Office cold, kettle on, pad open. The break was, by the standards of recent years, calm — the customer-portfolio carried into the new year without any incidents requiring out-of-hours engagement, and the holiday period was the kind of rest that the previous several years' operational-pressure had, on accumulation, made overdue.
The portfolio. Six vCISO clients carrying through. Eighteen SOC customers. Twenty-eight EmilyAI commercial customers entering the year, with three additional prospects in late-stage commercial discussion for Q1 close. The team is at forty-three. The 2026 hiring plan envisages four to six further hires through the year.
The regulatory-environment book. The fifth book in the series — working title remains "The Programme Is the Compliance" though the publisher has been pushing a different framing — is in final draft. The publisher's review is in progress through January with publication targeted for late March or early April. The substantive content covers the post-NIS2-and-post-DORA operational discipline that the customer-portfolio programme work has produced through the past several years, the broader regulatory-environment progression including the EU AI Act and the UK Cyber Resilience Act, and the customer-organisation strategic frame for thinking about regulatory-environment-as-a-discipline rather than as an administrative burden. The case-study material is, as in the previous books, anonymised across the customer portfolio.
The threat-landscape planning for 2026. The continuing supply-chain pattern. The continuing state-actor activity (post-Salt-Typhoon, post-Treasury-BeyondTrust, the various Russia-Ukraine-related activity that continues into year-five of the conflict, the continuing Chinese-state-actor activity at sustained operational tempo). The continuing language-model-environment progression on both offensive-and-defensive sides. The continuing post-2025-UK-retail-wave Scattered-Spider-pattern activity that has, on early Q4 2025 evidence, been migrating from UK retail toward adjacent customer-organisation categories. The aggregate threat picture is consistent with the 2025 trajectory.
The product roadmap. EmilyAI v3.6 in Q2 with the v3.5-federated-learning capability moving from preview to general-availability across the customer base. Subsequent v3.x releases through the year on the steady cadence. The team's research agenda continues with two preprint-stage papers that may convert to formal peer-reviewed submissions through 2026.
The continuing personal-direction conversation. The shift toward strategic-and-external-facing work has continued through 2025 and the cumulative pattern is settled. The day-to-day operational management is the senior leadership team's; my own time is increasingly on the customer-engagement, the writing, and the conference contribution. The pattern is, on the personal-experience measure, sustainable and engaging.
The kettle has boiled. Inbox now.