey 2025/26, Sophos Active Adversary Report 2026 and Tendring MDR service reporting.