ISJ’s Digital Content Editor, Eve Goode speaks with James Savory, RVP UK&I of Island, about the rapid rise of AI, the evolving cyber-threat landscape and why the enterprise browser is becoming a critical part of modern security strategies.
What led you into cybersecurity and what sparked your interest in the industry?
Like many people who end up in cybersecurity, it wasn’t a planned career path. I’m ex-military and spent nine years serving with the British Special Forces before leaving in 2013.
After that, I moved into the Lloyd’s insurance market as a Kidnap, Ransom and Extortion Insurance Broker.
It was a natural transition because I understood risk and could speak confidently about it, even though I was new to the insurance industry itself.
Around 2013 and 2014, I began hearing more and more conversations about ransomware.
At the time, it was still relatively new outside the cybersecurity community, but when I looked at it, I saw it as extortion under a different name.
The principles were the same, but it was far less risky for organised criminal groups than traditional extortion.
I remember thinking this was going to grow rapidly and, as we’ve seen, it certainly did.
Those conversations naturally led me to meet cyber underwriters and people working in cybersecurity.
I quickly realised that cybersecurity was the next evolution of physical security.
As more of our lives and businesses moved into the digital world, protecting digital assets became just as important as protecting physical ones.
What do you think are some of the biggest cybersecurity challenges organisations are facing today?
There are plenty of challenges, but the biggest one today is undoubtedly the adoption of AI.
What’s unique about AI is that it’s one of the first technologies where adoption has been driven by users rather than IT departments.
Traditionally, organisations had time to assess new technologies, complete governance and compliance checks and then roll them out in a controlled way.
With AI, employees have already started using the tools. Now cybersecurity, IT, governance and legal teams are trying to work out how to introduce appropriate controls after the fact.
It’s probably the fastest adoption of technology we’ve ever seen within enterprises, and everyone is now asking the same questions.
- How do we govern it?
- How do we secure it?
- How do we ensure it’s being used responsibly?
The long-term impact is still unknown.
We’re living through a period that will define a new normal, and organisations are still trying to understand what that future will look like and how they’ll manage it.
What’s interesting is that this has also created strong alignment between CIOs and CISOs.
They’re both looking at the same challenge and recognising that AI governance will become one of the defining priorities over the next few years.
How is AI changing both cyber threats and security opportunities?
Attackers have access to exactly the same AI technologies as defenders, so naturally they’ll use them to make attacks faster and more sophisticated.
The good news is that cybersecurity teams can also use AI to improve their response times, automate repetitive tasks and analyse incidents more quickly.
The reality, though, is that security has always involved playing catch-up.
Whether it’s physical security or cybersecurity, defenders have to be right every single day, while attackers only have to succeed once.
AI won’t fundamentally change that dynamic, but it will make defenders much faster at responding.
The challenge is that this increased capability also comes with increased cost.
Organisations will need to invest in more advanced technologies and ensure they have skilled people who know how to use them effectively.
What is Island’s mission, and what market challenge was it created to solve?
Our founders recognised that the browser is one of the most important applications in every organisation, even though it was never actually designed for enterprise use.
Browsers were originally built for consumers, not businesses.
As organisations adopted cloud applications and SaaS platforms, the browser became the place where people did their work, yet it remained largely outside the enterprise technology stack.
Instead of improving the browser itself, organisations built countless compensating controls around it.
That includes technologies like VPNs, VDI, SASE, SSE, sandboxes and DLP solutions, all designed to add security somewhere between the user and the application.
Island takes a different approach.
Rather than redirecting traffic through multiple layers of security, we build those controls directly into the browser itself.
That means security policies can be applied exactly where users interact with applications and data.
It also allows organisations to be much more flexible. Instead of blocking users, you can simply prevent the specific actions that create risk while allowing people to work normally.
Another major advantage is that those controls work whether the device is managed or unmanaged.
More recently, we’ve expanded beyond the browser to help organisations rethink the wider desktop experience.
As AI becomes embedded within more enterprise applications, applying controls directly where users interact with data gives organisations much greater context and visibility.
We can understand not only what users are doing, but why they’re doing it, allowing security decisions to be based on both context and intent.
Why is the browser becoming such an important part of security strategy today?
Over the last 15-20 years, almost every enterprise application has moved into the browser.
Whether it’s SaaS or other web-based applications, the browser. has effectively become the workplace.
Following the shift towards hybrid working, many employees now spend between 80% and 90% of their working day on a browser.
What’s remarkable is that organisations accepted a consumer product as the foundation of enterprise work.
We don’t really do that with any other technology. Almost everything else we use in business has been purpose-built for enterprise environments.
The opportunity now isn’t simply making browsers more secure, that part is relatively straightforward.
It’s about making the browser an active part of the enterprise technology stack.
It becomes the workspace where users access applications, collaborate and interact with data securely.
Ultimately, security shouldn’t be about blocking people.
It should be about reducing friction, enabling productivity and giving users secure tools that allow them to do their jobs more effectively.
That’s why the browser has become such a strategic part of modern enterprise security.
What emerging threats, trends or opportunities should security leaders be watching over the next three to five years?
One of the things that really caught my attention recently was seeing that one of the most widely adopted consumer uses of AI isn’t actually productivity, it’s companionship.
If people begin trusting their personal AI assistants more than they trust their employers, that raises some interesting questions.
How likely are they to share sensitive information with those AI tools simply because they trust them?
Ultimately, security is built on trust.
Technical controls are important, but organisations also rely on users making good decisions.
That’s why moving security controls closer to where users interact with applications becomes increasingly valuable.
The more context and intent we can understand, the better those security decisions become.
The other trend I think we’ll see is greater scrutiny around AI spending.
At the moment, organisations are encouraging widespread AI adoption, but eventually CFOs will start looking closely at the costs.
When those bills arrive, businesses will want visibility into how AI is being used, whether it’s delivering value and whether employees are using it appropriately.
Understanding user behaviour, AI usage and where those interactions take place will become increasingly important, not only from a security perspective but also from a governance and financial one.