Joining the Dots

Will Lyne & Matt Horne: Cybercrime, national security, and the fight for resilience

Will Lyne & Matt Horne: Cybercrime, national security, and the fight for resilience

Thomas speaks with Will Lyne (former NCA) and Matt Horne (Clue/TechUK) about the future of cybercrime and national security. From ransomware to AI, they discuss the blurred lines between crime and state threats, and why collaboration and resilience are key to staying ahead.

Transcript

Thomas: Welcome back to Joining the Dots. In today’s episode, we’re diving into what it really means to be an intelligence-led organisation — not just in theory, but in day-to-day practice.

Alex: Thanks for having me, Thomas. It’s a conversation that a lot of organisations are starting to take seriously, but there’s still a big gap between ambition and execution.


What does “intelligence-led” actually mean?

Thomas: Let’s start there. When you go into an organisation for the first time, what’s the biggest indicator that they aren’t intelligence-led?

Alex: Usually it’s the surprise factor. If teams are constantly being blindsided by incidents, or reacting instead of anticipating, that tells me intelligence isn’t driving decisions — it’s just being collected and stored somewhere.

Thomas: And that’s more common than people realise.

Alex: Definitely. Most teams think “we have reports, therefore we’re intelligence-led.” But unless those insights are shaping your operations, influencing priorities, or changing behaviours, it’s just paperwork.


Breaking down the silos

Thomas: You mentioned that one of the biggest problems is siloed information. Can you give an example?

Alex: Sure. I once worked with an organisation where safeguarding, investigations and frontline operations all kept their own data sets. Each team was excellent individually, but none of them shared information consistently. When we finally aligned the systems and processes, patterns emerged that nobody could see before — serial offenders, hotspots, behavioural escalations. It changed everything.

Thomas: That must have been a big moment.

Alex: Huge. And it always comes down to the same principle: intelligence only works when it’s connected.


Lessons learned from the field

Thomas: What’s the biggest misunderstanding you see about intelligence work?

Alex: That it’s all about technology. Technology is essential — don’t get me wrong — but the real shift happens when organisations build habits around asking the right questions. “What should we be worried about next? What don’t we know yet? What action will this insight drive?”

Thomas: So it’s part mindset, part tooling.

Alex: Exactly. People, processes, and platforms — in that order.


Prediction vs. reaction

Thomas: You often talk about moving from “incident management” to “risk anticipation.” What does that actually look like?

Alex: It looks like mapping vulnerabilities before something goes wrong. Monitoring behaviours, spotting escalating patterns, and having pre-agreed responses. If you only ever act after harm occurs, the system isn’t intelligence-led — it’s incident-led.