In the space of four months the government has published three things that, read side by side, tell rather different stories about the same risk. In July came the National Risk Register 2026. On 22 October the Cabinet Office launched Be Ready, asking every household to keep three days of supplies at home. And yesterday the NCSC published its Annual Review 2026, with Richard Horne warning of “a real prospect of an unprecedented rise in the number of cyber incidents” in the coming months.
Put them on the desk together and the obvious question is whether anyone in government is joining the dots. Having spent a good deal of time with all three, I think the answer is less damning than it first looks, though it raises some awkward questions about risk registers in general, including the ones most organisations keep.
What the register actually says about the grid
Turn to the electricity scenario in the NRR and the language is stark. The reasonable worst case is a malicious cyber attack on a critical electricity system leading to a National Power Outage. Everyone without a back-up generator loses mains power “instantaneously and without warning”. Within a few hours small pockets of consumers start to come back on an intermittent supply, and within a few days enough demand is reconnected to create what the register calls a “skeletal network”. Full restoration “could take at least 7 days” and, depending on the cause of failure and the damage done, “restoration of critical services may take several months”.
The knock-on effects are set out too. Mobile and internet telecoms, water, sewage, fuel and gas would all be hit, with disruption running on into health, government services, food and transport, and the register is explicit that there would be loss of life. There is also one line that every business continuity manager should read twice: “It is not possible for any customer’s electricity supply to be prioritised during a National Power Outage.” Whoever you are, you will not be at the front of the queue.
Now look at the score. Cyber attacks on infrastructure are grouped together and given an average impact of 3, which the register labels “moderate”, and an average likelihood of 4, meaning a 5 to 25 per cent chance over the two-year window used for malicious risks. That is exactly where the group sat in the 2025 edition. And in the same section that describes the electricity scenario, the register states that “Great Britain has never experienced a nationwide loss of power and the likelihood is low.”
So we have a scenario involving loss of life and a week or more without mains power, described in its own text as low likelihood, placed inside a group scored as moderate impact with a likelihood of up to one in four. The likeliest explanation is that the register is being asked to do too many jobs at once.
How a national blackout becomes “moderate”
Much of this comes down to averaging. The cyber group takes in gas, electricity, fuel, transport, telecoms, data infrastructure, water and now police systems, among others. The register’s own footnote says the category ranges “from small scale cyber attacks with limited impact to more significant threats” to critical national infrastructure. Blend a national power outage with attacks of far more limited consequence and the average lands in the middle of the matrix. The dot is a fair average, and it tells you almost nothing about the worst thing in the group.
The likelihood bands do not help either. Band 4 runs from 5 to 25 per cent, so a risk could treble in likelihood without its position on the matrix moving at all. Anyone who has tried to explain a risk matrix to a board will recognise the problem.
The trouble with risk matrices, whatever their size
To be fair to the Cabinet Office, the NRR matrix is better built than most. Its likelihood columns rise by a factor of five each time (“the likelihood range in each column, moving from left to right, is 5 times greater than the previous column”), the impact scale is logarithmic, and the boxes on the matrix get bigger to show it. It also plots likelihood and impact without multiplying them together. The 5×5 grid found in most organisational risk registers does almost everything the NRR avoids.
The usual approach is to score likelihood from 1 to 5 and impact from 1 to 5, multiply the two, and colour the result red, amber or green. The numbers look like measurements, but they are really labels for categories. A 4 is not twice a 2, so multiplying them produces a figure that looks precise and means very little. On that arithmetic, a risk scored 5 for likelihood and 1 for impact comes out at 5, exactly the same as one scored 1 for likelihood and 5 for impact. One is a near-certain nuisance and the other is a rare event that could close the business, yet the matrix presents them to the board as equals. In practice the catastrophic, low-likelihood risk often ends up amber or even green, and that is precisely the kind of risk business continuity exists to deal with.
None of this is new. Tony Cox set out the problems in 2008 in What’s Wrong with Risk Matrices?, showing that matrices can give identical ratings to very different risks and can even rank a smaller risk above a larger one. Changing the size of the grid doesn’t help much either. A 3×3 leaves everything in a sea of amber, while a 7×7 asks people to make distinctions they have no evidence for, and the argument about the number soon takes over from the discussion about the risk.
The colours bring their own problems. Where the boundaries between green, amber and red fall is a judgement somebody made, often years ago and rarely revisited since. Once a risk turns green it tends to drop off the agenda, which is fine for the near-certain nuisance and a real worry for the scenario involving a week without power.
The NCSC and the NRR are answering different questions
Set all of that alongside yesterday’s review. The NCSC judges it “highly likely” that AI-powered malicious software will be used by financially motivated attackers against UK power stations, airports and hospitals by 2028 (Infosecurity Magazine has a good write-up). On the intelligence community’s probability yardstick, “highly likely” means roughly 80 to 90 per cent. The NRR looks two years ahead for malicious risks, so the time horizons are almost the same. On the face of it, one part of government is saying 80 to 90 per cent and another is saying 5 to 25.
In practice they are measuring different things. The NCSC is forecasting that an attack of a particular kind will happen. The NRR is scoring the reasonable worst case, a cyber attack that brings down the national grid. Ransomware that cripples a generating company’s back-office systems is a long way from a National Power Outage, and both statements can be true at the same time. The difficulty is that nobody has put them side by side and explained the difference, and the general public is never going to work it out from a 223-page PDF.
The NCSC’s own figures add to the sense of mixed messages. Its count of nationally significant incidents fell to 80 this year from 204 the year before. Horne’s message was about what is coming rather than what has been, and I would want to know whether the way incidents are categorised has changed before taking any comfort from the lower figure. But look at it from outside the profession: fewer serious attacks, louder warnings and a national risk score that hasn’t moved. It is hard to know what anyone is supposed to do with that.
Be Ready and the 72-hour question
The one thing the public has actually been asked to do is get ready, and that campaign was not a bolt from the blue. The government said in July that a national resilience awareness campaign would follow the register (Emergency Services Times reported it at the time), so in that sense the planning was joined up. The public reaction was rather livelier than intended. Within days Maplin was reporting torch sales up 284 per cent and radio sales up 92 per cent, and Iceland saw a 40 per cent jump in tinned food sales.
The part I find harder to reconcile is the duration. Be Ready asks households to cover 72 hours. The register’s own worst case for the grid assumes at least seven days to full restoration, and its fuel supply scenario talks about disruption lasting at least five to ten days. Three days is in line with much of Europe and a perfectly sensible starting point for a household, but a campaign built around three days, alongside a planning assumption of seven or more, needs some explanation. The NRR is, in its own words, “not targeted at the general public”, so people were handed the shopping list without the reasoning behind it. A government telling you to buy tins sounds like a government that knows something you don’t.
So is this a failure of joined-up thinking?
Mostly, I don’t think so. The register, the campaign and the NCSC review each make sense on their own terms. What they expose are limitations that every risk register shares. A register is a snapshot, scored months before it is published and revisited perhaps once a year, while the threat it describes moves week by week. It squeezes a complex scenario into a single pair of numbers. It averages, so the tail disappears. And its bands are wide enough that real change can go unrecorded.
Where the joining-up has been missing is in the explanation. Three publications in four months, and nothing that walks the reader from one to the next. For those of us who work with the NRR, the contradictions can be explained. For someone in a supermarket aisle wondering whether they need a second wind-up radio, they can’t.
What this means for your own risk register
The same flaws are very probably present in your own organisation’s register, and the NRR is a useful prompt to go and look. The obvious temptation is to lift the national scores straight across, but a national “moderate” says very little about the impact on a business with no generator, a cloud-hosted phone system and staff who drive to work. The value of the NRR lies in its scenario narratives, and the electricity scenario hands you a ready-made set of planning assumptions: no mains power for at least a week, telecoms, water and fuel all affected, and no priority for anyone.
Those durations are what your plans should be tested against. How long will your generator run on the fuel you hold, and can you get more if fuel distribution is disrupted as well? Can your people communicate if the mobile networks drop? Can you take payments, pay staff or keep chilled stock safe? An exercise built around the NRR scenario will throw these questions up very quickly, and it will tell you a great deal more than the colour of a box on a grid.
It is also worth asking whether a matrix is giving you the information you need at all. For many organisations it has become a habit, something the board expects to see each quarter, and it is fair to ask when it last helped anyone decide what to do. If the grid is the only place a risk is described, a short written scenario with durations and dependencies, like the ones in the NRR, may well tell you more. If you do keep the matrix, check what any grouping hides, stop treating a multiplied score as a ranking, and make sure anything with a top impact score is reviewed on that basis alone, whatever colour it has been given.
And there is no need to wait for the annual review cycle. When the external picture shifts as much as it has since July, that is the time to revisit your risk assessment and check whether your assumptions still hold.
If you would like help designing an exercise around the National Power Outage scenario, or a fresh look at how your register handles risks like this, get in touch.
