The National Cyber Security Centre published its tenth Annual Review this morning, The State of the Cyber Nation, and I listened to the launch live. There were two speakers: Baroness Liz Lloyd, the Cyber Security Minister, and Dr Richard Horne, the NCSC’s chief executive. Between them they called on a supermarket fridge, the Leaning Tower of Pisa, a Gwyneth Paltrow film and the Victorian railways, and all four were in service of much the same point. The foundations matter, and too many organisations have chosen not to lay them.
That message isn’t new, and both speakers acknowledged as much. What struck me was how little either of them tried to dress it up.
A wake-up call, not a victory lap
Ten years is an anniversary, and anniversaries usually come with a certain amount of self-congratulation. Baroness Lloyd set the tone early by describing the review as a wake-up call rather than a victory lap, and Horne’s written foreword is just as frank. He says the UK’s cyber resilience “is not yet where it should be” and that the threat has grown faster than our defences.
That is worth bearing in mind when the headline numbers start doing the rounds. The NCSC’s incident management team supported 337 incidents in the year to the end of August, 80 of which were classed as nationally significant. The year before, that figure was 204. A drop of that size will tempt some people to conclude the problem is easing, but the NCSC itself warns that reporting doesn’t follow a tidy year-on-year trend, and these are incidents reported to the NCSC rather than every attack on a UK organisation. I wouldn’t want any board drawing comfort from that number.
Wilfully blind
Lloyd talked about organisations carrying years of technical debt and legacy systems, and mentioned the recent cyber attack on supermarket refrigeration systems, where known vulnerabilities were exploited. Horne came back to the same attack in his speech and was a good deal sharper about it, describing the approach that left those vulnerabilities open as “wilfully blind”. His point was that none of it happened by accident. The failure to invest in technology was a decision. So was buying services on price rather than on resilience or security, and so was not putting monitoring in place. He then widened the lens to national infrastructure, where pumping, electricity switching and much else is now automated, and where the same lack of investment in cyber security can be found.
From a business continuity point of view, every one of those choices is a risk decision, whether or not anyone wrote it down as one. The supplier chosen because it was cheapest, the monitoring that didn’t make it into the budget, the old system that still works so nobody replaces it. Each of those accepts a risk, and boards often don’t realise they have done so. I wrote about the supermarket attack in more detail here, because it touches almost everything a resilience programme is supposed to cover.
Can defence outrun attack?
The line from Lloyd that stayed with me was a question: can we use AI for cyber defence more quickly than our adversaries can exploit it? She pointed to Cyber Shield, a national-scale defensive capability, as part of the government’s answer, and was clear that we need to use AI better than the attackers do.
The review’s own assessment shows why that matters. The NCSC judges it highly likely that, by 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure.
Horne made a point about AI that I think every board should hear. AI hasn’t invented new ways to attack us. What it does is find the vulnerabilities that have been left alone for too long, faster and at greater scale than before. He also noted that its impact will be felt by everyone, whether or not an organisation has chosen to use AI itself. You can opt out of using it, but you can’t opt out of being on the receiving end.
So my answer to Lloyd’s question is a qualified yes, for organisations that have modernised and know what they are running. Those still relying on unpatched legacy kit with nobody watching aren’t really in the race.
The tower that was always leaning
Horne’s image for all of this was the Leaning Tower of Pisa. The problem was in the foundations from the start, and everyone has long known that it needed reinforcement and investment. Technology is the same. We already know what needs doing, which is rather the point.
The figures in the review back him up. For large organisations, 88% of incidents came through just four routes: exploiting public-facing applications, phishing, misuse of valid accounts and exploiting external remote services. None of those is exotic. Strong foundations were the thread running through his whole speech, and he put it plainly: resilience needs to be a fundamental requirement, not an afterthought. He also named China as a significant threat, which matches the review’s assessment that China is the state best placed to use AI against critical national infrastructure.
One of the NCSC’s “seven things we learned” from this year’s incidents is that preparation determines outcomes. Logging, monitoring, incident response planning and supply chain resilience decide how an incident turns out. That will be familiar to anyone in business continuity, and I’d add exercising to the list, because a plan nobody has tested is closer to a hope than a capability. The NCSC has also published new guidance on recovering from a highly disruptive cyber attack, aimed in part at business continuity professionals, which is worth reading alongside your own arrangements.
Help for small businesses, and its limits
The most practical announcement of the day came from Lloyd, aimed squarely at SMEs. The basics, she said, still matter enormously, and the government wants as many businesses as possible to hold Cyber Essentials. She cited the figure that certified organisations are 92% less likely to make a claim on their cyber insurance.
There are two routes to help. The new Cyber Essentials First Step Fund offers eligible micro, small and medium-sized businesses a 75% discount on a new certification, which brings the cost down to between £80 and £125 plus VAT. It is open to businesses that haven’t held Cyber Essentials in the past four years, runs on a first-come, first-served basis until March 2027 or until the £2.4 million runs out, and you can apply at firststep.iasme.co.uk. Separately, SMEs that supply organisations signed up to the Cyber Resilience Pledge can be referred by those customers for fully funded certification, with support from a cyber adviser.
If you run a small business and don’t yet have Cyber Essentials, I’d take up the offer now. At that price the cost is no longer a reasonable excuse.
I do have reservations, though. The government expects around 6,000 businesses to benefit, which is welcome but small against the number of SMEs in the UK. The free route also depends on who your customers are, so a small firm that doesn’t supply a pledge signatory gets the discount and nothing more. The pledge itself, which asks signatories to make cyber a board-level responsibility, sign up to the NCSC’s Early Warning service and take a risk-based approach to requiring Cyber Essentials from suppliers, now has more than 230 organisations behind it. That is up from around 60 when it launched in July, but it still doesn’t feel like a lot. Lloyd was right that this can’t be solved by government alone or by industry alone, and her line that we cannot have growth in every postcode without cyber resilience in every postcode deserves to be repeated well beyond Westminster.
The generation that got on the train
Horne opened his speech with Sliding Doors, the film in which catching or missing a single train sends a life down two very different paths. His point was that the decisions taken now will determine which version of the next decade we get. Later in the speech he came back to trains. Our forefathers built the railways that the country still runs on, and it falls to us to build cyber resilience in the same way, so that we can be the generation that got on the train and can point to the actions we took.
For boards, I think that comes down to three fairly uncomfortable questions. What are we still running that we know is out of date, and who decided that was acceptable? Which services did we buy on price, and what resilience or security did we give up to get that price? And if our critical systems were unavailable tomorrow, do we know, from having practised it, how we would keep going and how we would recover?
If the answers aren’t clear, that is the place to start. Most of the work involves deciding that the foundations are worth paying for, and then paying for them.
