The data question you can no longer avoid
Housing might not be formally classified as ‘critical national infrastructure’ but housing providers do provide services on which millions of people depend. They hold significant quantities of personal and financial information, support vulnerable residents, manage physical assets and increasingly rely on interconnected digital services and complex technology supply chains.
A serious cyber-attack therefore isn’t just an IT incident; if residents’ services, contact centres, repairs, payments, building-safety information or access to important data become unavailable, it can quickly develop into an organisation-wide resilience incident affecting the ability to provide services to residents.
Cyber health
But do organisations genuinely understand their data? As insurers become more sophisticated in measuring ‘cyber health’, knowing what critical information exists, where it is, who can access it and how it’s protected should become an important factor in understanding both the likelihood and potential consequences of a successful attack.
Most housing providers know that they hold sensitive information but far fewer can confidently demonstrate where all of it is, who owns it, how it’s classified, who can access it, which systems and suppliers process it and which information is genuinely critical to the organisation.
Housing providers have a particularly important responsibility because they can hold information relating to residents, employees, finances, properties, vulnerabilities, complaints, safeguarding and highly-sensitive details concerning people’s personal circumstances. Not all of this data creates the same level of risk, which means housing providers need to understand which information represents their crown jewels and apply appropriate protection around it.
Data governance
This starts with good data governance. A meaningful data asset register should identify important information, its owner, where it is, which business processes depend on it and who or what is permitted to access it. Classification and sensitivity labelling can then help the organisation apply proportionate controls, while retention policies and data-loss-prevention measures help to ensure information isn’t retained indefinitely or moved to places where it shouldn’t exist.
If I were assessing the cyber health of a housing provider, I would increasingly want it to answer a straightforward challenge: show me your critical data, where it is, who can access it and how you know it’s protected.
The rise of AI
The rapid adoption of AI makes this understanding of data much more important. There’s enormous excitement around AI, yet most of the AI-related security discussions continue to focus on how we secure AI technology itself, when for most organisations one of the more immediate risks is the information that AI is allowed to access.
An AI agent can potentially search, correlate, summarise and surface information at a speed and scale that a human simply cannot achieve. Excessive permissions, forgotten documents, poorly-classified information and weak data governance can consequently become AI security vulnerabilities. A document that has been sitting unnoticed in a database for six years may suddenly become relevant because an agent is capable of finding it, understanding it and combining its contents with information held elsewhere.
This changes the role of data security. Housing providers need visibility not only of where their information is, but also increasingly of how AI interacts with it, such as which agents exist, what identities and permissions they use, what information they can access, what prompts are being submitted, which corporate information is being referenced and what responses are being produced.
This is why I increasingly see data security as one of our principal defences in the age of AI. Identities, endpoints, infrastructure, models, LLMs and agents all need to be secured, but their security ultimately depends on the quality of the environment beneath them. If a housing provider doesn’t understand where its sensitive information is, who has access to it and how it should be protected, introducing super-capable AI can magnify existing weaknesses rather than resolve them.
The arrival of AI therefore doesn’t change the importance of good cyber fundamentals; it just makes getting those fundamentals right much more important.
What should you do?
The answer is not to respond to every new cyber threat by buying yet another security product. Housing providers should concentrate on doing the cyber basics exceptionally well and measuring whether those foundations remain healthy over time.
That means maintaining strong identity security and multi-factor authentication (MFA), managing vulnerabilities at pace, configuring endpoint protection effectively, maintaining resilient and tested backups, understanding suppliers, monitoring threats, rehearsing incident response and proving that services can be recovered. These controls should form part of a continuously-understood picture of cyber health rather than existing simply because a framework or annual audit requires them.
Data security now needs to become a central attribute of that cyber health. Housing providers must understand what information they hold, where their important data is, who owns it, which users, systems and agents can access it, how it is classified and labelled, where it moves and whether controls can prevent or detect inappropriate access. As AI becomes more embedded into organisational processes, knowing what data exists and how it can be used will become increasingly inseparable from cyber security itself.
For housing, the objectives should be straightforward: do the basics exceptionally well, understand cyber health continuously, know and protect the data that matters and be ready to demonstrate that resilience before the insurer, auditor, regulator or even attacker comes asking.
Richard Holland is the field CISO at Quorum Cyber.
