As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question than "should we adopt it" — it's "who's accountable when it goes wrong." To unpack this, The Cyber Express sat down with Harsha Reddy, Head of Information Security at Veterinary Emergency Group (VEG).

With nearly two decades in security leadership — including senior roles at Lixil and American Standard before joining VEG — Harsha brings a practitioner's view of where AI is genuinely changing the CISO's job, and where it's mostly just hype and shadow adoption.

Watch the Full Interview:

Harsha Reddy Explains Why AI Will Replace Tasks, Not Defenders

Harsha pushes back on the narrative that AI will hollow out security teams, pointing to Gartner research showing that while most fields are projected to lose jobs to AI, cybersecurity is expected to gain them. In his view, the technology is mainly absorbing the "toil" — log review, alert triage, evidence gathering — that keeps analysts from actually defending.

Also listen to S1 Episode: Awareness and Education at Young Age is the Answer to Cybersecurity Skill Gap

“It's the analyst who refuses to use AI that will get replaced by an analyst who uses it,” he says.

On adoption, Reddy points to a 2024 Microsoft-LinkedIn survey in which most executives called AI critical to their business, yet a majority had no formal plan and most had employees already bringing in their own tools. That gap, he argues, is why so many organizations are now dealing with AI-related data leaks. "Many organizations started onboarding AI like software when they should be onboarding it like staff." His fix isn't more restrictions — blocking AI just pushes it into the shadows — but guardrails, an internal AI enablement committee, and measuring actual business value instead of token consumption.

The conversation also digs into deepfake-driven fraud, why training employees to spot deepfakes is “a losing bet” at machine speed, and how he decides when to greenlight a new AI tool versus telling a business unit “not yet.”

The conversation closes with our newly introduced rapid-fire round "Express Shots" — Claude vs. ChatGPT, passkeys vs. passwords, and Reddy's prediction for the biggest cybersecurity threat of 2030.

💾

Ofcom has announced tougher measures aimed at stopping the spread of non-consensual intimate images and AI-generated deepfake abuse online, as the UK regulator pushes tech companies to strengthen user safety protections. The updated guidance, released Monday, will require platforms to do more to identify, detect, and remove illegal intimate content shared without consent. The changes are part of Ofcom’s strengthened Illegal Content Codes under the UK’s Online Safety Act and are expected to come into force in autumn 2026, subject to parliamentary approval. At the centre of the updated rules is the growing concern over deepfake intimate images, including AI-generated nude content and manipulated explicit media targeting women and girls online.

Tech Platforms Asked to Deploy Hash Matching Technology

Under the proposed measures, Ofcom is recommending that certain platforms and apps expand their use of automated detection systems known as “hash matching” technology to identify and block illegal intimate images before they spread further online. Hash matching works by converting harmful images into unique digital fingerprints, or hashes, which are then stored in a database. When users attempt to upload the same or similar content again, platforms can automatically detect and block the material. Ofcom specifically referenced the use of databases such as StopNCII, one of the leading systems designed to combat the spread of non-consensual intimate imagery online. The regulator said the move is aimed at providing stronger protections for women and girls who are increasingly being targeted through AI-enabled abuse and image manipulation. According to Ofcom, the updated recommendations, combined with new UK legislation banning “nudification tools,” could significantly reduce the circulation of harmful intimate content online.

UK Government Pushes Faster Removal of Non-Consensual Intimate image

The tougher stance follows recent action by the UK government to pressure technology companies into removing abusive content more quickly. Earlier this year, UK Prime Minister Keir Starmer backed legislation introducing heavy penalties for platforms that fail to promptly remove illegal intimate images. Under the law, companies may face substantial fines if they do not take down reported content within 48 hours. Authorities have also warned that services repeatedly failing to comply could face restrictions or blocking in the UK. The government said the rules are intended to prevent victims from repeatedly reporting the same harmful images while waiting for action from online platforms. The push for stricter enforcement comes amid rising global concern over the misuse of generative AI tools to create realistic explicit deepfake content without consent.

Deepfake Concerns Grew After Viral AI Image Abuse Cases

The UK government’s increased focus on deepfake intimate images follows widespread concern over reports that millions of manipulated nude images involving women and children circulated online through AI-powered tools and chatbots earlier this year. Regulators and child safety advocates have warned that the rapid growth of generative AI platforms has made it easier to create convincing fake explicit images, raising concerns around online abuse, harassment, and exploitation. Ofcom said technology companies must take greater responsibility for detecting harmful content and preventing its distribution across their platforms.

Ofcom Investigation Into Online Platforms Continues

The latest action also comes as Ofcom continues broader investigations into online platforms under the Online Safety Act.

In April, the regulator expanded an ongoing probe into Telegram, Teen Chat, and Chat Avenue over concerns linked to child sexual abuse material (CSAM) and online grooming.

According to Ofcom, the investigation began after receiving evidence suggesting that harmful content and predatory behaviour may have been taking place across these services.

A major focus of the investigation involves Telegram’s potential exposure to CSAM. Authorities said intelligence shared by the Canadian Centre for Child Protection indicated the alleged presence and distribution of abusive material on the platform.

Following its own assessment, Ofcom launched a formal investigation into whether Telegram may have failed to meet its legal responsibilities under the Online Safety Act.

The regulator stated that platforms offering user-to-user communication services are legally required to assess risks related to illegal content and implement safeguards to prevent its spread.