NAO warns of severe cyber threat to the UK

The National Audit Office (NAO) has issued a stark warning regarding the UK government’s vulnerability to cyber threats, highlighting critical gaps in resilience and the urgency of addressing them.

A newly released report reveals that 58 key government IT systems assessed in 2024 exhibited significant deficiencies in cyber resilience, while 228 legacy systems remain unassessed for vulnerability, posing a substantial risk to public services.

In 2023-24, one in three government cybersecurity roles were vacant or filled by temporary staff, with some departments reporting that over half of their cyber roles remained unfilled.

The shortage of cybersecurity skills, coupled with outdated IT infrastructure, was flagged as a major factor contributing to the slow progress in bolstering defences. According to the NAO, financial constraints have forced many departments to scale back critical cybersecurity work, leaving 53% of legacy IT systems without fully funded remediation plans.

The report points to the British Library cyber attack in 2023, which cost £600,000 in recovery expenses, as an example of the consequences of underinvestment. Similarly, a 2024 cyber attack on an NHS supplier led to the postponement of over 10,000 outpatient appointments, underscoring the real-world impact of cyber vulnerabilities.

Gareth Davies, head of the NAO, stated: “The risk of cyber attack is severe, and attacks on key public services are likely to happen regularly, yet government’s work to address this has been slow. To avoid serious incidents, build resilience and protect the value for money of its operations, government must catch up with the acute cyber threat it faces.”

To address the crisis, the NAO recommended that the government develop a cross-departmental implementation plan within six months, improve cyber risk accountability, and fill critical skills gaps within a year. It also stressed the importance of interdepartmental cooperation, noting that departments often fail to share lessons learned from cyber incidents.

Despite the government’s 2022 Cyber Security Strategy aiming to significantly harden systems by 2025, the NAO concluded that the current rate of progress falls short. Departments have blamed civil service pay limitations and cumbersome recruitment processes for their inability to hire qualified cybersecurity personnel, further compounding the issue.

Without urgent intervention, the report warns, the government’s cybersecurity strategy risks falling behind, leaving public services vulnerable to further disruption.