The changing face of cyber security in the UK public sector

Summary:

• Over the past decade, cybersecurity in the UK public sector has moved from a fragmented to a centralised approach
• Public bodies protect extremely sensitive data and operate under heightened regulatory scrutiny; secure by design is now a baseline
• While AI significantly strengthens defensive capabilities, it also enables more sophisticated, scalable attacks
• Effective security now requires continuous, automated testing in order to keep pace and free up specialists' time
• Public bodies must view cybersecurity as a foundation of modern government, not an add on

Over the past decade, the UK public sector has been forced to evolve at pace. As recently as 2016, cyber responsibility was fragmented across government departments and primarily framed as a national security issue, rather than a strategic imperative embedded in day to day operations. That began to change with the formation of the National Cyber Security Centre (NCSC), which provided a clearer focal point for national guidance and coordination. The impact of the WannaCry ransomware attack soon after proved to be a watershed moment, accelerating the shift towards centralised standards, regulation and accountability.

Between 2022 and 2024, this trajectory hardened further. The launch of the Government Cyber Security Strategy 2022-2030, combined with heightened geopolitical tension, drove a marked increase in both the volume and sophistication of threats facing public bodies. Today, that challenge is being reshaped once again. The arrival of AI has dramatically accelerated attackers' capabilities through scale, speed and automation. At the same time, it offers defenders powerful new tools for vulnerability discovery, threat detection and response. How the public sector balances those forces will define the next era of cyber resilience.

Why cyber risk looks different in government 

Today, public sector cybersecurity remains shaped by confidentiality, integrity and availability. For example, protecting citizen data held by organisations such as HMRC, ensuring systems that store national insurance and pension data cannot be manipulated or corrupted, and keeping critical national infrastructure — including NHS services — available at all times. As a result, cybersecurity requirements in government are more stringent and specialised. Public bodies must operate under heightened regulatory scrutiny and defend systems that cannot simply be taken offline without real world consequences. Security programmes, therefore, must balance resilience, accountability and continuity at scale and be prepared for high levels of public exposure.

Consequently, modern public sector cyber security programmes operate under a set of rigorous and highly specific requirements. Secure by design procurement is now a baseline expectation, with vendors required to meet defined security standards and demonstrate that controls are embedded from the outset, rather than added retrospectively. Data sovereignty and classification rules add further complexity; for example, sensitive defence or law enforcement data often cannot leave UK borders or approved environments. This dictates how information is stored, accessed and shared. Identity and access management are equally critical. With multi agency collaboration and third party contractors commonplace, access controls must be granular, auditable and continuously enforced to prevent misuse or privilege creep.

These requirements are rooted in a heightened focus on sovereignty and national security, which most clearly distinguishes public sector cybersecurity from private sector programmes. However, important operational differences also come into play. Public bodies typically rely far more heavily on complex legacy systems that support essential services and cannot be easily replaced or upgraded without significant risk. Slower, more rigid procurement cycles further constrain the pace at which new technologies can be adopted. At the same time, the responsibility for protecting sensitive citizen data and critical national infrastructure increases exposure to nation state and politically motivated attacks, as adversaries seek to steal state secrets, undermine public trust or disrupt economic stability.

AI and the new cyber arms race 

As with every sector, AI is reshaping the cybersecurity landscape, and the public sector is no exception. What makes cybersecurity distinctive in this context is its dual role: AI significantly strengthens defensive capabilities while simultaneously enabling more sophisticated and scalable attacks. For public bodies responsible for essential services and national infrastructure, that tension is particularly acute.

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

On the defensive side, AI is helping government security teams detect threats earlier, improve accuracy, and reduce pressure on already-stretched resources. AI driven analytics can identify anomalies across vast, complex estates, including legacy systems, far faster than human analysts alone, while automated response capabilities reduce dwell time and help contain incidents before they disrupt public services.

AI has also reshaped security testing itself. Where penetration testing was once a point in time, scoped exercise, effective assurance now requires continuous, automated testing that assesses systemic risk across entire environments and dependencies. With time to exploit reducing from days to hours, regular scanning and AI driven assurance are essential in order to keep pace with adaptive attacks and free up specialists to focus on higher value, strategic work.

However, the same technologies are equally available to adversaries. AI now enables the rapid generation of highly convincing phishing campaigns, automated reconnaissance at scale, and faster adaptation to defensive controls. Attackers can identify vulnerabilities across public facing systems, personalise social engineering efforts, and even exploit deepfake technologies to impersonate trusted officials or suppliers. 

What comes next for public sector cybersecurity? 

Against this backdrop, the combination of AI enabled threats and sustained attacker focus on critical national infrastructure and defence systems is making public sector cyber security more complex, interconnected and unpredictable. Looking ahead, several forces will shape the next phase of public sector cyber risk.

Chief among them is the continued rise in state sponsored activity as demonstrated by the NCSC, which dealt with 204 ‘nationally significant’ cyber attacks against the UK in the 12 months to August 2025 (https://tinyurl.com/ycya32k5). This was up from 89 in the previous year, reflecting growing geopolitical tension and a willingness by hostile states to use cyber operations to pursue strategic objectives. 

At the same time, space and satellite systems are emerging as prime targets for adversaries. Modern defence operations rely heavily on space based assets for secure communications, navigation, intelligence and the coordination of military, emergency and transport services. Disrupting or degrading satellite infrastructure can therefore have cascading effects on everything from defence readiness to economic stability, making it an attractive target in both cyber and hybrid conflict.

Further ahead, quantum computing poses a long term yet potentially profound challenge. While still emerging, advances in quantum capability could eventually undermine today’s cryptographic standards. For public sector organisations responsible for long lived data and systems, this demands early planning, investment and a clear roadmap towards post quantum resilience.

Cybersecurity as a foundation of modern government 

Cybersecurity in the public sector has moved far beyond perimeter defence or compliance checklists. It now sits at the intersection of national resilience, public trust and geopolitical reality. The challenge ahead is not simply adopting new technology, but embedding security as a strategic, continuous capability, spanning people, policy and platforms. Public bodies must plan for disruption, design for resilience and treat cybersecurity as a foundational enabler of modern government rather than an afterthought.