Q1 closing. The customer-portfolio operational picture has been steady through the first quarter — no customer-organisation incidents requiring supervisory-authority notification, no acute-pressure period of the kind that the 2024 Q1 (the Change Healthcare and Operation Cronos sequence) or 2025 Q1 (the post-DORA-deadline programme work alongside the early UK-retail-wave activity) produced. The team has been able to sustain a more measured operational tempo than the recent years' Q1s have permitted.
The portfolio status. Six vCISO clients carrying through. Eighteen SOC customers. Thirty EmilyAI commercial customers (added two in Q1, no churn). The team is at forty-four (one hire in Q1). Q1 revenue is at approximately 102% of plan, with both services and product sides performing on plan.
The regulatory-environment progression. The post-NIS2 enforcement-environment continues to develop with the year-two enforcement decisions starting to land — the first multi-million-Euro NIS2-derived fines have been issued in two EU jurisdictions through Q1 and the customer-portfolio briefings have addressed the precedent-implications. The post-DORA financial-services regulatory regime is operationally settled into year-two operation. The EU AI Act compliance progression continues with the next staged-compliance deadline (high-risk AI system obligations) approaching in mid-2026. The UK Cyber Resilience Act is in advanced legislative stages with introduction expected in H2 2026.
The book. The regulatory-environment book is at proof — the publisher's editing-and-typesetting cycle has been completed in late February, the proof copy is in the team's review, and the publication date is locked for the 16th of April. The launch event is a small private affair in Bristol, comparable in form to the 2024 February book-launch event.
The product roadmap. EmilyAI v3.6 is on track for Q2 release with the federated-learning capability moving from preview to general-availability. The customer-side adoption of the federated-learning capability through the v3.5 preview programme has been, on the early-feedback measure, positive; the operational uplift in incident-grade-class detection performance has been measurable across the early-access customer population. The Q3-Q4 roadmap continues with the language-model-integration capability extensions that have been the principal product-research theme through 2024-2026.
The personal-and-team note. The continuing shift in my own role toward strategic-and-external-facing work continues. The team is, on the operational measure, performing at a level that has not required substantive day-to-day operational engagement from me for some time, which is the appropriate operational-leadership-delegation pattern for a company at the current scale. The 2026 customer-engagement and conference cadence is settled — Infosec Europe in June, Black Hat USA in August, BSides Manchester in October. The book launch in April is the principal personal-strategic event of H1.
Onward to Q2.