Cyber security is now a whole-of-state effort in UK
Public and private sectors working together can strengthen the nation’s cyber resilience, writes Freha Arshad
October marks Cyber Security Awareness Month across the UK, and a milestone for the country's cyber defences: the National Cyber Security Centre (NCSC) turned ten on 3 October. Together they offer a timely moment to look at how far cooperation between government and industry has come, and why it matters more than ever.
Artificial intelligence is industrialising cyber-attacks, lowering the barrier to entry and helping adversaries find weaknesses and strike at a speed and scale most organisations cannot match.
The new mantra is simple: assume breaches will happen. Perimeter defence alone is no longer enough. Preparing to operate through a breach, containing the damage and recovering quickly should now be board-level objectives.
For Scottish public sector organisations and critical national infrastructure operators, the cost of a cyber-attack is not only financial. The public depends on services ranging from railways and energy supply to hospitals and benefit payments. When those services are disrupted, the safety of the nation is at stake, which is why continuity and speed of recovery matter most.
As geopolitical tensions grow, national security is increasingly seen as a whole-of-state responsibility. It extends beyond traditional defence to the suppliers and third parties behind critical infrastructure, healthcare, telecommunications and public digital services.
The public sector has further to go. The World Economic Forum's Global Cybersecurity Outlook 2026 found that 23 per cent of public-sector and international organisations report insufficient cyber resilience, compared with 11 per cent in the private sector. Legacy technology and complex interdependencies are part of the reason. Strengthening castle walls is no longer enough. Organisations must also contain attackers once inside, build in security by design and update systems regularly.
Vulnerabilities can sit several layers below the service providers and their main contractors, among specialist suppliers, technology platforms and infrastructure firms. A breach at any one of them can expose the entire supply chain. Yet the same WEF study found that only 27 per cent of organisations run incident simulations or recovery exercises with their ecosystem partners. They are critical to successfully navigating and surviving a real event.
This is where a whole-of-state approach to cyber defence is needed. Shared responsibility across government, operators and suppliers – built on common standards and governance rather than hardware and individual security alone, can make the entire system safer.
Much of this work is already under way. The government's Cyber Resilience Pledge, launched in July, asks organisations to make cyber a board-level responsibility, sign up to NCSC early warnings and require basic security standards across their supply chains.
In January, a group of leading firms, including Accenture, joined the Department for Science, Innovation and Technology’s first Software Security Ambassadors Scheme. The initiative aims to encourage uptake of the Software Security Code of Practice, share practical examples of how it is being implemented, and feed operational insights into government policy.
The Cyber Security and Resilience Bill, now before Parliament, would extend cyber security duties beyond service operators to the data centres, managed IT providers and suppliers they rely on. It could help set a standard for cyber resilience as widely recognised as data privacy has become under the General Data Protection Regulation (GDPR).
Organisations can act now, and testing recovery plans with suppliers, not just internally, is a good place to start. The public and private sectors are more resilient together than either can be alone.
Freha Arshad, UKI Health & Public Sector Cybersecurity Lead at Accenture
Comments
Want to join the conversation? Please or to comment on this article.