Digital Content Editor, Eve Goode spoke exclusively with Travis DeForge, Director of Cybersecurity at Abacus about how organisations should strengthen their cyber-resilience.
Abacus works across different industries to strengthen cyber-resilience. What are the biggest challenges your clients are facing today?
We serve highly regulated sectors, primarily financial services and healthcare, where the challenge is balancing cyber-risk with growing regulatory expectations and enabling employees to do their jobs.
In financial services, firms must demonstrate strong governance, operational resilience and third-party oversight in line with requirements outlined by the FCA in the UK, DORA in the EU and evolving SEC expectations in the US.
At the same time, they are defending against ransomware, business email compromise and increasing AI-enabled attacks.
The value of financial data and the time-sensitive nature of trading and fund operations make these firms particularly attractive targets, while making any disruption especially costly.
Healthcare faces similar pressures.
Providers must protect highly sensitive patient data and critical clinical systems while keeping pace with requirements including GDPR in Europe, the evolving Cyber Security and Resilience Bill in the UK, and HIPAA and HITECH in the US.
Ransomware, data theft and operational disruption remain significant risks, with the potential to create financial, reputational and operational consequences in addition to, and most importantly, putting patients’ health at risk.
Across our client base, AI is also introducing new risks.
The AI landscape shifts monthly, sometimes weekly.
New tools, features and rules arrive constantly, and a setup that was sound six months ago can quickly fall behind.
The exposure shows up when no one is governing AI usage: unknown tools, sensitive data leaving the environment and no records logging what happened.
How does Abacus help companies overcome these challenges?
At Abacus, we take a layered approach to cybersecurity, bringing together the controls, tools, monitoring, testing and expertise needed to manage risk across our clients’ environments.
We make sure that technology, processes and people work together as part of a coherent security programme so organisations can identify weaknesses, strengthen defences and respond quickly when threats emerge.
Our Blue and Red Teams play complementary roles across the risk management lifecycle.
The Blue Team monitors and defends client environments through 24×7 managed detection and response (MDR) and vulnerability management.
Our Red Team tests those defences from an attacker’s perspective, using penetration testing and social engineering to expose weaknesses before they can be exploited.
If a breach does occur, our 24×7 incident response capability supports containment and recovery.
Lessons from more than 200,000 hours of incident response work are fed back into our monitoring and detection capabilities, helping clients benefit from intelligence gathered during real ransomware recoveries and adversary activity.
Our team also offers managed AI services, including an AI Risk and Readiness Assessment and Secure AI service.
As AI orchestrators, we select, integrate, govern and continuously manage best-of-breed AI tools and platforms inside the environments we already run and secure for our clients so they can deploy AI with confidence – and without compromising security or compliance.
People are another important part of resilience.
Cybersecurity awareness training and simulated phishing help firms strengthen resilience to social engineering, while tabletop exercises test how teams would respond to a serious incident.
For regulated firms, cybersecurity also needs to support compliance.
We help organisations strengthen the controls and reporting needed to meet changing regulatory expectations and demonstrate that those controls are working in practice.
Many organisations are investing heavily in AI-powered security tools. Where do you see AI making the biggest difference for defenders, and where are its limitations?
AI is transforming cybersecurity on both sides of the battlefield.
Adversaries are using AI to automate social engineering, accelerate attack velocity and bypass traditional defences.
Generative AI has also proven highly effective in facilitating social engineering by malicious actors, who produce high-quality phishing emails and even leverage deepfakes to trick end users.
In parallel, AI-driven agentic ransomware has emerged and represents a shift from static, pre-coded malware to adaptive, on-demand attack engines.
These tools can write and execute custom code in real time, making them harder to detect and faster to act.
At the same time, though, defenders are leveraging AI-powered tools to detect anomalies, predict threats and respond rapidly.
There are several areas where AI is making a difference here. Industry-led threat intelligence and AI-driven processing add context to security events, enabling faster triage, smarter prioritisation and more effective response.
MDR solutions are increasingly incorporating AI-driven enrichment to reduce noise and accelerate response.
Before organisations adopt AI for defence, however, it’s important to understand where its limitations can create additional risk.
We typically see firms fall down in four main areas: they have not established clear ownership and governance, they introduce AI without considering how securely it integrates with existing systems, they lack sufficient oversight once it is in use, or they fail to assess whether it is delivering the intended value.
These gaps can quickly turn AI from an asset into a liability, particularly for regulated organisations where sensitive data and compliance requirements add another layer of risk.
Firms need clear guardrails from the outset to ensure both the AI tools and the people using them have access to the right data, followed by ongoing monitoring as the technology and its use develop.
What are the most common vulnerabilities your Red Team uncovers during penetration testing, and what practical steps can organisations take to address them?
Some of the most common weaknesses our Red Team uncovers are unpatched vulnerabilities, security misconfigurations, weak identity and credential controls, and exposure to social engineering.
We also regularly find that critical systems, including security tools and backup environments, are improperly domain-joined or share credentials with other systems.
This can allow an attacker to turn an initial, relatively minor compromise into access across a much wider part of the network.
Weak or inconsistently applied multi-factor authentication (MFA) is another recurring issue, particularly around perimeter systems such as legacy VPNs.
We often encounter easily guessable credentials, excessive user privileges and exceptions to security policies which create exploitable gaps.
Social engineering exercises can expose similar weaknesses in processes and employee awareness, including susceptibility to phishing and MFA-bypass techniques.
Addressing these vulnerabilities means focusing on exploitable weaknesses rather than periodic compliance checks.
Organisations should enforce MFA consistently, limit access privileges, segment critical systems and backups and use continuous monitoring to detect suspicious activity.
Regular Red Team exercises, penetration testing and scenario-based training can then help identify and address new weaknesses as they emerge.
Finally, the base of a good cybersecurity strategy starts with foundational IT best practices, like regular patching.
Outdated software will contain vulnerabilities that cyber-criminals can exploit and an organised and standard approach to patching and proactive maintenance is key.
Looking ahead, what do you think will be the defining cybersecurity challenge over the next three to five years, and how should security leaders start to prepare today?
AI will continue to increase the speed and sophistication of cyber-attacks, but one of the defining challenges will be managing third-party risk amid escalating supply chain attacks.
As organisations become more dependent on external providers, their exposure increasingly extends beyond their own environment.
Data may pass through multiple suppliers and subcontractors, creating additional points of vulnerability and making risk more difficult to assess and control.
The difficulty is that organisations often have limited visibility into how vendors handle data, which subcontractors they use and what access those parties retain.
Security leaders therefore need to move beyond basic vendor questionnaires towards continuous third-party risk management, with clearer contractual controls, stronger oversight and access restricted to the minimum required.
These incremental measures can significantly reduce exposure over time.
As Director of Cybersecurity at Abacus Group, Travis leads a world-class Red Team that provides advanced penetration testing and adversary simulation services. Before transitioning to the private sector, Travis served as an Active-Duty Military Intelligence Officer in the US Army, specialising in signals intelligence, open-source intelligence and electronic warfare. His experience in supporting large-scale intelligence operations across Europe has equipped him with the ability to think like an adversary, a skill he now uses to help businesses anticipate and counteract cyber threats. Travis’s blend of military and technical expertise makes him unique at delivering critical, in-depth security strategies to clients ranging from small businesses to Fortune 500 enterprises. Holding a Master’s degree in Information Technology Management, Travis possesses numerous certifications in networking, project management, cybersecurity and cloud computing. He is also an internationally published author on network penetration testing using open-source tools.