Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NAO report reveals severe cyber threat to UK government

Security

NAO report reveals severe cyber threat to UK government

According to a new report published by the National Audit Office (NAO), the cyber threat to UK government is severe and advancing quickly, with the public spending watchdog emphasising that government must act now to protect its own operations and key public services.


 
Image by Titima Ongkantong / copyright Shutterstock
 
The National Audit Office (NAO) evaluated whether government was keeping pace with the rapidly evolving cyber threat it faces from hostile actors.
 
It identified that the government’s new cyber assurance scheme, GovAssure, which independently assessed 58 critical departmental IT systems by August 2024, found significant gaps in cyber resilience with multiple fundamental system controls at low levels of maturity across departments.
 
At least 228 ‘legacy’ IT systems were in use by departments as of March 2024 and the government does not know how vulnerable these systems are to a cyber attack.
 
If successful, cyber attacks can have devastating effects on government organisations, public services and people’s lives. In June 2024, a cyber attack on a supplier of pathology services to the NHS in south-east London led to two NHS foundation trusts postponing 10,152 acute outpatient appointments and 1,710 elective procedures.

Advertisement
Leonardo RT

The British Library, which experienced a cyber attack in October 2023, has already spent £600,000 rebuilding its services and expects to spend many times more as it continues its recovery work.
 
Successive governments have been working for at least a decade to build the UK’s cyber resilience, including publishing a strategy for improving government organisations’ cyber security in January 2022.

This strategy included a target for key government organisations to be “significantly hardened to cyber attack by 2025”. Yet government has not improved its cyber resilience fast enough to meet this aim.
 
One reason for this is shortages of cyber skills within government. In 2023-24:

  • one in three cyber security roles in government were vacant or filled by temporary staff (contingent labour)
  • more than 50% of cyber roles in several departments were vacant
  • 70% of specialist security architects in post were temporary staff

Departments reported that the salaries they can pay and civil service recruitment processes are barriers to hiring and keeping people with cyber skills.
 
Other concerns include a lack of coordination within government jeopardising effective cyber defence. The respective roles of departments and organisations at the centre, such as the National Centre for Cyber Security (NCSC), are insufficiently understood. Departmental leaders have not consistently recognised the relevance of cyber risk to their strategic goals.
 
Financial pressures have also meant that some departments have significantly reduced the scope of their work to build cyber resilience, which could increase the severity of an attack when it happens. In March 2024, departments did not have fully funded plans to remediate around half of government’s legacy IT assets (53%, or 120 out of 228), leaving these systems increasingly vulnerable to cyber attack. Under-investment in technology and cyber was a key factor in the British Library cyber incident.
 
The NAO is urging the government to act now to build its cyber capabilities and defences. It recommends government:

Within the next six months:

  • develops, shares and starts using a cross-government implementation plan for the Government Cyber Security Strategy.
  • sets out how the whole of government needs to operate differently and what is needed for this transformation to be effective, so that it can achieve its goals for government cyber security and resilience.
Advertisement
DSEI 2025

Within the next year:

  • make and enact plans to fill cyber skills gaps in workforces.

Gareth Davies, head of the NAO said: “The risk of cyber attack is severe and attacks on key public services are likely to happen regularly, yet government’s work to address this has been slow.

“To avoid serious incidents, build resilience and protect the value for money of its operations, government must catch up with the acute cyber threat it faces.

“The government will continue to find it difficult to catch up until it successfully addresses the longstanding shortage of cyber skills, strengthens accountability for cyber risk and better manages the risks posed by legacy IT.”

Nathaniel Jones, VP, AI & Security Strategy at Darktrace said: "The NAO's findings highlight both challenges and opportunities in UK government cybersecurity. While departments are actively working to harness AI solutions, they're also managing complex legacy IT systems that require careful attention. The findings that 58 critical systems need strengthening provides a clear roadmap for improvement.

“The Government now has an opportunity in its upcoming Cyber Security and Resilience Bill and national procurement statement to upgrade the UK's defences for a modern age. As we enter an era where AI is compounding offensive cyber capabilities, government departments will need to fundamentally upgrade their security approaches to safely harness modern day solutions for better public services. This isn't just about patching existing systems - it's about building security architectures that can adapt to the future landscape."

Advertisement
PTC PTC
Value of aerospace, defence, security and space to UK up 64% in 10 years

Aerospace Defence Security Space

Value of aerospace, defence, security and space to UK up 64% in 10 years

16 June 2025

The UK’s aerospace, defence, security and space sectors added £42.2 billion to the UK economy in 2024, according to new data from ADS, equating to a 64% increase over the last decade.

Kahootz signs MAPP contract extention with MoJ

Security

Kahootz signs MAPP contract extention with MoJ

12 June 2025

British provider of secure online collaboration platforms, Kahootz, has signed a three-year contract extension with the Ministry of Justice (MoJ), marking a decade of continued Kahootz support for Multi-Agency Public Protection Arrangements (MAPPA).

NPAS opens Tactical Flight Officers recruitment 2025

Aerospace Security

NPAS opens Tactical Flight Officers recruitment 2025

12 June 2025

The National Police Air Service (NPAS) is now accepting applications for the role of Tactical Flight Officer (TFO) - a unique opportunity for substantive Police Constables to join the national air support team and take their careers to new heights.

Dstl trials underwater robot

Defence Security

Dstl trials underwater robot

11 June 2025

The Defence Science and Technology Laboratory (Dstl) has trialled an underwater robot which can prevent adversaries from sabotaging undersea cables and pipelines by disarming or removing threats.

Advertisement
ODU RT
Eclipse Digital Solutions creates custodial division

Security

Eclipse Digital Solutions creates custodial division

10 June 2025

Building on its responsibility to provide cost effective quality systems and services to the Ministry of Justice (MoJ), award-winning security solutions provider Eclipse Digital Solutions Ltd has created a custodial division, underpinning its commitment to the prison and probation and police sector.

BAE Systems and Hanwha Systems to develop multi-sensor satellite system

Defence Security Space

BAE Systems and Hanwha Systems to develop multi-sensor satellite system

10 June 2025

BAE Systems and Hanwha Systems have signed a Memorandum of Understanding (MoU) to develop technology and collaborative working to deliver an advanced multi-sensor satellite system for international markets.

Advertisement
DSEI 2025