Summary
- The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, up from 89 the prior year — roughly four per week.
- The 2024 Synnovis ransomware attack disrupted NHS pathology services across south-east London, delaying more than 11,000 outpatient appointments and elective procedures.
- The dismantling of DSIT and Local Government Reorganisation are creating transition gaps where accountability blurs and attack surfaces expand.
- Incoming legislation — the Cyber Security and Resilience Bill — will extend incident reporting obligations and bring more critical suppliers into scope.
- Boards are being asked not just whether security tools exist, but whether they can demonstrate resilience, accountability, and service continuity under active pressure.
For most of the past decade, cyber security in UK public services sat comfortably inside technical teams. Leadership set the budget and largely left the detail to specialists. That arrangement is no longer adequate. Three forces are converging simultaneously — policy expectations are rising, organisations are undergoing significant structural change, and technology is expanding the attack surface faster than governance can keep pace. The combined effect is that cyber resilience has become a boardroom responsibility in substance, not just in principle.
The policy signal is unambiguous
The National Cyber Security Centre’s Cyber Governance Code of Practice frames cyber risk as a material organisational risk that must be governed accordingly. The Cyber Resilience Pledge asks organisations to make cyber security a board-level responsibility, register for NCSC Early Warning, and take a risk-based approach to Cyber Essentials across their supply chains. The forthcoming Cyber Security and Resilience Bill will go further, strengthening incident reporting requirements and expanding the scope of critical suppliers subject to oversight.
The data behind this direction is sobering. The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, compared with 89 the previous year. The UK is now averaging four nationally significant attacks every week. These are not theoretical exposures. The 2024 ransomware attack on Synnovis — a pathology services provider to parts of the NHS — disrupted the processing of blood, urine and specimen tests across south-east London and contributed to delays affecting more than 11,000 outpatient and elective procedure appointments. Abstract cyber risk, in other words, translates directly into harm to patients and erosion of public trust.
Structural change creates hidden exposure
Organisational transitions are a distinct and underappreciated source of cyber risk. Local Government Reorganisation is redrawing structures and responsibilities across England. Rail renationalisation is shifting ownership of critical data and systems. At central government level, the scrapping of DSIT — previously the hub of government digital, technology and cyber policy — is redistributing functions across Whitehall, including digital transformation, public sector AI adoption and information resilience.
Every one of these transitions requires systems to be integrated, identity and access privileges to be reassessed, data to move between agencies and suppliers, and contracts to be renegotiated. During periods of change, attack surfaces expand and accountability can become genuinely unclear. Cyber resilience must therefore be designed into public sector reform programs from the outset, rather than retrofitted once restructures are complete.
Technology change outpaces governance
Public sector work now runs across hybrid environments, cloud platforms, shared services and complex supplier ecosystems. The security models built for fixed offices and predictable networks are not suited to this landscape. AI adoption is accelerating the problem. Productivity and service delivery benefits are real, but without governance, organisations can quickly lose track of which tools are in use, what data those tools can access, and whether sensitive information is being inadvertently exposed. Shadow AI is a present governance challenge, not a future one.
Continuous assurance is the appropriate response. Access decisions should be based on verified identity, device posture, context and risk — not on the assumption that a user is trusted because they are on a familiar network. Data should be segmented so that a compromise in one area does not propagate across the organisation. AI adoption should be governed before it scales, so innovation does not create unmanaged routes to sensitive information.
What boards actually need to do
Making cyber resilience a board-level priority does not require every director to develop technical expertise. It requires senior leaders to establish the right governance, demand meaningful evidence, and maintain clear accountability. That starts with treating cyber resilience as a standing agenda item linked directly to service continuity, citizen trust, regulatory exposure and reform delivery — not as a periodic update from the CISO.
Boards also need a clear picture of which critical services depend on which systems, suppliers and datasets, and where single points of failure exist. Supply chain assurance must be embedded into procurement and contract management, not bolted on after the fact. Cyber Essentials, supplier checks, contractual obligations and incident reporting expectations all belong in that conversation from the start. Public services are delivered through ecosystems, and resilience cannot stop at the boundary of a single department, council, agency or trust.
Why it matters
For CISOs in public sector organisations, the window for treating cyber resilience as primarily a technical matter has closed. Policy obligations are hardening into legislation, organisational restructures are creating real and immediate gaps in access governance and supply chain accountability, and AI adoption is outpacing the controls being placed around it. The risk is not just a cyber incident — it is demonstrated failure to protect essential public services, with direct consequences for citizen safety, regulatory standing and leadership credibility. CISOs need to convert this environment into a governance conversation at senior leadership level before the next significant incident forces the point.
What to do now
- Treat cyber resilience as a standing board agenda item, explicitly linked to service continuity, citizen trust, regulatory exposure and active reform programs.
- Map which critical services depend on which systems, suppliers and datasets, and identify single points of failure before restructures create new gaps.
- Embed Cyber Essentials, supplier assurance checks, contractual cyber obligations and incident reporting expectations into procurement and contract management processes.
- Register for NCSC Early Warning and assess alignment with the Cyber Resilience Pledge and Cyber Governance Code of Practice.
- Move away from network-location-based trust toward continuous verification based on identity, device posture and context.
- Establish governance over AI tool adoption before it scales, including visibility of which tools are in use and what data they can access.
