Strategy First, Technology Second: Solve for Outcomes, Not Infrastructure 

Rob Deakin, Capco, in conversation  

Lindley Gooden: Let’s start with data and AI. What comes first for utilities trying to get prepared – the data foundations, AI, or something else? 

Rob Deakin: The obvious answer is that you can’t have good models, you can’t have useful AI, without good data. But the key point is where you actually start. Many people say, “Right, we need to put all the data together, stick it in a data lake, maybe cleanse it, become a data-literate organisation with a good culture” – and spend three years doing it. 

Our view is a little different. We need to start with the business strategy, and the KPIs we’re trying to move in a positive direction. From there, you can curate the data you need and train the models to create genuine value. That’s still done badly across the industry, and it’s critical to start with the end in mind. 

Lindley Gooden: And the ripple effects of not doing that well almost inevitably lead to failure. If you don’t keep the whole environment and purpose in mind throughout, what happens? 

Rob Deakin: Firstly, the credibility of you as an executive, or of your function, erodes. It becomes harder to get funding. And it stifles momentum within the organisation. We see plenty of examples of pilots that fail to scale, because people haven’t thought through the operating model adequately, or evolved the control framework alongside the pilot. That’s critical to get right. 

Lindley Gooden: There are always many ways to invest, and demands on the budget. Cyber might feel like it runs in parallel – but AI is also a very effective way to attack organisations. How well are utilities keeping sight of cyber threats, which change constantly, and what do they need to do to be ready? 

Rob Deakin: I think the awareness is there – you can see from today’s conference that everyone’s talking about it. But there’s a gap between being aware and being operationally prepared. In the past, you might have had minutes to respond to a threat; now it needs to be milliseconds. Human-in-the-loop at the initial point of attack simply isn’t going to work anymore. I think people understand that’s the direction of travel, but whether boards truly understand it yet is a moot point – there’s more to do there. 

The complexity of defense now spans the entire ecosystem – third-party platforms, your whole supply chain, shared data interfaces. That creates many attack points, and the entirety of it needs to be protected in harmony. 

Lindley Gooden: It’s interesting you use the phrase “human in the loop,” because when we talk about AI implementation generally, most of us still think that’s important. But in cyber’s case, a human can’t keep up with the decisions needed to deal with a threat that comes through quickly, possibly somewhere you weren’t expecting. 

Rob Deakin: The failure points are rarely where you expect them – rarely the obvious ones. It’s critical to be aware of that, and, as you say, to have the entire ecosystem working in harmony, in milliseconds. 

There’s a real asymmetry in this whole equation. An attacker only needs to get through once. A defending organisation needs to repel every attempt, all the time. 

Lindley Gooden: Just on investment – a lot of the time you might lock money into long-term projects, but I assume there needs to be some flexibility too. At least a portion of investment needs to stay flexible? 

Rob Deakin: Yes – that’s one of the immediate priorities when we talk about senior accountability. Executives need to break the mentality that there’s only a long-term investment cycle. Funding for near-term threats has to be available; I don’t see that as optional. 

Lindley Gooden: Before AI became the term we use every day, it was cloud, and a lot of investment went into that. How do we avoid locking ourselves into long-term commitments the way we did with cloud, and stay flexible enough to keep several plates spinning at once? 

Rob Deakin: Most organisations now have a cloud strategy, and most are fairly well advanced in cloud migration. But what many discovered is that they expected migrating to the cloud would save a lot of money – and actually, the reverse has often been true. A lot of people moved to the cloud without re-architecting for how cloud billing mechanisms actually work. They assumed the platform work would just happen for them. 

We’ve seen a lot of “lift and shift” of applications onto the cloud, where those applications weren’t architected to work well there, and the commercial ramifications weren’t considered. Architectural decisions upfront are very important – you need to get that right, and the organisation needs to evolve a more sophisticated operating model to manage cloud costs. 

Lindley Gooden: In terms of operating model – and mindset – how does a large organisation shift emphasis to respond not just to cyber threats, but to how it operates more broadly? Utilities are thinking about things like balancing supply at a local level, for instance. 

Rob Deakin: That thinking has to filter through the technology stack too – you need to be able to respond, and to innovate, to do things you haven’t done before. You can see very quickly how different technologies leapfrog one another. There was huge excitement when ChatGPT came out; now the conversation online is predominantly about Claude and Anthropic. Organisations need to be thoughtful about not getting locked into one particular solution when the pace of change is this great. Many are trying to ensure their ecosystem can benefit from best-of-class tools as they emerge, and that’s only going to keep mattering. 

Lindley Gooden: When you’re working with clients, what advice do you give them on getting their stack ready – so they genuinely have the capability to change direction when they need to, whether that’s cyber or something more positively operational? How do you build in that flexibility? 

Rob Deakin: From a technology standpoint, there are architectural decisions to get right. But there’s also a lot of naivety on the human side. When things move to the cloud, people talk about it as agnostic – that you’ll be able to move an application, or shift services from Azure to GCP or wherever. That rarely actually happens. So it’s important to get the decisions right upfront and not be simplistic about it, because organisational priorities move on, and it’s quite rare that people go back and re-architect. Getting things right the first time is key. 

Lindley Gooden: The final thing we haven’t touched on is the partner ecosystem – integrators, vendors, supply chain partners, anyone you need in place to deliver for your customers. How do you build those relationships, especially as they need to evolve over time? 

Rob Deakin: Good organisations are constantly scanning for emerging technologies and new functionality. Awareness is the first step, and that’s something we focus on within our own organisation – staying aware of emerging tech, and continuing to build ecosystems you can plug new things into rapidly. The pace of change keeps increasing, so you need an ecosystem that can incorporate new technologies as they become available. 

Lindley Gooden: And in utilities specifically, that has to be reliable – as close to 100% as possible, and fit for purpose immediately. 

Rob Deakin: It comes back to the original point – you need to be very clear about your business strategy and your key KPIs. If one of your KPIs is 100% uptime, that should inform your technology decisions, and calibrate your appetite for risk: whether you adopt new technologies early, or wait for a level of maturity and proof. Reliability and security both flow from that. 

Lindley Gooden: A final point on security – energy security is high on the agenda again right now, and there’s a broader anxiety around it: people worried about local supply, and about threats from outside. As a word of reassurance, what would you say to partners about how to think about this – staying reliable, while still innovating for today and tomorrow, not yesterday? 

Rob Deakin: Awareness is the first step – to repel a threat, you first need to recognise its scale, and I think there’s been a real point of inflection there. Investment is undoubtedly increasing. Look at the UK – cyber investment is right up there, arguably the biggest growth area, alongside data and insurance. So there’s real awareness now. A few years ago, the technology organisation was worried about cyber and wasn’t getting the funding. Now there’s cause for hope – the awareness is there, and alongside it, a significant increase in funding to address it. 

Lindley Gooden: Rob, it’s been lovely – we’ve covered a lot of ground. Thank you very much for joining us. 

Rob Deakin: It’s been a pleasure, thank you very much. 

Lindley Gooden: That’s it from Future of Utilities: Insights. Take care, and see you again soon.