Dispatches from the first line of defence
Emma Smith, global chief information security office, Vodafone.
The world is at “a defining moment” in technological evolution. So says Emma Smith, Vodafone’s global chief information security officer (CISO) who has worked in cybersecurity for about as long as Vodafone Ireland has been in existence.
Smith has seen a lot of change over the past quarter century but AI presents the most radical evolution yet, not only for businesses but for humankind.
“Cloud computing and the internet were benchmarks,” she says. “AI is the next wave of technical evolution that will shift how our businesses work, how we protect our businesses and customers, and how we serve customers.”
As the technology evolves, so too does the threat landscape. Sixty per cent of Irish financial firms consider cyber attacks to be their biggest operational threat, according to a survey by the Compliance Institute in 2026. Smith oversees a cyber capability team across all Vodafone’s markets. Vodafone responds both globally and locally. Teams in Vodafone Ireland are embedded close to businesses, customers and regulators. Vodafone also benefits from scaled central cyber capabilities for architecture, operations, engineering and defence. The operator is currently expanding its existing capabilities in UK, EU and India with a new Global Cyber Centre (GCC) in Lisbon, Portugal.
Business customers can draw from international and local expertise and resources. “We’ve always taken the view that our scale means we can benefit from central technical engineering and operations that partner with local teams” says Smith. There is a blend of both.
“We have central capabilities, tools, platforms, expertise, local teams work closely on implementation and with customers and government. We tailor that service to make sure we’re meeting local laws and regulations, the threats facing that country and the needs of local customers. It’s important to have a blended model because the threat is global. Many cyber attacks originate beyond national borders. We have the opportunity to apply what we learn across all the countries we operate in.”
Cyber risk, Smith believes, has no finish line. The threat landscape continues to evolve, requiring sustained focus, investment, care and nurturing.
“It isn’t just national infrastructure companies who face this threat. There are layers of threat across the whole of society.”
In 2026, the danger emanates from AI. AI is lowering the barrier to entry and can increase the speed, scale and sophistication of cyber attacks. Doing the security fundamentals is a priority for businesses of all sizes.
One of the biggest threats to small and large businesses is social engineering: criminals stealing, through deception, confidential information such as passwords or payment details.
“It’s much easier to orchestrate a sophisticated social engineering attack with the help of a LLM [large language model],” says Smith. “It allows scaled attacks and targeted attacks which would have been manually intense before AI.”
Advanced AI can be used to identify and exploit vulnerabilities within a business. Less technically skilled criminals, conversing with the models in natural language, can conduct these attacks.
But AI also has defender advantages. It gives those responsible for protecting society, including Smith’s team, “the scale, reach and speed we’ve longed for. It’s difficult to defend machine speed attacks with human speed responses.”
The team’s goal is to adopt AI “in a safe and responsible way with partnerships that are durable and stand the test of time”. This involves keeping Vodafone customers informed, educated and abreast of changes.
There are a number of ways in which Vodafone Ireland spreads awareness of cybersecurity and demystifies the topic. The quarterly Vodafone Business Cybersecurity Report informs organisations about avoidable risks. Research from Vodafone this year found that four in 10 Irish businesses allow staff to access their networks on personal devices. Emma Smith recommends that every business puts fundamental security controls in place.
“For example, a key priority is enabling multifactor authentication on business-critical systems, cloud services, email and other accounts containing sensitive information.”
Small businesses are recommended not to use outdated devices or outdated software. “Take the updates when they come out. Keep the modern currency of technology that your company relies on. AI-enabled security tools can help identify vulnerabilities and suspicious patterns more quickly, but they must operate alongside human oversight and established controls. Having those foundational, fundamental layers of control in place is important. Not all small business can have security teams. This is where partnership and collaboration prove vital.”
Cybersecurity in a large organisation can be complex, spanning multiple clouds, interconnected systems and different departments. The Vodafone Business Cybersecurity platform conducts cyber security monitoring, health checks, and helps with incident response and management.
“Protecting our networks and the network edge [the boundary where a local device or private network connects to an external network such as the internet] is essential,” says Smith.
Vodafone’s mobile device security and endpoint security is conducted in partnership with large technology companies, including a range of established global security technology partners. As part of Vodafone and Google’s ten-year, billion-plus-dollar strategic partnership, Vodafone is developing cloud-based security and AI-enabled services for business customers using Google Cloud technology.
Google Security Operations (SecOps) supports Vodafone’s managed security services by analysing authorised security telemetry to identify suspicious activity and help customers investigate and respond to threats in line with agreed service arrangements. Customers can use Google Cloud services to strengthen the security, resilience and monitoring of their environments.
“Alongside cyber health check and readiness assessment, and security operations monitoring, SecOps allows us to work closely with customers to protect them,” says Smith.
Vodafone also works with government, industry peers and suppliers to strengthen cyber resilience.
“In cyber, we’ve only got one competitor,” says Smith, “the adversaries trying to attack us.”
Vodafone shares threat information and works on complex solutions with its peers, including the Irish Government.
“We help endorse and promote policies and make them accessible for small to medium-sized enterprise and consumers.”
The company is active in global and local collaboration groups. Emma Smith, for example, is part of the UK’s National Cyber Advisory Board. “Data sovereignty [making data subject to the laws of the country or region where it is stored, processed, or generated] will be an increasingly important consideration for organisations,” she says.
But the reality of cybersecurity and cyber resilience is there is no endgame. “As we see more automation and more use of AI, that will affect cyber threat. In 25 years’ time, I think we should expect machine-on-machine attack and defence.” Cyber risk requires constant management. Does that mean human management?
“I think it will be AI plus human,” replies Smith. “I think we’ll always have a human security workforce but it has to be AI enabled. There are certain tasks you wouldn’t want a machine doing, certainly not until we’ve really got all the guardrails established. Fully autonomous AI-enabled security is something we all have a vision towards but that requires incremental transformation.”
In this changing telecoms landscape, businesses are advised to keep two mantras in mind: become risk aware and maintain a security culture.
Smith explains: “Often a human will spot something that layers of security may not, yet part of the problem is that people often don’t report things when they happen. Every business, large and small, needs an open and transparent culture where people feel comfortable to report.”
Every business should be aware of the fundamentals of cybersecurity: understand the risks, know where to go for help, take the latest software upgrades, get rid of out-of-date devices, introduce multi-factor authentication. In this defining moment of telecommunications, the future is in our hands.
“Who knows what technologies we’ll all be using in 25 years’ time? But the pace at which AI is advancing, and its ability to transform processes we’ve relied on for many years, is immense. I see this moment as a seismic shift in the way we work, and the ability to adapt securely will remain essential.”
Emma Smith will speak at the upcoming Vodafone Ireland event, Future Frontiers, on November 4th in the Dublin Royal Convention Centre.
