Penetration Testing Services Cloud Pentesting Penetration Network Pentesting Application Pentesting Web Application Pentesting Social Engineering October 18, 2024 On this page 2024 UK Cyber Security Guide Introduction In 2024, the UK’s cybersecurity landscape is marked by robust preparedness and proactive measures across businesses and organisations. The UK Cyber Security Breaches Survey 2024 reveals widespread adoption of essential “cyber hygiene” practices, including updated malware protection, password policies, cloud backups, restricted admin rights, and network firewalls. This aligns with the National Cyber Strategy, showcasing the UK’s dedication to securing its digital environment for commerce and communication. The threat landscape, however, remains unpredictable. The National Cyber Security Centre (NCSC) emphasises the significant risks to critical infrastructure from state-aligned groups and increased cyber aggression, often tied to geopolitical tensions and conflicts. The National Cyber Security Centre (NCSC) regards Russia, China, Iran, and North Korea as the state actors that present the most acute cyber threat to UK interests, attributing cyber attacks to a nation state as most challenging. Attackers and their tactics continue to evolve, but the most common type of cyber threat remains relatively unsophisticated. Phishing attacks are by far the most prevalent, affecting 84% of UK businesses and 83% of charities. Other significant tactics include impersonation in emails or online, and viruses or other malware. Despite the prevalence of these attacks, the UK’s cyber resilience is bolstered by the government’s guidance on cyber hygiene and the strategic deployment of defensive measures by organizations. AI also presents a new frontier of risk, especially concerning electoral integrity. The NCSC warns of sophisticated disinformation campaigns powered by AI that can erode public trust. Collaboration with allies and industry partners is crucial to counter these emerging threats. Lastly, organisations are increasingly turning to external experts and security services like threat intelligence, security audits, and managed security service providers (MSSPs) to enhance their defenses. This collaboration ensures that businesses can quickly adapt to new threats with the latest tools and expertise, reinforcing the UK’s resilient cybersecurity ecosystem. Please note that this guide is intended to give readers a snapshot into the state of cybersecurity in the UK providing information from recent industry and government surveys and reports conducted in 2023-2024. It is not intended to be an in-depth resource but rather an overview of the UK cyber security market. All sources are listed on the last page of this guide. The UK Cyber Security Sector Within the National Cyber Strategy 2022, cyber security is defined as: The protection of internet-connected systems, including hardware, software, and infrastructure, from unauthorized access, harm, or misuse, whether intentional or accidental. This analysis aims to identify UK businesses that offer products or services to safeguard these systems and their users. Active businesses within the UK that provide products or services that enable the protection of internet connected systems and their users are defined by the following attributes: Have a UK-registered business with annual reporting to Companies House. Demonstrate active commercial presence (e.g., website/social media). Provide cybersecurity products or services aligned with the specified taxonomy. Show identifiable UK revenue or employment in cybersecurity. Be currently active (not dissolved or in the process). Excludes charities, universities, networks, and individual contractors. How Cyber Security Providers are Defined The businesses included within this analysis are considered to provide one or more of the following products or services: Cyber professional services: Provide trusted contractors or consultants to advise on, or implement, products, solutions, or services for others. Endpoint and mobile security: Hardware or software that protects devices when accessing networks. Identification, authentication, and access controls: Products or services that control user access, for example with passwords, biometrics, or multi-factor authentication. Incident response and management: Helping other organisations react, respond, or recover from cyber attacks. Information risk assessment and management: Products or services that support other organisations to manage cyber risks, for example around security compliance or data leakage. Internet of Things (IoT Security): Products or services to embed or retrofit security for Internet of Things devices or networks. Network security: Hardware or software designed to protect the usability and integrity of a network. SCADA and Information Control Systems: Cyber security specifically for industrial control systems, critical national infrastructure, and operational technologies. Threat intelligence, monitoring, detection, and analysis: Monitoring or detection of varying forms of threats to networks and systems. Awareness, training, and education: Products or services in relation to cyber awareness, training, or education. Emerging Cyber Security Challenges The National Cyber Security Centre (NCSC) acts as a bridge between industry and government, providing a unified source of advice, guidance and support on cyber security, including the management of cyber security incidents. In their 2023 Annual Review, they stated, “We lie in a dangerous, volatile world. The events of the past few years have demonstrated the extent to which geopolitical crises and technological change impact us all, threatening not just our traditional security but our economic security.” The methods of attack are proliferating. The number of hostile state and non-state actors with access to such tools is growing. The ways in which these countries, organisations and individuals can do us harm – from bots undermining our democracy, to hacks disrupting our public services, to ransomware attacking our businesses – is expanding. The rapid rise of artificial intelligence is accelerating the pace of change, compounding the threats and lowering the barrier to entry. As a result, the cyber world is a more dangerous place than ever before, and cyber security is rising up our risk register. Most Acute Cyber Threats Ransomware: Ransomware remains one of the most acute cyber threats facing the UK, and all domestic organisations should take action to protect themselves from this pervasive threat. The now-normal approach of stealing and encrypting data continues to be the primary tactic cyber criminals use to maximise profits. However, data extortion attacks, in which data is stolen but not encrypted are a growing trend in the threat landscape. Between September 2022 and August 2023, the NCSC received 297 reports of ransomware activity (‘tips’), triaged into 28 NCSC-managed incidents, 18 of which were categorised as C3 and above. The top five sectors reporting into the NCSC were academia (50), manufacturing (28), IT (22), finance (19) and engineering (18). Although academia appears high in their statistics, they did not have any specific evidence of actual targeting in this sector. Cyber Proliferation: Commercial proliferation will transform the cyber threat landscape by lowering entry barriers for both state and non-state actors, granting them cost-effective capabilities and intelligence. This risks misuse without proper oversight or understanding of international norms. The NCSC supports the UK’s international response with like-minded countries to ensure advanced commercial cyber tools are developed, sold, and used legally, responsibly, and proportionately, aligning with the UK government’s aim to promote responsible cyberspace behavior. Cyber-enabled Fraud: Fraud continues to be one of the most significant threats facing UK businesses and citizens. In 2021 more than 80% of all reported UK fraud was cyber-enabled, but only 32% of UK citizens thought they were likely to become a victim. Over the past year, the UK government’s Cyber Aware campaign supported individuals and small businesses to significantly improve their personal cyber resilience with two simple steps: Use a password based on three random words. Secure accounts by enabling two-step verification (2SV) Critical National Infrastructure (CNI): 2023 has seen the addition of state‑aligned actors to the ongoing threat from state actors, as a new and emerging cyber threat to CNI. While the cyber activity of these groups often focuses on DDoS attacks, website defacements and/or the spread of misinformation, some have stated a desire to achieve a more disruptive and destructive impact against western CNI, including in the UK. The NCSC continues to prioritise the resilience of UK CNI. AI / Large Language Models (LLMs): Hostile states and cyber criminals will use AI to enhance their methods, likely amplifying existing cyber threats rather than creating new ones, but increasing the speed and scale of attacks. The NCSC and wider government are actively assessing and responding to AI-related risks. UK Industry Insights: Information Technology (IT) Challenges The IT sector faces increased risks from supply chain attacks, particularly as dependencies on third-party services grow. These attacks exploit vulnerabilities in software and service providers, making the entire IT ecosystem more vulnerable. 2024 Notable Breach Company: RayTech Solutions In March 2024, RayTech Solutions, a major UK IT service provider, experienced a breach due to a vulnerability in their cloud infrastructure. Hackers exploited a misconfiguration in their server permissions, which allowed unauthorized access to sensitive client data. Impact: The breach affected thousands of companies across different sectors that relied on RayTech’s services, leading to data leaks, service disruptions, and significant reputational damage for both RayTech and its clients (Source: IT Governance). Vulnerabilities The technology sector experienced a 40% year-on-year increase in breaches, reflecting its growing importance and exposure. The most prevalent vulnerability is cloud misconfigurations due to complexity of managing cloud environments and face pace environments resulting in security oversights. Security Tools AI-driven threat detection, Zero Trust Architecture, and automated incident response tools are increasingly used. Provider Needs IT firms seek providers offering advanced threat intelligence, supply chain risk management, and comprehensive incident response solutions. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Cloud Misconfigurations Remediation Tools: Cloud Security Posture Management (CSPM): IT firms are increasingly using CSPM tools like AWS Security Hub to continuously monitor cloud environments, detect misconfigurations, and ensure compliance with security best practices. These tools automate the identification and remediation of risks associated with cloud deployments. Infrastructure as Code (IaC) Security: Tools like HashiCorp’s Terraform and Checkov are used to embed security checks into the development pipeline, preventing misconfigurations from being deployed in the first place (IT Governance). UK Industry Insights: Healthcare (NHS and Private) Challenges Healthcare remains a prime target due to the sensitive nature of medical data. Ransomware attacks and phishing are prevalent, often crippling critical systems. 2024 Notable Breach Company: North London NHS Trust In February 2024, North London NHS Trust was targeted by a ransomware attack that exploited outdated software systems. The attackers encrypted patient records and demanded a ransom for their release. Impact: The breach caused significant disruption to patient care, as access to medical records was blocked for several days. The Trust had to revert to manual processes, and the breach exposed the personal data of thousands of patients (ConsultancyUK). Vulnerabilities The healthcare sector accounts for 20% of all data breaches, highlighting its susceptibility. The healthcare sector continues to rely on legacy systems, which are often not updated with the latest security patches. These outdated systems are particularly vulnerable to ransomware attacks, as seen in the North London NHS Trust breach. The sector’s reliance on older technology and the challenges of updating critical systems without disrupting services make this a persistent vulnerability (ConsultancyUK). Security Tools Healthcare organizations are increasingly adopting endpoint protection, secure communication tools, and ransomware protection. Provider Needs The NHS and private healthcare providers are looking for vendors with expertise in data protection, compliance with healthcare regulations, and resilience against ransomware. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Outdated Software and Systems Remediation Tools: Patch Management Solutions: Healthcare organizations are employing automated patch management tools like Microsoft SCCM and IBM BigFix to ensure that all systems are up-to-date with the latest security patches. These tools help in managing the complexities of updating legacy systems without disrupting patient care. Network Segmentation: By implementing network segmentation using tools like Cisco TrustSec, healthcare providers can isolate critical systems from vulnerable legacy systems, reducing the attack surface and containing potential breaches (ConsultancyUK) UK Industry Insights: Banking & Finance Challenges Financial institutions are under constant threat from sophisticated phishing schemes, credential theft, and insider threats. 2024 Notable Breach Company: Midlands Banking Group In January 2024, Midlands Banking Group was breached through a compromised third-party vendor that had access to the bank’s payment processing systems. The attackers used phishing emails to gain access to the vendor’s network and subsequently infiltrated the bank’s systems. Impact: The breach exposed the financial details of over two million customers, leading to fraudulent transactions and significant financial losses. The incident also resulted in regulatory scrutiny and fines for the bank (ConsultancyUK). Vulnerabilities The finance sector saw a spike in breaches, with 27% of all breaches in the last year occurring in this sector. Third-party risks are particularly prevalent in the banking and finance sector, where the reliance on vendors and external service providers introduces additional entry points for attackers. The breach at Midlands Banking Group highlighted how vulnerabilities within a third-party provider can cascade into more significant issues for financial institutions(ConsultancyUK). Security Tools Banks and financial institutions are investing heavily in multifactor authentication, AI-driven fraud detection, and advanced encryption. Provider Needs Financial institutions are focused on securing digital channels, ensuring compliance with regulatory requirements, and fortifying against insider threats. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Third-Party Risks Remediation Tools: Third-Party Risk Management (TPRM) Platforms: Financial institutions are increasingly using TPRM platforms, penetration testing, and automated vulnerability scanning to continuously assess the cybersecurity posture of their third-party vendors. These tools provide visibility into the security practices of vendors and alert banks to potential risks before they become critical. Zero Trust Architecture: Many banks are adopting a Zero Trust model, using tools like Zscaler and Okta, to ensure that all users, both within and outside the organization, are continuously authenticated and authorized before accessing critical resources (ConsultancyUK). UK Industry Insights: Professional Services Challenges Professional services, defined as consumer services, human resources, law practices, legal services, and staffing and recruitment, face growing threats from phishing and business email compromise (BEC) attacks, often leading to data theft and financial loss. 2024 Notable Breach Company: Harrow & Partners Law Firm In April 2024, Harrow & Partners, a prominent UK law firm, was breached through a phishing attack. A senior partner’s email was compromised, allowing attackers to access sensitive client communications and legal documents. Impact: The breach resulted in the exposure of confidential client information, damaging the firm’s reputation and leading to potential legal actions from affected clients (ConsultancyUK). Vulnerabilities The sector saw its breach rate grow from 3% to 12%, underscoring its increasing vulnerability. Phishing remains the most common attack vector in the professional services sector. Employees in these firms often handle sensitive client data, making them prime targets for phishing schemes that can lead to compromised accounts and data breaches, such as the incident at Harrow & Partners Law Firm (ConsultancyUK). Security Tools Firms are employing secure email gateways, data loss prevention (DLP) systems, and cloud security solutions. Provider Needs Legal and consulting firms are seeking cybersecurity providers that offer strong email security, data encryption, and compliance monitoring. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Phishing Attacks Remediation Tools: Email Security Gateways: Tools like Proofpoint and Mimecast are widely used to filter out phishing emails before they reach employees’ inboxes. These tools use advanced threat detection to identify and block malicious emails in real time. Security Awareness Training: Professional services firms are increasingly investing in employee training programs along with red teaming exercises, which simulate phishing attacks and educate staff on how to recognize and report phishing attempts (ConsultancyUK). UK Industry Insights: Retail & eCommerce Challenges Retailers are targeted through point-of-sale (POS) system vulnerabilities and supply chain attacks, leading to data breaches and service disruptions. Challenges Company: Fashion UK In March 2024, Fashion UK, a leading UK retailer, suffered a data breach due to a vulnerability in their online payment processing system. Hackers injected malicious code into the checkout page, capturing customers’ payment information. Impact: The breach affected over 500,000 customers, leading to widespread fraud and identity theft. The company faced backlash from consumers and had to invest heavily in improving its cybersecurity measures (ncsc.gov) (ConsultancyUK). Vulnerabilities The retail sector saw a rise in breaches, from 7% to 11%, indicating growing exposure. Retailers are frequently targeted through vulnerabilities in their POS systems. These systems are often connected to the broader network, and any security flaw can be exploited to capture payment data, as was the case in the breach at Fashion UK. Retailers’ need for seamless transactions sometimes leads to overlooking security patches or updates (ncsc.gov)(ConsultancyUK). Security Tools Retailers are increasingly using network segmentation, fraud detection systems, and secure payment processing technologies. Provider Needs Retailers look for cybersecurity solutions that protect customer data, ensure transaction security, and prevent supply chain disruptions. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Point-of-Sale (POS) System Exploits Remediation Tools: Secure Payment Processing Solutions: Retailers are deploying secure POS systems that comply with the Payment Card Industry Data Security Standard (PCI DSS). Solutions like Verifone and Square include encryption and tokenization to protect transaction data from being intercepted during the payment process. Network Monitoring and Intrusion Detection: Tools like Splunk and Darktrace are used to monitor network traffic and detect anomalies that could indicate an attack on POS systems, allowing for rapid response to potential breaches (ncsc.gov) (ConsultancyUK). UK Industry Insights: Agriculture Challenges The agriculture sector, often overlooked in cybersecurity, is increasingly targeted by ransomware attacks, threatening food supply chains Notable 2024 Breach Company: GreenFields AgriTech In February 2024, GreenFields AgriTech, a major agricultural supplier, was hit by a ransomware attack that targeted their operational technology (OT) systems. The attackers exploited outdated network security protocols to infiltrate the company’s systems. Impact: The breach disrupted supply chain operations, leading to delays in agricultural production and distribution. The company faced significant financial losses and had to pay a ransom to regain control of their systems (ConsultancyUK). Vulnerabilities The sector remains vulnerable due to outdated systems and limited cybersecurity awareness. Agricultural businesses often use outdated network security protocols, making them vulnerable to ransomware and other types of cyberattacks. The breach at GreenFields AgriTech was facilitated by exploiting these weak protocols, a common issue in the sector where cybersecurity is not always prioritized (ConsultancyUK). Security Tools Agricultural businesses are beginning to adopt basic endpoint protection, network security, and ransomware defenses Provider Needs The sector needs affordable, easy-to-deploy cybersecurity solutions, focusing on protecting operational technology (OT) and supply chains. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Weak Network Security Protocols Remediation Tools: Next-Generation Firewalls (NGFW): Agricultural businesses are starting to implement NGFWs from providers like Fortinet and Palo Alto Networks to protect their networks from unauthorized access and to enforce stronger security protocols across their IT environments. Endpoint Protection Platforms (EPP): Tools like Symantec Endpoint Protection and CrowdStrike are being adopted to secure endpoints, which are often the weakest link in agricultural businesses due to their remote and dispersed nature (ConsultancyUK). UK Industry Insights: Critical National Infrastructure Challenges Critical infrastructure sectors like energy, water, and transport are prime targets for state-sponsored attacks aiming to cause large-scale disruptions. Notable 2024 Breach Company: UK National Grid In April 2024, the UK National Grid was targeted by a state-sponsored cyberattack. Attackers exploited a zero-day vulnerability in the grid’s SCADA (Supervisory Control and Data Acquisition) system to disrupt electricity distribution across several regions. Impact: The breach caused temporary power outages in multiple areas, raising concerns about the vulnerability of critical national infrastructure. The attack prompted a nationwide review of cybersecurity measures in critical sectors (ncsc.gov). Vulnerabilities Critical infrastructure sectors like energy and water face constant threats, with rising targeted attacks designed to disrupt services. SCADA systems, crucial to these sectors, are often targeted by state-sponsored actors. These systems, especially when integrated with legacy infrastructure, are vulnerable to zero-day exploits if not regularly updated and monitored, as demonstrated by the UK National Grid breach.(ncsc.gov). Security Tools The use of industrial control system (ICS) security, threat intelligence platforms, and intrusion detection systems is critical. Provider Needs Providers must offer robust, resilient solutions that protect against advanced persistent threats (APTs) and ensure the continuity of essential services. Security Tools Currently Used for Remediation Most Prevalent Vulnerability: Zero-Day Exploits in SCADA Systems Remediation Tools: Industrial Control System (ICS) Security: Critical infrastructure providers are investing in specialized ICS security solutions like Nozomi Networks and Dragos that are designed to protect SCADA systems from sophisticated cyber threats. These tools provide real-time monitoring, anomaly detection, and threat intelligence specifically tailored for industrial environments. Vulnerability Management: Tools used to continuously scan and assess the security of SCADA systems, identifying and patching vulnerabilities before they can be exploited by attackers (ncsc.gov). Cyber Attacks in the UK In 2024, half of businesses (50%) in the UK and around a third of charities (32%) reported having experienced some form of cyber security breach or attack in the last 12 months. This is much higher for medium businesses (70%), large businesses (74%) and high-income charities with £500,000 or more in annual income (66%). Phishing was by far the most common type of breach or attack in 2024, with 84% of businesses and 83% of charities reporting experiencing this type of attack. This is followed, to a much lesser extent, by others impersonating organisations in emails or online (35% of businesses and 37% of charities) and then viruses or other malware (17% of businesses and 14% of charities). Ransomware & DoS Attacks In contrast to the U.S. and other regions, ransomware and denial of service attacks are the least reported cyber crimes (2% or less) among UK businesses and charities. Excluding phishing, 3% of businesses and 2% of charities experienced non-phishing cyber crimes in the past year. Members of the Counter Ransomware Initiative, including the UK, strongly discourage paying ransoms, and institutions under UK national authority should not pay ransomware extortion demands. The NCSC and Information Commissioner’s Office also do not endorse ransom payments, though it is not illegal. 7.8 Million Cyber Crimes It is estimated that UK businesses have experienced approximately 7.78 million cyber crimes of all types and approximately 116,000 non-phishing cyber crimes in the last 12 months. For UK charities, the estimate is approximately 924,000 cyber crimes of all types in the last 12 months. It should be noted that these estimates of scale may have a relative margin of error. Of the businesses that experienced cyber attacks, 13% reported that at least one had resulted in a direct negative impact such as loss of money or data. 32% of large businesses reported a direct negative impact. 24% of business reported indirect costs, such as lost staff time. A 2024 survey estimated that the mean total cost of the single most disruptive attack was £4,590 for small and micro businesses and £40,400 for medium and large business. These are a total of direct and indirect costs. Cyber Preparation & Risk Assessment 61% of medium and 72% of large companies reported undertaking a cybersecurity risk assessment last year. Similarly, 63% of medium and 72% of large businesses deployed security monitoring tools in the past year. Overall, only one-third of businesses undertook a cybersecurity risk assessment in 2023, while a mere 33% deployed security monitoring tools. Organisations carrying out activities to identify risks in the last 12 months These actions are more common in larger organisations: Over 8 in 10 or 83% of medium businesses, 9 in 10 or 92% of large businesses, and 8 in 10 or 86% of high-income charities have performed at least one listed activity. 63% of medium businesses and 71% of large businesses use security monitoring tools. 72% of large businesses conduct cyber security-related risk assessments. Investing in threat intelligence is the least common with 4 in 10 or 42% of large businesses doing so, while other activities are carried out by 60-70% of large businesses. Audits & Findings The way that UK businesses undertake audits continues to be strongly linked to size. Let’s take a look at how small businesses compare to large and whether these audits are conducted internally or with the support of external providers. Among the 17% of businesses that undertake cyber security vulnerability audits, a third undertake internal audits (31%), a slightly larger proportion only conduct external audits (41%) and a fifth (21%) carry out both. Micro, small, and medium businesses are most likely to solely use external contractors to undertake audits: 42% of micro businesses, 41% of small businesses, and 35% of medium businesses. 57% of large businesses conduct both internal and external. Supply Chain Risk In 2024, the UK supply chain faces heightened cybersecurity risks from sophisticated attacks on software dependencies and third-party services. The Cyber Security Breaches Survey 2024 reveals that half of businesses and a third of charities have experienced breaches, with phishing being the most common. The UK Cyber Security Trends Report calls for Zero Trust Architecture, AI/ML defenses, and quantum-resistant cryptography. Supply chain attacks are expected to rise due to growing complexity and stealthier threats. The National Cyber Security Centre has issued new guidance to strengthen supply chain defenses, highlighting the need for continuous cybersecurity improvements. Organisations Conducting Review of Potential Supplier Risks Just over 1 in 10 UK businesses review the dangers posted by their immediate suppliers (11% vs. 9% of charities), while more medium companies (28%) and large businesses (48%) review immediate supplier risks. Top 4 Supply Chain Security Threats 2024 Third-Party Vendor Risks: 3rd party vendors often introduce data security risks to organisations. This is often due to poor security practices stemming from a weak security strategy and vendors not taking cybersecurity seriously. Digital Risks: Digital risks are an unavoidable by-product of digital transformation – the more digital solutions within the ecosystem, the more potential network gateways cybercriminals have. The exposures could be due to software vulnerabilities, such as zero-day exploits or overlooked configuration errors. Supplier Fraud: Supplier fraud, or vendor fraud, is when a cybercriminal claims to be a known retailer requesting a change to payment processes. These events are difficult to identify as fraudsters commonly adopt advanced social engineering techniques, including AI-generated voicemails, phishing attacks, and Deepfake video recordings. Data Protection: Data integrity throughout the supply chain is a significant area of security concern. Security measures should ensure all data states are secure, including at rest and in motion. Data encryption practices are especially important between third-party integrations because hackers know that a target’s third-party vendor likely has access to their sensitive data. Organisations Conducting Risk Assessment of Immediate Suppliers Incident Response Incident Management: In 2023, reports of cyber attacks into the NCSC increased but the volumes that reached the threshold of national significance remained broadly stable. There were, however, more incidents at the top end of the scale, reflecting more high-level and damaging incidents against the UK. There was a 64% increase from 1,226 reported incidents to 2,005 reports with 371 or almost one-quarter deemed serious. Of these, 16% were significant with some of the most severe due to the sustained disruption the incident caused to critical infrastructure via supply chains. While a large majority of organisations say that they will take several actions following a cyber incident, in reality a minority have agreed processes already in place to support this. These 2024 findings are consistent with previous years. The most common processes, mentioned by around a third of businesses and charities, are having specific roles and responsibilities assigned to individuals, having guidance on external reporting, and guidance on internal reporting. External reporting of breaches remains uncommon. Among those identifying breaches or attacks, 34% of businesses and 37% of charities reported their most disruptive breaches outside their organisation. Many of these cases simply involve organisations reporting breaches to their external cyber security or IT providers and no one else. Only 22% of UK Businesses Have IR Plans Formal incident response plans are not widespread (22% of businesses and 19% of charities have them). This rises to 55% of medium-sized businesses, 73% of large businesses and 50% of high-income charities. Board Engagement & Corporate Governance Board engagement and corporate governance approaches toward cybersecurity tend to be more sophisticated in larger organisations with levels of activity remaining stable compared with 2023, according to NCSC. Three quarters of businesses (75%) and more than 6 in 10 charities (63%) report that cyber security is a high priority for the senior management. This proportion is higher among larger businesses (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). Despite economic conditions, many organisations have continued to invest either the same amount or more in cyber security over the last 12 months. Three in ten businesses and charities (both 30%) have board members or trustees explicitly responsible for cyber security as part of their job role – rising to 51% of medium businesses and 63% of large businesses. There has been no change in the overall figures since 2023. 22% of medium businesses and 33% of large businesses have heard of the NCSC’s Board Toolkit rising from 11% and 22% respectively in 2020 (when it was introduced). NCSC Board Toolkit What is the NCSC Board Toolkit? The NCSC’s Board Toolkit helps boards embed cyber resilience and risk management across an organisation’s people, systems, processes, and technologies. Benefits of Using the Board Toolkit Prioritise investment that balances risk exposure Integrates compliance into the business more efficiently Better understand “enterprise estate” that are critical to operations and identify resources to mitigate threats Healthy security, learn from incidents, drive improvement and innovation Invest in cyber security training and education to prepare for adverse events and empower decision making Board, Directors, Trustees Cybersecurity Priority Relatively few organisations at present are adhering to recognised standards or accreditations. However, a sizable proportion of organisations, including larger organisations, continue to be unaware of government guidance such as the 10 Steps to Cyber Security, and the government-endorsed Cyber Essentials standard. Cyber Security Priority in UK Businesses Four in 10 businesses (41%) and charities (39%) report seeking information or guidance on cyber security from outside their organisation in the past year, most commonly from external cyber security consultants, IT consultants or IT service providers. The figure for businesses is lower than in 2023 (49%), while there has been no change among charities. % Organisations Aware of Government Guidance or Communications The Cyber Essentials scheme is a UK government-backed framework supported by the NCSC (National Cyber Security Centre). It sets out five basic security controls that can protect organisations against 80% of common cyber attacks. 12% of businesses and 11% of charities are aware of the Cyber Essentials scheme, consistent with 2023 but representing a decline over last 2-3 years. Awareness is higher among medium businesses (43%) and large businesses (59%). Although only 3% of businesses and charities report adhering to Cyber Essentials. A higher proportion (22% of businesses and 14% of charities) report having technical controls in all five of the areas covered by Cyber Essentials. Government’s Approach and Cybersecurity Regulations As of May 2024, government departments such as Cabinet Office, Department for Science, Innovation and Technology (DSIT), and the Home Office are all involved in cyber security and responsible for driving innovation and cybersecurity strategies and policies within the UK government. Non-departmental public bodies are also involved in cybersecurity, such as the National Cyber Security Centre (NCSC), which advises public and private sector organisations. The National Cyber Strategy 2022 describes the UK’s overarching cyber policy. The strategy takes a ‘whole-of-society’ approach, arguing that the government must work in partnership with private sector organisations and cybersecurity professionals to improve cybersecurity. The strategy aims to shift the burden of cybersecurity from individual citizens to the organisations best placed to manage cyber risks. The government is therefore seeking to improve uptake of the NCSC’s cybersecurity guidance, incentivise investment in cybersecurity measures, increase the number of skilled cyber professionals, and strengthen statutory cybersecurity responsibilities. The UK’s regulatory framework for cybersecurity comes from multiple pieces of primary and secondary legislation. Different legislation covers the cybersecurity of IT systems, internet-connected products and personal data. The legal obligations in cybersecurity legislation apply to sectors and organisations where cyber-security breaches would have a significant impact on society, the economy or individual rights. These include operators of essential services, such as telecommunications and transport, or digital service providers, such as online search engines (designated under the Network and Information Systems (NIS) Regulations 2018). NIS Regulations 2018:The Security of Network & Information Systems Regulations (NIS Regulations) provide legal measures to boost the level of security (both cyber & physical resilience) of network and information systems for the provision of essential services and digital services. Cybersecurity regulations set general expectations rather than specific measures that responsible organisations must take. This provides organisations with a degree of flexibility, which the government regards as important given the rapidly changing nature of cyber threats. Government departments and regulators also publish guidance tailored to specific sectors. As of April 2024, the Product Security and Telecommunications Infrastructure Act 2022 will place cybersecurity requirements on manufacturers and distributors of internet-connected consumer products Current Proposals for Regulatory Reform (as of May 2024) Reforms under debate among policy makers and industry stakeholders include: Ethical Hacking: A defense in law for legitimate cyber security researchers who adopt methods used by malicious actors (known as ‘ethical hacking’). Reporting & Banning Ransoms: Obligations on the victims of cyber attacks, such as banning ransoms and to obliging victims to report cyber incidents. The UK Government has also proposed reforms including: Increasing the scope of the NIS Regulations by including more organisations and requiring a broader range of incidents to be reported. The government says that these reforms will be implemented once a “suitable legislative vehicle” is found. Introducing a ‘cyber duty to protect’, which would place greater responsibilities on organisations who manage online personal accounts. The government has not yet responded to this consultation. Increasing corporate responsibility by requiring large organisations to include a ‘resilience statement’ in their annual reports describing how they manage threats, including from cyber attacks. The government withdrew this legislation on the basis that it would be ‘burdensome’. Negotiations are ongoing at the United Nations regarding a new international cybercrime treaty, proposed by Russia. It would seek to harmonise cyber legislation and improve international collaboration on cyber issues. However, the treaty has drawn criticism from human rights campaigners for its proposed criminalisation of ‘content-based’ activities in cyberspace such as disseminating ‘seditious’ material. UK Cyber Security Government Departments Cabinet Office The Cabinet Office has overall responsibility for cybersecurity policy. It publishes the National Cyber Strategy. Department for Science, Innovation and Technology (DSIT) DSIT is responsible for the implementation of the Network and Information Systems (NIS) Regulations 2018 and other aspects of domestic cybersecurity policy. Home Office The Home Office is responsible for policy on cyber crime. Ministry of Defence (MoD) The MoD leads on work to ‘detect, disrupt, and deter’ adversaries operating in cyberspace, including terrorists, large cyber criminal groups, and state actors. It oversees the National Cyber Force. Foreign, Commonwealth & Development Office (FCDO) The FCDO has policy responsibilities for the UK’s international cybersecurity activities. It also oversees the National Cyber Security Centre and (alongside the MoD) the National Cyber Force. National Cyber Security Centre (NCSC) The NCSC is a pubic agency and is part of Government Communication Headquarters and is designated under the NIS Regulations as the UK’s: Single point of contact, responsible for liaising with national and international partners; Technical authority, responsible for providing expert technical advice to Competent Authorities and other organisations; and Computer Security Incident Response Team (CSIRT), responsible for monitoring and reporting on cyber incidents, conducting threat assessments, and providing early warning about cyber threats. The general responsibilities of the NCSC are set out in the National Cyber Strategy 2022. Competent Authorities Competent authorities are responsible for the implementation of cybersecurity requirements in specific sectors. They designate organisations in scope of the NIS Regulations, work with the NCSC to produce sector-specific cybersecurity guidance, and monitor and enforce compliance. For each sector the competent authority is the relevant UK or devolved government department and/or regulator (for example Ofcom in the telecoms sector). Information Commissioner’s Office (ICO) The ICO is responsible for data protection rules and regulates Digital Service Providers under the NIS regulations. National Cyber Force The National Cyber Force is a partnership between the MoD and GCHQ. It is responsible for conducting covert operations to “counter, disrupt, degrade, and contest” cyber threats from terrorists, criminals, and state actors. The force has published information about how it approaches cyber operations in a “legal, ethical, and responsible” manner. National Crime Agency The National Crime Agency is the law enforcement agency responsible for combatting serious and organized crime. The agency’s National Cyber Crime Unit focuses on tackling cybercrime nationally and internationally. UK Cyber Security Council The UK Cyber Security Council is an independent body funded by DSIT that acts as the Charters Institute for the cybersecurity profession. Critical National Infrastructure (CNI) Most critical national infrastructure companies have cybersecurity responsibilities under the NIS Regulations. The two categories of organization are: Operators of essential services are qualifying operators in critical sectors (energy, water, transport, health, and telecommunications) Relevant digital service providers are qualifying providers of online search engines, online market places, and cloud services. Guidance and Cyber Security Strategy Plans NIS2 Directive The NIS 2 Directive (Directive (EU) 2022/2555) aims to establish a high common level of cybersecurity across the EU. Member States must ensure essential and important entities implement appropriate measures to manage network and information system risks, minimising incident impacts, using an all-hazards approach. National Cyber Security Strategy 2022 Taking over where the pioneering National Cyber Security Strategy of 2016 leaves off, the new National Cyber Strategy is a plan to ensure that the UK remains confident, capable and resilient in this fast-moving digital world; and continues to adapt, innovate and invest in order to protect and promote UK interests in cyberspace. Cyber Security UK CNI UK CNI toward has set resilience targets to be achieved by 2025, and what is needed to achieve those targets to make computer hardware architecture more secure by design to protect CNI. It will determine Government’s approach to standards and regulations for cyber resilience and preparedness, supply chain access, and trusted partners. Counter Ransomware Initiative (CRI) The work of the CRI supports the implementation of the endorsed UN framework for responsible state behaviour in cyberspace, specifically the voluntary norm that States should cooperate “to exchange information, assist each other, prosecute terrorist and criminal use of ICTs and implement other cooperative measures to address such threats.” Network and Information Systems (NIS) Directive The EU’s NIS Directive (Directive on security of network and information systems) is the first piece of EU-wide cyber security legislation. It aims to achieve a high common level of network and information system security across the EU’s critical infrastructure. Telecoms Security Act 2021 The Telecoms Security Act requires UK telecom providers to have measures in place to identify and defend their networks from cyber threats, as well as prepare for any future risks. UK Cyber Security Reforms in Progress Resilience to supply chain attacks Supply chain attacks have risen to prominence in the UK and proposals include imposing cybersecurity responsibilities on third party providers of certain B2B IT services or MSPs. Critical sectors and subsectors With increasing digitalisation additional critical sectors need to be added to NIS regulations who are becoming increasingly vulnerable to security threats, including education, manufacturing, and waste water. Critical sectoral dependencies Critical Network and Information Systems (NIS) sectors (energy, transport, health, drinking water, digital infrastructure, and financial services institutes (FSIs) are dependent on 3rd party services, without which they could not operate. These sectors need to fall under the definition of MSPs. NIS2 Directive New 2024 directing will bring sectors such as medical devices manufacturing, waste management, communications providers, food, and public administration into the NIS IT services and systems supply chain of essential services. Digital Service Providers Currently subject to reactive supervision, proposed legislation includes a risk-based approach, with the most critical providers subject to proactive supervision, meaning they would require to proactively demonstrate their compliance with NIS regulations. Incident Reporting Duties Currently organisations covered by NIS Regulations are required to report all cyber incidents that affect the continuity of services. Incidents that do not affect service continuity do not need to be reported, including unsuccessful attacks or attack where personal, rather than business-critical, files were affected. New reporting is being proposed covering any incident which has a significant impact on the availability, integrity, or confidentiality of networks and information systems, and that could cause, or threat to cause, substantial disruption to the service. Cyber Duty to Protect UK government would remove the cybersecurity burden from individual civilians by placing more responsibility on manufacturers, retailers, service providers and the public sector to raise cyber security standards. In Conclusion The 2024 cybersecurity landscape in the UK continues to evolve rapidly, driven by the increasing sophistication of cyber threats and the expanding digital footprint across critical sectors. Recent trends indicate a sharp rise in targeted attacks against key industries such as healthcare, finance, and critical infrastructure, underscoring the urgent need for robust cybersecurity measures. The UK government has responded by reinforcing its cybersecurity framework through updates to the Network and Information Systems (NIS) Regulations and the introduction of new guidelines for emerging threats. These measures are aimed at enhancing the resilience of organisations and ensuring the protection of essential services that underpin the nation’s economy and security. Key to the UK’s cybersecurity strategy is the emphasis on proactive threat management and compliance with stringent standards. Organisations within critical sectors are now required to implement more comprehensive risk assessments, conduct regular security audits, and adopt advanced technologies such as artificial intelligence and machine learning for threat detection. Additionally, the UK’s Cyber Essentials scheme has been updated to include more rigorous controls, particularly around cloud security and third-party risk management, reflecting the growing complexities of the digital ecosystem. The emphasis on continuous monitoring and incident response capabilities is particularly crucial, as it enables organisations to detect and mitigate threats before they cause significant harm. As the UK looks to the future, it is clear that cybersecurity will remain a top priority for both public and private sectors. The government’s commitment to fostering a secure digital environment is evident in the ongoing investment in cybersecurity research, the development of public-private partnerships, and the expansion of training and education initiatives to build a skilled workforce. However, to stay ahead of evolving threats, organisations must not only comply with regulatory requirements but also cultivate a culture of cybersecurity awareness and resilience. By doing so, the UK can maintain its position as a leader in cybersecurity, safeguarding its critical infrastructure and ensuring the continued trust and confidence of its citizens and global partners. Sources Cyber security breaches survey 2024 – GOV.UK. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024/cyber-security-breaches-survey-2024. Cyber security sectoral analysis 2024 – GOV.UK. https://www.gov.uk/government/publications/cyber-security-sectoral-analysis-2024/cyber-security-sectoral-analysis-2024. Cyber security sectoral analysis 2024 – GOV.UK. https://www.gov.uk/government/publications/cyber-security-sectoral-analysis-2024. The UK’s Cybersecurity: Where Is it and Where Is it Going?. https://www.tripwire.com/state-of-security/uks-cybersecurity-where-it-and-where-it-going. Cyber Security Breaches Survey 2024 – GOV.UK. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024. Cyber Security Breaches Survey 2021 – GOV.UK. https://assets.publishing.service.gov.uk/media/6065c36ad3bf7f401340b300/20-046099-01_CSBS_2021_medium_and_large_trends_infographic_310321.pdf. Businesses urged to boost cyber standards as new data reveals … – GOV.UK. The UK’s Cybersecurity: Where Is it and Where Is it Going?. https://www.tripwire.com/state-of-security/uks-cybersecurity-where-it-and-where-it-going. Cyber security breaches survey 2024 – GOV.UK. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024/cyber-security-breaches-survey-2024. NCSC Annual Review 2023: https://www.ncsc.gov.uk/pdfs/reports/Annual_Review_2023.pdf About BreachLock BreachLock is a global leader in Continuous Attack Surface Discovery and Penetration Testing. Continuously discover, prioritize, and mitigate exposures with evidence-backed Attack Surface Management, Penetration Testing, and Red Teaming. Elevate your defense strategy with an attacker’s view that goes beyond common vulnerabilities and exposures. Each risk we uncover is backed by validated evidence. We test your entire attack surface and help you mitigate your next cyber breach before it occurs. Know Your Risk. Contact BreachLock today! Author Ann Chesbrough Industry recognitions we have earned Tell us about your requirements and we will respond within 24 hours. Fill out the form below to let us know your requirements. We will contact you to determine if BreachLock is right for your business or organization.