From Command to Code: Major General Jonathan Shaw on Leading in a Digital Era

Major General Jonathan Shaw is a distinguished former British Army officer and a globally respected cybersecurity speaker, known for his expertise in strategic defence and national security. Having served as the UK’s first Head of Defence Cyber Security at the Ministry of Defence, he played a pivotal role in shaping the nation’s cyber defence policy and response capabilities.

In this exclusive interview, he discusses the evolving nature of leadership in the digital era, the growing threat of ransomware, and how organisations must adapt to new styles of cyberattack. Drawing from his time at the Ministry of Defence, he also shares how individuals can better protect their digital lives—and why the rise of AI and global cyber dominance presents deep cultural and strategic implications for the West.

 

Q: In your view, what defines effective leadership within the ever-evolving cybersecurity landscape?

Jonathan: “Well, that’s the key point. Cyber is fundamentally disruptive. It concerns information, and therefore it disrupts the entire hierarchy of information flows and knowledge. Organisations tend to be structured so that those at the top receive information first and understand it best. Actually, in the cyber world, that’s no longer true.

“People of my age—people I encountered at senior levels—were often ‘cyber tourists’; they didn’t have a real grasp of the subject. So leadership has to change. You can no longer wait for the people at the top to figure out what’s going on and issue orders. You’ve got to empower people, train people, and trust them. The people on the coalface—those your age, not mine—are much better at this than I am.

“What’s needed is a shift away from a top-down command-and-control system to one that empowers people on the ground. That way, you get individuals who actually understand the issues and can respond more quickly. Hierarchical systems today are simply too slow. In the military, we call it mission command rather than directive command—for reasons of speed, understanding, and comfort with the technology.”

 

Q: Reflecting on your time leading the Defence Cyber Security Programme at the Ministry of Defence—what stands out as your most meaningful contribution?

Jonathan: “I think it was the personal journey—from someone who initially knew nothing about cyber to someone who could speak quite knowledgeably about the conceptual aspects.

“Cyber clearly has a deeply technical dimension, but what I quickly realised is that the real significance lies in its implications—how the technology affects all our lives. My greatest achievement was developing the ability to talk about a digital subject in analogue terms, in ways that made it meaningful to those who didn’t fully understand it.”

 

Q: With ransomware attacks growing in frequency and impact, what key actions should organisations prioritise when facing a financial extortion attempt by hackers?

Jonathan: “I was recently watching Lindy Cameron, the CEO of the National Cyber Security Centre, give a talk—which I’d recommend everyone watch. She made it clear that ransomware presents the most immediate danger to UK businesses and organisations. It’s absolutely the top threat we’re facing.

“What should you do? I wouldn’t second-guess the National Cyber Security Centre. They’ve laid out full guidance on their website. But as a summary:

“Always have a clean backup—on a separate contingency server, not linked to your main system.

• Use layered defences.
• Conduct regular backups.
• Prevent the malware from being delivered or spreading.

“These are just highlights. But the main advice they give is: don’t pay them. You’ve got no guarantee you’ll get your money or your data back. Even if they do return the information, they might keep parts of it and blackmail you again later. Paying is a futile gesture.

“So—back up your systems and follow NCSC guidance. Take ransomware seriously. It’s the biggest threat right now.”

 

Q: Looking ahead, what emerging attack vectors or strategic shifts do you foresee shaping the next wave of cyber threats?

Jonathan: “Cyberspace is inherently insecure. So much so, in fact, that the Russians hacked into the NSA’s database and found all the backdoors that US authorities had insisted tech companies build into their systems. Now, the Russians have a list of those vulnerabilities—and they’ve already exploited them once with SolarWinds. They could easily do so again.

“We should expect more of that. Another concern is the blind faith in blockchain technology. Many treat it as some kind of panacea—as if it’s inherently secure. It’s not. It has backdoors, it’s been hacked, and there are zero-day faults. The idea that blockchain suddenly makes cyberspace secure is complete nonsense. So keep an eye on that.

“Looking at the longer term, this goes beyond cybercrime. We’re entering a period of strategic cultural change. We’ve been living—without really noticing it—under what some call ‘United States digital colonialism.’ The US has developed the technology, and its values are embedded in the systems. That suited us in Britain, because we share those values.

“But now, as the Pentagon’s Head of Cyber Security said recently on retirement: “We’ve already lost the AI battle. China is going to win that.” What we’re seeing now is the beginning of Chinese digital colonialism. That will fundamentally shift the assumptions on which software is built—and those cultural features will begin to dominate us as we move further into the AI era. I find that culturally very unsettling.”

 

Q: From a personal standpoint, how do you approach protecting your digital footprint and sensitive data online?

Jonathan: “I won’t go into detail—minimising exposure is part of the point—but I’ll offer this thought: cybersecurity isn’t fundamentally different from how you protect your home.

“Start by looking at your assets and prioritising them. What’s essential? What absolutely must be protected? Frankly, I’d say—don’t put those things online. It’s the digital equivalent of locking your inherited jewellery in the bank. Don’t take on challenges you can’t win. If someone really wants to get to it, they’ll try very hard.

“Prioritise. Your garden furniture? Leave it outside. It’s a hassle to move daily. But valuables? Lock them away. The same applies digitally—build layers of protection. But it starts with the awareness that there is no such thing as perfect security. Only put things online if you have to, and if you do, use tools like Signal, Telegram, and multi-factor authentication. I know it’s a bit of a hassle—but it matters.”

This interview with Jonathan Shaw was conducted by Mark Matthews.

To learn more, visit https://cyber-security-speakers.com/topics/cyber-security-speakers