Keith Price

Today we published the government's 🇬🇧 UK Cyber Security Sectoral Analysis 2025. It shows another year of very strong growth for the UK cyber sector: ⬆️ Sector revenue up by 12% ⬆️ Gross Value Added (GVA) up by 21% ⬆️ Employment up by 11% The UK cyber sector is a consistent high performer and we have been measuring this performance since 2017. The compound annual growth rate for sector revenue works out at 13%. While venture capital investment has not grown this year, investors surveyed remain bullish and there has been significant other investment activity in the UK market including mergers, acquisitions, loan and equity funding. https://lnkd.in/ea_fMdez Department for Science, Innovation and Technology / techUK / CyberFirst / National Cyber Security Centre / Plexal Cyber / UK Cyber Security Council / UKC3 - UK Cyber Cluster Collaboration / Cyber Security Academic Startup Programme

123

#CyberAlert | Foundations for OT cyber security We have joined international partners to release guidance for owners and operators on foundations for operational technology cyber security and asset inventory. Read it here: https://lnkd.in/esEEhNFc

54

3 Comments

BREAKING: Middlesbrough Council has allocated £25,000 to cyber security for the next 12 months - safeguarding £300 million in public funds, services, and citizen data. That’s 0.0083% of annual turnover. Or £0.11 per resident. Or roughly the cost of a mid-range firewall and a motivational poster about password hygiene. In an era of ransomware-as-a-service, AI-driven fraud, and cascading supply chain breaches, this is a bold gesture - not toward resilience, but toward plausible deniability. What does £25,000 buy you in 2025? • A phishing simulation, two awareness emails, and a laminated “Think Before You Click” sign • A procurement trail proving “something was done” • A future FOI response that reads: “Cyber security measures were in place at the time.” Obviously tongue in cheek, as hopefully they’ve allocated more budget and resources toward cyber security than this, but it got my attention anyway. :) #CyberSecurity #LocalGovernment #DigitalRisk #SymbolicSpending #Middlesbrough #PublicSectorPriorities #Procurement #Accountability #LinkedInIrony

204

82 Comments

JLR (Jaguar Land Rover) will restart production October 1st, having been shutdown for a month due to a ransomware attack that has been claimed by Scattered-Lapsus$-Hunters. I have talked about #ScatteredSpider before and the way they launch their attacks with very successful social engineering techniques. I've seen their type of attacks firsthand with two customers of mine. The attacker call into a registrar's office, or the business office, and they are very effective at getting an end user to allow the attacker on their machine. They use built in tools that do not trigger top tier MDR tools, like Crowdstrike, so alerts do not fire. What can you do? Train your users, teach them about these new kinds of attacks. Change your protocols for changing passwords, make sure your users know to verify who is contacting them. Your users are not the problem; they are the target. Put in protective layers around your users because that is who the attacker's target. Train them to spot the attackers and know that they can safely report these kinds of social engineering attacks. #cybersecurity #CISO #ransomware #risk #awareness #training

28

21 Comments

🚀 Exciting news for aspiring cyber security professionals! The UK Cyber Security Council, in partnership with the UKC3 - UK Cyber Cluster Collaboration (UKC3), has launched the Cyber Access Network (CAN)—a free initiative funded by the Department for Science, Innovation and Technology to help bridge the cyber skills gap. Whether you're a student starting out or a career changer exploring new opportunities, CAN provides: ✅ Networking with industry professionals ✅ Informative & interactive webinars ✅ Exclusive insights into the cyber security sector 🔗 Learn More > https://bit.ly/can-bb  🔗 Sign up today and take your first step into cyber security! > https://bit.ly/canrf-bb #CyberSecurity #Careers #CyberAccessNetwork #Networking #TechJobs

50

2 Comments

🖥CyberRise Yorkshire has announced the launch of a new programme to transform the way cybersecurity is taught and experienced in schools to encourage more girls into careers in the industry.  ⌨Led by Sheffield Hallam University and supported by partners in education, academia, and industry, the project has secured funding from Innovate UK, with co-funding from the Department for Science, Innovation and Technology (DSIT) through the Cyber Local Programme. Read more here👇 https://lnkd.in/ehccDbSi

48

4 Comments

❗New Research - Cyber Security in CNI 2025❗ At last week's CNI Cyber Security Summit, we launched our annual research looking at the top cyber threats, trends and challenges facing UK CNI organisations in 2025. Now in it's fifth consecutive year, the research surveyed over 600 respondents across critical sectors. Some of our key findings were: 👉95% of organisations surveyed have experienced a data breach 👉41% of CNI organisations rank data protection as one of their biggest security challenges. 👉37% of CNI organisations have experienced costs in excess of £500,001 due to ransomware Read more ➡️ https://lnkd.in/eC8ceFsQ #CNIResearch2025 #CyberSecurity

28

1 Comment

If you were too busy to note, the UK’s National Cyber Security Centre published its latest "Annual Review": https://lnkd.in/etWxVb2Y Notably, NCSC calls for “radical transparency” in technology, quipping that we know more about what’s in our sausages than our software. It’s a brilliant and frankly damning indictment. For too long, we’ve allowed critical business decisions to be made in a fog of technical jargon and ambiguity. We’ve hidden behind vague, qualitative statements that do more to obscure reality than illuminate it. The chief culprit seems to be the “risk appetite.” It has become a boardroom euphemism, a convenient way to justify underinvestment without a rigorous analysis of the consequences. A board states it has a “moderate risk appetite” and the conversation ends. But what does that actually mean? It’s a statement devoid of the specificity needed for effective governance. To achieve the radical transparency our industry needs, we must shift our entire mindset: from managing an ill-defined attack surface to managing a quantifiable risk surface. This requires a new engine room for security: the Risk Operations Centre (ROC) and a ruthless intolerance for ambiguity.

82

6 Comments

Another interesting read from The National Audit Office (NAO) which published a report this week (29th January) highlighting the severe and rapidly advancing cyber threat to the UK government. The report reveals that although the Cabinet Office has initiated several efforts to improve cyber resilience through projects like GovAssure and Secure by Design, progress is slow and the CDDO does not expect that it will start improving services across the whole public sector until 2026. https://lnkd.in/e224Ccvm A common challenge “Leaders within departments have not always recognised how cyber risk is relevant to their strategic goals. Often, departments’ most senior decision-making boards and non-executive boards do not include any digital leaders or directors with cyber expertise.” The report confirms government’s cyber resilience levels are lower than previously estimated, with significant gaps in system controls and outdated legacy IT systems contributing to vulnerabilities and whilst the government aims for its critical functions to be cyber resilient, this remains challenging due to a shortage of cyber skills, weak accountability for cyber risks, and poor management of legacy IT. Method launched GRAVITATE (graduates, returners, apprentices, veterans, interns into tech, and transformation employment) in 2020 to try and address the shortage of skills and this programme continues into 2025, if you would like more information then take a look here: https://lnkd.in/eM-aV5tc Methods robust cyber solutions, such as Secure by Design and GovAssure, align perfectly with the government’s initiatives to enhance cyber resilience as our approach focuses on embedding security at the design phase, ensuring that systems are not only protected against current threats but also resilient to future advancements in cyber tactics. By integrating these solutions at the core of governmental IT infrastructure, Method ensures comprehensive security that evolves with emerging threats and if you are interested Method capabilities are available for your review. https://lnkd.in/eipFfn_4 The NAO report underscores the essential need for immediate and sustained efforts to fortify the UK government’s cyber defences. Method's proven capabilities, innovative solutions, and comprehensive management strategies position us as a trusted partner who can confidently advance towards a more secure and resilient digital future. #CyberSecurity #DigitalTransformation #CyberResilience #Innovation #Government #Methodforgood

32

Glasgow City Council announced on Wednesday being impacted by a cyber incident which it said was “disrupting a number of online services and which may have involved the theft of customer data.” The nature of the incident hasn’t been confirmed. It was uncovered by the council’s IT supplier CGI last week, “on servers managed by a third-party supplier,” according to the council’s statement. Day-to-day digital and online services have been disrupted by the council taking the affected servers offline. Its statement included an apology “for the anxiety and inconvenience this incident and the necessary response to it will undoubtedly cause.” #cybersecurity #CNI #Glasgow

17

🆙 UK Cyber Growth Action Plan 🔒 ➡️ The Department for Science, Innovation and Technology has published a new policy paper, “A UK Cyber Growth Action Plan – Final Report”. This is the result of an independent and rapid review, providing key recommendations on the measures required to strengthen and expand the UK’s cybersecurity sector. ➡️ The report underlines the importance of building wider national cyber resilience, highlighting the role of a strong UK cyber culture and mindset, clear and effective cyber leadership, and thriving technology ecosystems that can attract talent, investment, and collaboration to drive innovation and sustainable growth. ➡️ I was honoured to contribute and be a research participant in the #ActionPlan, developed by the University of Bristol in partnership with Imperial College London. ⬆️ I stressed the need for a “cyber MOT”, where organisations of every size should be able to demonstrate that they have appropriate, real-time security controls in place. This would ensure they are trusted members of the supply chain and capable of reducing up to 95% of cyber risk. ✅ Here's the report ➡️ https://lnkd.in/dyJTWCu4 ##UKCyberGrowth #CyberSecurityUK #CyberResilience #CyberLeaders #TechEcosystem #CyberInnovation #SupplyChainSecurity #CyberRiskManagement #CyberCulture #DigitalUK #CyberStrategy #CyberMOT #CyberInvestment Zhero Cybersecurity & IT Support Zaheer Rahman Natasha Wilbers Deman Marx Tomasz Jakubczyk Louise Niemand (De Bruin) Louis Oosthuizen Elizabeth Roux Andrew Elliot Ryan Leech Ryan O'Connor Kathy Meyer Lucindi Storme Mikello Terblanche Shirley Lang

37

Introducing the Cyber Assessment Framework (CAF) 4.0 On 6 August 2025, the UK’s National Cyber Security Centre (NCSC) released the most significant update to the Cyber Assessment Framework since its original launch in 2018.   CAF remains a key tool for demonstrating cyber resilience across the UK's essential services and Critical National Infrastructure. Version 4.0 introduces important updates that reflect a more advanced and evolving threat landscape.   What’s changing? ✅ Stronger focus on threat-informed assurance and contextual risk ✅ New expectations for behavioural monitoring and threat hunting ✅ AI, machine learning, and automation must be considered in risk assessments ✅ Updated and new Contributing Outcomes across all four CAF objectives ✅ Transition timelines will be set by sector regulators, not centrally   If you are an Operator of Essential Services (OES), a Digital Service Provider (DSP), or support UK Critical National Infrastructure, now is the time to start preparing.   We are already working with clients to assess readiness and close gaps against the new expectations.   Read our latest blog, Introducing the Cyber Assessment Framework 4.0: An Updated Tool for UK Cyber Resilience by Josh Waller at NCC Group, to learn what’s required and how to get started.   ➡️ https://bit.ly/4m8Fuv5   #CAF #CyberSecurity #NCSC #NISRegulations #CriticalInfrastructure #CyberResilience 

68