The final session. First, where the threat landscape is heading and what to start preparing for now. Then, the part that makes the whole programme worthwhile: your own 30/60/90-day plan.
Day 3Wrap-UpAction Plan
Notes: Close the course with forward-looking calm, then convert three days into commitment. The value is only realised in what they change.
Lesson 16 · Slide 2
The through-line of three days
The adversary is persistent — and you are personally the target
Harden the organisation — people, foundations, resilience
Govern & decide — lead the programme and the crisis
One sentence
Persistent threat → you are the target → harden self, org, and decisions → govern and rehearse resilience.
Notes: Reveal each. Recap the arc so the horizon and action plan sit on a clear foundation.
Lesson 16 · Slide 3
The horizon: what to watch
These are things to start preparing for, not to panic about. Press → along the timeline.
Now: harvest-now-decrypt-later (the quantum clock runs)
→
Near: AI-driven offence & deepfakes maturing
→
Mid: IoT / OT & cyber-physical convergence
→
Ongoing: supply-chain & regulatory pressure
Notes: Reveal left to right. The harvest-now node is highlighted because its clock is already running today (Lesson 10), unlike the others which are emerging.
Lesson 16 · Slide 4
Post-quantum & AI
Post-quantum
Today's encryption may not survive future quantum computers. Long-lived secrets stolen now can be decrypted later. Inventory and begin migration (Lesson 10).
AI
Offence and defence both mature. Deepfakes erode trust in voice and video. Fundamentals — verification, OPSEC — still hold (Lessons 09, 11).
Notes: The two fastest-moving trends. Both were covered; here they are framed as things to plan for, with the reassurance that known defences still apply.
Lesson 16 · Slide 5
Convergence & systemic risk
IoT / operational technology — cyber risk reaches into the physical world
Cyber-physical convergence — a breach can now have kinetic consequences (Lesson 15)
Supply-chain systemic risk — one shared supplier can affect many at once (Lesson 10)
Evolving regulation — faster disclosure duties and accountability at board level
Notes: Reveal each. These expand the surface and the stakes. The point for leaders: cyber is now enterprise and physical risk, not an IT topic.
Lesson 16 · Slide 6
Of everything in three days, which one change would most reduce your personal risk this month?
C. A informs but changes nothing by itself; B rarely fixes the human paths adversaries actually use; D surrenders your personal risk to someone else's timeline. Phishing-resistant authentication (Lesson 04) plus the verification rule (Lesson 09) defeat the most common real intrusions — credential theft and fraudulent instructions — and you can do both this week without anyone's permission.
Notes: Bring it home. The single highest-leverage personal change is the pairing of phishing-resistant auth and the verification rule. Everything else is secondary for personal risk this month.
Lesson 16 · Slide 7
From knowledge to commitment
Three days of insight change nothing until they become a plan with owners and dates. We build it in three horizons.
The frame
30 days — personal quick wins. 60 days — organisational program. 90 days — governance and resilience.
Notes: Set up the 30/60/90 structure. Emphasise owners and dates — a plan without them is a wish.
Lesson 16 · Slide 8
30 days — personal & quick wins
Adopt phishing-resistant authentication on your key accounts (Lesson 04)
Complete your device hardening baseline (Lesson 04, 07)
Write and adopt your verify-before-you-act rule (Lesson 09)
Run one OPSEC pass on your own signature (Lesson 05)
Notes: Reveal each. These are all things a leader can do without waiting for a programme — the fastest risk reduction available.
Lesson 16 · Slide 9
60 days — organisational programme
Schedule and run a tabletop like today's (Lesson 15)
Test a backup restoration end to end (Lesson 12)
Review your top suppliers' access and requirements (Lesson 10)
Set an acceptable-AI-use rule for your teams (Lesson 11)
Notes: Reveal each. These require organisational effort and a sponsor — the leader's job is to fund and mandate them.
Lesson 16 · Slide 10
90 days — governance & resilience
Establish your evidence-forcing question cadence (Lesson 14)
Agree metrics that matter; retire the vanity ones (Lesson 14)
Fund the biggest unfunded resilience gap you found this week
Begin your post-quantum inventory for long-lived secrets (Lesson 10)
The horizon meets the plan
The 90-day items are where you start preparing for what's coming — deliberately, not in a panic.
Notes: Reveal each. The 90-day band connects the action plan to the horizon scan — governance and forward-looking resilience.
Lesson 16 · Slide 11
Two-minute drill: your first 30-day action
Right now, write the single action you will complete in the next 30 days, with a date. Make it something you can start this week without anyone's permission.
Notes: Start the 3-minute timer. This is the behavioural close — one concrete, dated, self-owned commitment before they leave the room.
Lesson 16 · Slide 12
Close — the value is in what you change
You are the target; the fundamentals defeat the common attacks
Harden self and organisation; govern the programme; rehearse the crisis
Start with one dated action — and schedule the next rehearsal
Final word
Security is not a state you reach; it is a discipline you lead. The programme paid off the moment you commit to the first change.
Notes: Reveal each. End on agency and leadership: this was never about fear, but about the leader's power to reduce risk deliberately. Point them to the homework — the full 30/60/90 plan.