Summer 2026 has been a scorcher in more ways than one. Between the heatwaves and the World Cup heartbreaks, what have the ECI team been reading when they haven’t been spending their time ferrying tower fans from room to room or trying to stay awake past the second-half whistle...

Mia Smith
Land by Maggie O'Farrell
Land is a beautiful, sweeping novel set in the aftermath of the Irish potato famine, following one family across generations and continents as they are drawn back, again and again, to the same patch of remote Irish ground. At its heart are questions of home and identity, and the indescribable pull back to a place that is bleak yet somehow impossible to leave behind. A thread of magic and Irish folklore runs through it, but nothing ever feels far-fetched. I've read reviews that complain of it being too descriptive, but I personally loved the level of detail O'Farrell offers when describing the wild and rugged landscape, which feels less like a setting than a character in its own right. I hope this, like Hamnet, is adapted into a film - ideally also with Jessie Buckley in the lead role!

Jeremy Lytle
All That Glitters: A Story of Friendship, Fraud, and Fine Art, by Orlando Whitfield
If you are even vaguely interested in the art world I’d recommend this book. It’s a memoir of friendship but also betrayal at the heights of the contemporary art world. Whitfield met Inigo Philbrick when they were at Goldsmiths together, and while Whitfield’s own dealing career didn’t get anywhere, Philbrick went on to dizzying success, trading multimillion-dollar art works before pulling off the biggest art fraud in history. Whitfield uses his insider eye to show an industry that runs mostly on charm and with barely any regulation – a far cry from the world of the FCA. It’s this combination that means dazzling brilliance can cover a whole manner of sins. Part true-crime thriller, part an ode to a lost friendship.

Faye Maughan
London Falling by Patrick Radden Keefe
Patrick Radden Keefe picks up on the story of a 19-year-old boy who fell to his death from the balcony of a luxury apartment overlooking the Thames. His grieving parents discover that he'd been living a double life, posing as the heir to a Russian oligarch's fortune and moving into the orbit of dangerous people. In what's already a fascinating story, Radden Keefe uses his journalistic skills sensitively, digging into the background of a young man who emerged from his school years and very quickly became out of his depth. It's gripping, with an amazing pace, and raises questions about a criminal side of London that most people are happy to ignore. This book would not be as good as it is without the role played by his parents and their desperate search for answers.

Jeroen Sibia
Discussion Materials by Bill Keenan
Keenan's memoir charts his stumble from student athlete into life as a junior banker. It is a gloriously unglamorous account of life as a junior on the sell-side: the all-nighters, the endless reformatting of decks, the slow dawning that being brilliant at one thing prepares you for absolutely nothing about the next. Having come up the same way, I found it all very familiar, not least the special despair of an MD who wants the deck to "pop" at 2am. The bankers we work alongside every day are the ones who lived through that grind and came out sharper for it, and the best of them make a genuinely hard job look effortless. Keenan is wonderful on the small indignities and left me with a real affection for anyone who survives it all and still, somehow, cheerfully returns your call at ten on a Friday night.

Scarlett Salamon
Lessons in Chemistry by Bonnie Garmus
I really enjoyed Lessons in Chemistry, which follows the indomitable Elizabeth Zott as she pursues her passion for chemistry in 1960s America and faces constant adversity navigating a male-dominated environment. Her colleagues find it simply unfathomable that a woman could be capable of advancing science. When she is fired from her research position, Elizabeth is thrust into a career she never expected: hosting a cooking show. Through this unlikely platform, she empowers women across the country, teaching them the chemistry behind cooking and spreading the message that women are capable of doing what they want, not simply what society expects of them.
The book delivers a poignant message about the progress made towards equality and challenges the reader to reflect on the work still to be done. Elizabeth's tenacity is admirable and her refusal to accept the limitations placed on her sets an example that resonates far beyond the world of science.
Insights
28/07/2026
What are ECI reading? Our summer 2026 reading list
ECI has invested from Manchester for close to three decades - as we mark our 50th year, Stephen Roberts, who has spent much of his career doing deals across the North West, reflects on why the region remains one of Europe’s busiest deal markets and why it is still one of the best places in the UK to build and scale a business.
ECI’s Manchester office has led almost a third of ECI’s investments in its latest Fund. Why is the Manchester office so important?
“Because on some measures Manchester is the second most active private equity market in Europe, behind only London. It is a busy market, with a strong population of PE and VC funds based here, and that activity is particularly strong at the lower-cap end, with many deals which gives us sight of opportunities early. It also has a particular character: it is big, but small too. Everyone knows everyone, it is less transient than London, and that fosters a supportive and collaborative culture, which matters a lot when you’re building a business. And lastly, but most importantly, there’s a lot of innovative growth businesses here. We have been investing here for close to thirty years, and across every fund we have done two or three good deals out of the Manchester office.”
Does being on the ground change anything for the Founders and management teams you back?
“I like to think so. For a founder, having your investor around the corner is valuable. It means we can meet for a coffee at short notice to talk through a strategic issue, rather than everything being a formal, diarised set-piece. Those informal touchpoints often matter most.”
The North West is often labelled a tech region - is that how you see it?
“I would call it a growth hub rather than a tech hub. The perception that it’s all tech undersells the breadth we see. Partly that’s because some of the biggest success stories have been tech or tech-adjacent - the North West has produced a remarkable run of success stories, from Boohoo and THG to AO and On the Beach, and more recently Matillion. But that’s a real range; e-commerce has always been strong here, as have tech-enabled services. Our own track record reflects that breadth: we have backed businesses like Citation, Great Rail Journeys, Clarke Energy Services, TMG, CPOMS, Moneypenny, CMap and Mobysoft across the North, and what they have in common is that they’re strong, well-run, growing businesses, which is what we look for.”
What has changed in the market over the years you have been doing deals here?
“The biggest shift is how the advisory community has matured. It is no longer a case of regional teams covering regional deals - senior, nationally focused advisers at the major firms are now based in Manchester rather than London, across corporate finance but also legal and broader advisory. Manchester has become a national deal-doing centre in its own right, not just a regional one. That is true for us as well – personally, I lead the HRtech sector nationally, combining that sector expertise with genuine local presence. We also deliver national and international deals from here. A good example is our recent investment in Paragin Group, the Benelux leader in high-stakes assessment software, led out of Manchester, just as we support TAG on its international growth from here. Being based in the North West does not mean only doing North West deals.”
Do you think there’s a growing confidence in the region, is that translating to deals?
“There’s a huge amount of foreign direct investment in Manchester - it’s now in the top ten large European cities in the Regions of the Future rankings. You can see it on the ground (and in the amount of cranes across Manchester!) - real money going in from the Good Growth programme, innovation hubs, and a funding ecosystem built around the universities. VC investment in the North West was £2bn in 2024.”
What would you still like to see strengthened in the region?
“Connectivity remains top of the list. International travel out of Manchester is excellent, but it can be quicker to reach Amsterdam than Newcastle. We’ve said this for years and progress has been slow, but it’s still the biggest single thing that would help the North build on the past decade’s growth. One of the more dramatic changes that you could expect to strengthen the region is Andy Burnham becoming PM. This will help to shift the country’s centre of gravity away from London, with Burnham talking about a 'Downing Street North', a permanent government base here in Manchester. It is an interesting challenge to the London-centricity of the UK, and I’d expect a renewed focus on devolution with Manchester and the Northwest front and centre, which should be genuinely exciting for businesses and investors in the region.”
What’s your message to Founders?
“That we are very much open for business. We have backed growth businesses from this region for the better part of thirty years, and we intend to keep doing so for a long time yet. I’m passionate about the success of the North West and North West-based businesses”
Insights
22/07/2026
Stephen Roberts
Read Time: Min
Q&A: The investment outlook for the North West
A year ago, the question we heard most often from the software teams in our portfolio was some version of “how do we get AI to write more of our code?” It’s amazing how quickly that question has become out of date.
We recently brought together technology leaders from across our portfolio - CTOs and engineering heads from businesses spanning insurance, communications, professional services software and more - to hear what AI is actually doing inside their teams, not what the headlines say it should be doing.
If coding is no longer the bottleneck, what is?
The clear message from the group was: code generation is largely a solved problem, and the constraint has moved. The hard part - and the one that determines whether AI is an asset or a liability - is no longer writing the software, it’s all about verifying it.
Engineers writing lines of code used to be the main bottleneck but now an agent can produce a working feature in an afternoon. The new constraints are testing, quality assurance, security review, and the broader question of whether you can trust what has been produced enough to put it in front of a customer (and let’s not lose sight of the product question either - are we building the right things in the first place?). As one CTO put it, generation has improved so dramatically that every other part of the pipeline is now comparatively slow.
Why this should worry (and excite) leaders
Research from Veracode found that close to half of AI-generated code contained at least one of the most common security vulnerability classes, and that figure barely improved as the underlying models got more capable. A separate 2025 study of several hundred pull requests found materially more vulnerabilities in AI-assisted code than in human-written equivalents. Google's DORA research, the most authoritative longitudinal study of software delivery, has been blunt about this: AI speeds up development but it amplifies problems where team’s processes are weak.
Point a powerful generation engine at a team with strong testing, automation and review, and you will see real value in your acceleration. Conversely, if you’re pointing it at a team without those foundations in place, you’ll get more code and more defects.
AI will make your engineering faster and cheaper but has a knock on impact on verifying that work.
Automation isn’t the full answer (yet)
The group was unanimous that scaling quality assurance to match the new pace of generation is the challenge they are all focused on. Agents and automation are clearly beneficial, but trust and demonstrated failure cases are the challenge. Established test and security platforms were variously described as too slow, too narrow, or too expensive to keep up with code now arriving at pace.
CMap, the professional services software business, used AI agents to rebuild a core product written in a niche legacy language - a rewrite estimated at well over a year of manual effort - in a matter of weeks. In the process, the agents generated roughly 15,000 automated tests. That number is the tell – for automated testing to be effective, there needs to be significant scale, and you need to ensure that the machine hasn’t learnt how to mark its own homework highly. The scope of the testing depends on the scale of the change and the risk of the application (we’d all like to think the software that runs our cars has a higher trust hurdle than our favourite casual mobile game).
The businesses making the most progress treat evaluation, where testing of AI is automated against real scenarios, as core engineering work, not a “vibe check.” They actively guard against models gaming their own tests. They apply a risk-tiered quality bar: “good enough” for low-stakes internal tools, full validation for anything customer-facing or regulated. One CTO stated that getting it wrong in those contexts is not just an embarrassment but a genuine harm. The unglamorous plumbing of integration and automated testing is also changing the shape of teams. Product, dev and design roles are merging, and everyone is looking for “builders” who carry the end-to-end skill set, and we are also seeing a renewed appetite for QA engineers.
Great examples of this are at Avantia, where the AI claims tool “Holmes” improved fraud-detection accuracy 3.4x and completes payment calculations with 98% accuracy - and it works in a high-stakes, regulated setting precisely because verification and human escalation were designed in from the start. Similarly, Moneypenny filed patent-pending guardrails into its AI communication tools to keep responses accurate and compliant. The teams making the progress are focused on treating “can we trust the output?” as the first question rather than an afterthought.
What is front of mind on cost?
It’s worth being honest that this is not free. A standard AI seat might cost around £90 a month, but a single power user running agents at full tilt can consume several thousand pounds of tokens in the same period. Token spend is not immaterial, and cost management is going to be a top focus for tech teams going forward. We are also not yet experiencing the full cost of the tools we’re using, and that pressure will only increase as current subsidies are removed.
What does this mean for your business?
Don’t fixate on how much of your code is being written by AI. Focus on the full software development lifecycle and quality of output (DORA being a useful framework for that).
The good news is that this is a problem of operational discipline. The businesses pulling ahead are simply the ones who have accepted that shift from creating code to verifying it, and acted on that change.
At ECI, working through these questions with our portfolio is something we take seriously - through our Data & AI Maturity Model, our Commercial Team, and our dedicated Data & AI Growth Specialist. Getting the technology leaders in a room together is part of that. If you would like to compare notes on where AI is moving the bottleneck in your business, we would be delighted to hear from you.
Insights
20/07/2026
Duncan Ramsay
Read Time: Min
Software development: Code is no longer the bottleneck
Tomorrow, Christopher Nolan's much-anticipated retelling of the Odyssey arrives in cinemas, and one of the oldest stories we have will meet a new generation. It is a story I know well. Long before I joined ECI's Commercial Team, I studied Classics, and while we tend to remember the monsters and storms, beneath the spectacle, it is a study of resilience, the tale of one leader trying to make it home against immortal will and mortal temptation.
In our 50th year, having backed more than 250 businesses, the theme of resilience continues to feel close to home. Growth is rarely a straight line. The companies that have the most successful stories are rarely the ones that dodged every storm, but those that pulled through despite the odds and were stronger for it. Here are five key concepts from the epic tale of Odysseus and what they might teach us about building businesses that last.
1. Nostos (Homecoming): Never lose sight of the mission
Everything Odysseus does bends towards one fixed point: Ithaca and getting home. The landscape might change, but the destination stays the same. CEOs will recognise this - markets shift, and strategies change, but the core reason a business exists, its "why", is what keeps it steady when everything else is in motion. Bionic is a good example of this. When we backed it, the mission was simple: help Britain's small businesses get a better deal. Almost everything else was reinvented, as a telephone-based energy broker became a multi-product digital marketplace across energy, insurance and finance. We also see this in the Tech for Good businesses we back – not only does the mission drive the strategy, but it also motivates employees and helps them retain top talent. For example, Peoplesafe’s focus on worker safety across their products - whether that was on their commute, when working remotely or in lone worker situations. Know your Ithaca, and keep sight of it even when things change around you.
2. Metis (Cunning): Strategy beats resources
Christopher Nolan described Odysseus as "an amazing strategist and a very wily person", and the Odyssey is careful about the kind of intelligence it admires. Homer’s Odysseus is not “sophos”, learned or wise. He is “polymetis”, a man of many wiles: resourceful, quick, able to solve the problem in front of him with whatever is to hand. That distinction travels well into business. The strongest companies are not always the ones with the most capital or the biggest teams, but those able to think on their feet and problem-solve quickly. We see this in many of the companies we’ve backed, where they face much larger incumbents. It isn’t likely you will be able to outspend such a rival; however, you can out-think them, focussing relentlessly on a particular target customer, or building a better service that services a need ignored by larger competitors. They are the ones who make better choices and use the tools they have more cleverly. Auction Technology Group is a good example. Rather than pushing more spend into the traditional auction world, where it had its origins, it backed a simple but powerful insight: that the future of auctions was online and data-led. It built the marketplaces and the technology to match, turned a smart idea into a category-defining platform, and in 2021, we took it public on the London Stock Exchange, realising our remaining shareholding in 2024, generating a 4.4x return.
3. Atē (Folly): Don’t be tempted by the easy route
The Lotus-Eaters, Circe, Calypso and the Sirens all try to pull Odysseus off course, and the danger is not always obvious. The Sirens sing the sweetest song of all. In business, the Sirens are the easy answers, and success often depends on saying no more than yes, and on interrogating what looks attractive rather than taking it at face value. One of our investments, Avantia, does this very deliberately through OKRs, the objectives-and-key-results framework popularised by Google. It sets three a quarter, and leaders from across the business have to debate and agree on the top priorities that make the cut. Its CTO, Dan Huddart, has said that implementing OKRs forces you to prioritise, which requires commitment but can be hugely valuable. That discipline keeps a whole organisation pulling in one direction, rather than chasing every passing opportunity. Knowing what to say no to is as valuable as knowing what to say yes to. Another area where this is common is M&A; deciding which acquisitions not to do is often just as important as the ones you do acquire. Duncan Painter, the Founder of ClarityBlue who went on to pursue c.30 acquisitions at Ascential plc before joining ATG, put this succinctly: “It’s not something we would want to do too often, but we have pulled out of a couple of deals where we’d spent six to nine months on them, on the last night. We don’t see that as a failure. We see that as making the right choices.”
4. Homophrosunē (Like-mindedness): Build the team that stays the course
Odysseus gets home in part because the people who matter stay loyal: Penelope, Telemachus, even his old dog Argos. Long-term success depends on that kind of trust, because culture is what drives commitment. But the Odyssey tells a subtler story about teams too. Most of Odysseus's crew never makes it home. Some are reckless and do not listen. Others are lost precisely because he does not trust them: they open the bag of winds because they have no idea what is inside, and he keeps the danger of Scylla to himself. Trust, in other words, runs both ways, and a more open or trusting Odysseus might well have reached Ithaca sooner. The best businesses understand this. At MiQ, they described this two-way communication as radical transparency, creating an open and inclusive culture became a genuine driver of growth. Mark Eastham, CEO of Avantia, puts it well when he says a good leader is one who asks the right questions rather than always having the right answers. Teams that trust each other and leaders who are open with them tend to go further and faster.
5. Moira (Fate): Control what you can
Storms, gods and sheer luck shape Odysseus's voyage. Poseidon sends the waves, and no amount of seamanship stops them. Leaders face the same truth. You cannot control interest rates, geopolitics or regulation, but you can control your culture, your strategy, your talent and your execution. Tusker is a clear illustration. It couldn’t control changes to BIK tax rates, interest rates, used-car residual values or a pandemic-hit car market. What it could control was its response: the decisive pivot to electric vehicles, the strengthening of its leadership team and the rebuilding of its technology. It was those controllable choices, not the weather, that carried it through to a sale to Lloyds Banking Group. When the storm comes, and it always does, the businesses that endure are the ones that pour their energy into what they can change.
Insights
16/07/2026
5 case studies in resilience
We're delighted to share that CSL, the leading global provider of Critical Connectivity®, has acquired IoTM Solutions, creating a global platform for resilient, multi-carrier IoT connectivity management and eSIM orchestration.
Founded in 2015, IoTM Solutions has developed a cloud-native platform that brings fragmented carrier systems, connectivity management platforms and eSIM workflows into a single managed service. The platform already manages more than 30 million SIMs, supports over 20 native CMP, API and carrier platform integrations, and provides access to more than 100 mobile operators.
As IoT deployments scale globally, enterprises and operators are often forced to manage SIMs, eSIM profiles and carrier integrations across multiple separate systems, adding operational complexity and slowing carrier onboarding. The acquisition strengthens CSL's ability to help customers build resilient global IoT estates and prepares them for the transition to SGP.32, the GSMA's next-generation eSIM standard for IoT, one of the most significant changes in how connected devices are provisioned and managed.
The IoTM team will join CSL, and the acquisition marks a further step in CSL's buy-and-build strategy, which ECI has supported since first investing in 2020, extending the company's capabilities beyond connectivity into a single resilient operating model for managing SIMs, eSIMs, carriers and platforms across the device lifecycle.
News
14/07/2026
CSL Group acquires IoTM Solutions
Chris Ginnelly is Managing Partner of GTM Performance, and an independent growth advisor on ECI Partners’ Growth Specialist Panel. He led a session at a recent ECI Unlocked CRO dinner on one of the most debated topics of the evening: how to pursue and win larger enterprise deals. Here, he distils his key takeaways.
The commercial case
While CROs might not always agree on the right approach, the reason for targeting larger, enterprise-level deals is clear. Bigger deals tend to outperform over time. They typically carry better unit economics, lower churn, and the kind of reference brand weight that opens doors to the next deal.
But the more you concentrate on larger clients, often, the bumpier the ride. Forecast volatility increases, and the gap between your base and optimistic pipeline widens significantly. It creates significant internal stress – both for the CRO having more complicated Board discussions – but also to sales teams who become much more dependent on each individual deal converting.
So, there are pros and cons, but how can you make “whale hunting” work?
Theme 1: Engineer predictability, don’t wait for it
Enterprise sales tend to resist the standard funnel and processes that work in high volume sales. Timelines tend to be longer, stakeholders can change during the process, and procurement are much more likely to be involved, often at an unknown juncture, with different needs to the department who you were selling into.
Rather than focussing on the unpredictability, it’s better to reframe it as more of a choreographed dance: the sequencing of stakeholders, the framing of value, the management of internal champions, and the sales team collectively agreeing the characteristics of a winnable deal.
Murderboarding is one of the most effective tools for this. Rather than committing resources based on optimism, the revenue team stress-tests each deal aggressively before progressing it: Where is the real decision-making power? What assumptions have we (not) verified? Where does the buying logic fall apart?
When these structures are in place, it becomes easier to engineer predictability and to focus resources on the clients that are likely to convert rather than chasing the mega deals that may never land.
Theme 2: Reduce reliance on an individual belief
The second theme was more sensitive – when selling into an enterprise, forecasts are often based on a senior salesperson’s instinct on a key account. This ends up being quite high risk (tied to one person’s view) and adds volatility to forecasting.
The solution is to take the assessment out of the individual’s hands and put it into a shared process. Structured qualification frameworks help salespeople to document, throughout the process, what they really know, and then every deal is assessed against the same criteria. The difference between belief in a deal, and the evidence, can then be highlighted and discussed at pipeline reviews. To make this work there needs to be the establishment of a cultural norm that scrutiny of a deal is not a vote of no confidence in the person running it.
Stage progression needs to tie to buyer actions, not seller activity. A deal should only advance when the buyer has done something to progress it, not when the seller has. A meeting attended is not progress. A customer taking an action to move through their own buying process is. The team should be clear on the evidence of what is required to move a deal forward at an enterprise level and that should tie directly to propensity to convert, giving CROs more confidence in the numbers they’re putting forward.
Theme 3: The skills that win volume deals aren’t always the skills that win enterprise ones
CROs shifting up in customer size might presume that their best transactional salespeople will be able to easily transition into enterprise roles. They may, but closing volume deals and navigating a nine-month multi-stakeholder process are genuinely different skills. Speed and instinct are highly valuable in one; the latter requires patience, political intelligence, and the ability to sustain a champion in your service or product over the long term. Mismatched hires or promotions can slow down success, which is especially damaging given the lead times you’re looking at when shifting up in customer size.
Compensation structures also need to reflect the reality of longer cycles and higher individual deal dependency. Enterprise sales roles typically warrant a higher base-to-variable ratio. Asking someone to carry the same OTE structure across a nine-month deal cycle as they did in a high-velocity transactional role is a retention risk as much as a motivation one.
Key lessons
Pursuing enterprise deals can be the right strategic direction for many growth businesses, but it requires a deliberate investment in the right skillsets and qualification discipline. Enterprise selling will never be predictable in the way that high-volume selling can be, but the CROs responsible for doing it successfully ensure they build the systems that work with that uncertainty rather than attempting to eliminate it.
Insights
13/07/2026
Chris Ginnelly
Read Time: Min
Hunting for Whales: How to pursue an Enterprise sales strategy
“Guilty until proven human.” That was the title of a session at this year’s e-Assessment Association conference in London, and it captured the anxiety being felt in the testing and exam industry. AI is not only being built into authoring, marking and proctoring, the same tech is now in every candidate’s pocket, threatening exam integrity. A week later I was sitting on a panel at EdTechX, where investors were circling the same problem from the other side: with AI changing everything, which of these businesses is backable?


Following our recent investment in Paragin Group, the Benelux market leader in high-stakes exams and assessment software, my two conferences in a fortnight among their peers, buyers and regulators sharpened my conviction about where the value in the market will sit.
1. Innovation needs depth
At the conferences, every vendor is demoing the same features: AI that drafts questions, AI that grades them, and AI that flags suspicious behaviour. Most of it is a thin layer over the same large language models that anyone can license. If your product is just veneer on a model your competitor can call tomorrow, that’s not sustainable differentiation.
The businesses that stood out did the opposite to this. One UK-based provider, Risr, had trained its AI on deep, privileged medical training content in partnership with RCGP. Together, they developed an AI patient with an optional AI coach to help trainee GPs through simulated patient consultations to prepare for their final practical exams, something a general-purpose model cannot replicate without the underlying case bank. On my panel, this was the overarching theme - AI is an advantage where it sits on vertical depth, e.g. proprietary content or genuine domain expertise, where you know your customers’ workflows better than your competition. That last 10% of depth in customer knowledge is what impressed us most about the Paragin team. It leads to genuine innovation that can’t just be reskinned. Paragin has built out the most complete solution set on the market; AI can help us deliver on our roadmap more quickly, but it is human expertise that gives the edge on its direction.
2. Integrity has to be the sell
Strip away the technology, and what an awarding body actually sells is confidence that a grade means what it says. England’s exams regulator, Ofqual, was unambiguous at the conference: its priority is trust in qualifications, technology comes second, and there are no guinea pigs when 800,000 students sit a GCSE on the same morning.
That is why the market will be conservative on AI adoption, and why owning the narrative on security and fairness is more important than features. This is also why outsiders underestimate the ease of disruption. You are selling to cautious buyers to whom brand trust is everything; it’s much more than just the hassle of changing systems. It’s much easier for an AI-native challenger to copy a feature than it is to displace loyalty, and that caution by buyers protects market incumbents who have an earned reputation.
3. Security and fairness are designed in
High-stakes testing is, at its core, a business built on trust with people’s most sensitive data. A set of results can decide whether someone qualifies as a doctor, an accountant or an engineer, so security, data protection and fairness have to be designed into the technology from the outset. Regulation is now formalising this, and under the EU AI Act, AI used to evaluate learning or to monitor candidates during a test is explicitly classed as high-risk, which carries real obligations around documentation, human oversight and demonstrable fairness. The recent move of that deadline from August 2026 to 2 December 2027 under the Digital Omnibus package changes the timing, not the direction of travel, and similar expectations are forming well beyond the EU’s borders.
For an investor, this is where track record and scale count. Building security and fairness into an assessment platform and being able to prove it is the work of years. Paragin has spent over twenty years wrestling with exactly these questions while continuing to innovate, and it has the scale to treat compliance and security as core to the product rather than a tax on growth. That hard-won experience, plus the resource capability to meet increased regulations, is difficult for a challenger to replicate.
For Paragin, this creates M&A and growth opportunities - as the bar on security and compliance keeps rising, many capable but sub-scale assessment businesses will struggle to clear it alone, and a platform that already takes these things seriously becomes the natural home for them to join. We can be a trusted and mission-aligned custodian of acquired businesses, with the scale to invest in leading edge group roles, like our newly appointed Cyber Security Engineer.
The sharpest test I heard in two weeks was the one put to our panel: can a business explain why it will still need to exist once AI is everywhere? In e-assessment, the answer, in my view, is that the winners over the next three to five years will be the ones that treat integrity and compliance as the point of the exercise rather than the price of it, because that is exactly what AI cannot commoditise.

Insights
07/07/2026
Rory Nath
Read Time: Min
Looking to the future of e-assessment
Identity verification has been the core of cybersecurity with one assumed truth: verify identity at the point of entry, then trust the session. The new wave of AI has weakened this faith, operating at machine speed to mimic behaviour and bypass controls, meaning identity must be continuously monitored and re-verified. With multi-step AI-assisted attacks rising 180% year-on-year in 2025 according to the World Economic Forum, this is something we see leaders in the cyber space reacting to quickly.
1. Continuous verification in Zero Trust architectures
Rather than assuming trust persists after authentication, Zero Trust architecture rejects the traditional “castle-and-moat” model of securing the perimeter and trusting everything inside it. Instead, it divides an organisation’s IT infrastructure into smaller, independently protected segments, each with its own verification requirements. This means that even if an attacker compromises one set of credentials, they face new authentication barriers at every boundary. Strong identity verification at entry remains important, but the main change is how the blast radius of compromised credentials is significantly reduced.
Compromised credentials are one of the most common causes of a breach. IBM’s 2025 Cost of a Data Breach Report shows breaches linked to stolen credentials cost an average $4.81m and take over 290 days to detect and contain. They also stated that 93% of organisations experienced 2 or more identity-related breaches in the past year, highlighting the severity of the threat.
2. Widening attack surface
As organisations use more applications, operate increasingly in the cloud, and work remotely across multiple devices, the ways that their employees can be targeted are multiplying. AI is accelerating this by improving the quality of targeting through deepfakes and hyper-personalised phishing attacks, which make social engineering attacks more convincing than ever. Humans are a massive risk, which is why limiting devices and upskilling people through training and phishing simulations remains essential.
But alongside this, a second and distinct attack surface is emerging: the non-human one. AI agents can now autonomously identify what to access, determine the optimal moment to do so, and chain actions across systems without any human in the loop. This is very different from the risk profile of automation scripts in the past. As these agents act across customers' environments, cyber suppliers will increasingly be judged not just on whether an identity was verified at the start, but on whether loss of control was managed throughout: whether access was appropriately decayed over time, whether privileges were narrowed as risk increased, and whether the system could intervene mid-execution. Both perimeters are expanding simultaneously.
3. The next wave of identity shocks
Now, whether you believe that Mythos is as dangerous as Anthropic has outlined, or if it's just a clever marketing ploy, it is clear that as AI models get more sophisticated, so will the imminent danger to any cyber vulnerabilities. Bain characterises Mythos as a 'signal rather than the threat itself', which will expose under-investment in foundational cyber controls. A clear risk is how organisations govern the identity and access of their own AI agents. As businesses deploy copilots and autonomous agents across their operations, those agents need to be subject to the same identity verification and access controls as the people they work alongside. An agent that can access payroll data, financial records, or sensitive customer information when the human equivalent would be denied that access entirely — represents a significant governance gap. If not architected correctly, your own tooling can become a source of vulnerability.
This risk is compounded by an accelerating asymmetry in how attacks are developed and deployed. AI is enabling attackers to release malware at a scale and speed that was previously impossible, with little need for quality control. Cyber attackers have the privilege of pushing beta versions and seeing what works to iterate rapidly, while defenders need to rigorously test and ensure the solution can work across complex interconnected systems. AI widens this gap further, which is why any improvement in model capabilities further expands the exposure of vulnerabilities. There is an arms race underway, and those not investing in the foundational controls now risk being left behind.
Move beyond Mythos or any other next-gen model, and on the horizon is quantum computing. While it’s likely a decade away, companies are already adopting encryption algorithms that can withstand the onslaught of a quantum attack. In fact, Europe has already set a 2035 deadline for removing quantum-vulnerable cryptography, with some governments targeting 2030 for sensitive systems. While 2035 may feel like a long time away, there is growing concern around cyber attackers adopting a "harvest now, decrypt later" approach to collect encrypted data now, betting on future technology to decrypt and use it in attacks, meaning companies need to identify higher-risk encrypted data now and move to protect it ahead of time.
Insights
02/07/2026
AI has changed the attack surface. How are cyber companies protecting their customers?