Smart cities was the theme yesterday at Consec 26, the annual conference of the Association of Security Consultants (ASC). For a second year the association held its gathering at Hinxton Hall, outside Cambridge, before a black-tie dinner with awards ceremony in the evening.
ASC Board member Nigel Cook was on stage first, to introduce the chair, Simon Crane, pictured. Simon said: “Consec is what you make it. There are some fantastic people here, we have academia, industry, manufacturers, suppliers, integrators, everyone you can think of in the security industry.” He went on to mention how ‘the threats are changing’, and in particular from hostile states – touched on by numerous speakers over the day. Hence, one reason for the smart cities theme; although as a number of speakers pointed out, securing and seeing to the smooth running of the ‘smart city’ is not only about tech; but governance, and ethics (to put it one way; do you want patrolling drones that carry weapons?!).
JSaRC introduced
Simon Crane introduced the first speaker, Padraig Carroll, newly of the Home Office’s JSaRC (Joint Security and Resilience Centre). He described JSaRC in terms of collaborations; ‘meeting government problems with industry capabilities’. Hailing the Home Office security minister Dan Jarvis for his commitment, Padraig Carroll also mentioned the Home Office’s annual March invitation-only exhibition Security & Policing, at Farnborough. The ASC has a pavilion there with eight members able to exhibit; the ASC’s Chief Operating Officer (COO) Gary Thomas is leading on exhibiting there.
Adaptive systems
The criminologist Prof Alison Wakefield of the University of West London (UWL) and a former chair of the Security Institute talked about smart cities and ‘complex, adaptive systems’, drawing on her research paper for the security management association ASIS International, about autonomous vehicles. A smart city as she set out harnesses data and technology, such as for traffic management and public safety. But a ‘smart city’s is not only a matter of tech, but for a high quality of life. However the more dependent a city is on technology, the higher the cyber security challenges. She went on to offer the prospect of anticipating threats, through big data analytics and AI-enabled intelligence. As for resilience – another word that cropped up regularly across the day – she said that a resilient city can operate under ‘partially degraded systems’, for example to maintain emergency communications – perhaps switching to ‘manual modes’ – and is able to recover quickly from a cyber incident, which may include poisoned data and failures of AI decision making.
Move beyond linear
Security professionals, she said, must move beyond ‘linear prediction models’ and consider among other things ‘cascading failures’, and second- or third-order consequences. She concluded that smart cities cannot be secured through technology alone. We need systems thinking to understand complexity. We need to be informed, to anticipate threats and achieve resilient systems so that critical services will still continue under (cyber) attack. “And we ourselves need to evolve so that we are comfortable with governance, adaptation, and organisational resilience, as with cyber security tools.”
Hostile states
Later speakers gave academic or practitioner views, for example of an ‘intelligence led SOC’ – security operations centre – which adversaries will want to enter. Information silos are still around, more than one speaker acknowledged, and there’s no guarantee that you will have access to all the information in a smart city – used by the police, local government, estates, venues, transport, utilities and the National Health Service. AI and SaaS (software as a service) collects data, but as a support only to the human judgement of the SOC analyst, who assesses and decides. While the prospect is of AI detectors raising security concerns, hostile nation states – notably Russia, China and Iran – may be cyber or physical acts; or, the stirring up of unrest on social media. In a word, ‘blended’ threats. For businesses, it means the insider threat is ‘logical’, one afternoon speaker stated, whether due to negligence, a compromised insider exploited, or the disgruntled employee paid for access.
More in the December 2026 edition of Professional Security Magazine.
Photo at Hinxton Hall Conference Centre by Mark Rowe.
