The UK government officially released a new Cyber Action Plan on Jan 6, 2026. The Foreword makes it clear: “The Government Cyber Action Plan is a core deliverable within the Roadmap for Modern Digital Government…” It is not a cyber action plan for business and offers nothing for the UK’s national critical infrastructure.
For business, it is disappointing. The government has developed a plan for itself but thinks that regulation is sufficient for the private sector: “Cyber risk is a challenge facing not just government, but our entire society. The Cyber Security and Resilience Bill will protect more essential and digital services from cyberattacks, requiring them to have appropriate and proportionate measures in place to manage risks, and better prevent disruption to healthcare, drinking water providers, transport and energy. Our response for government is the Government Cyber Action Plan…”
Regulatory compliance for private industry is just another threat and risk that business must circumnavigate – it is not a cybersecurity solution.
Having said that, the cyber risks faced by government are basically the same as the cyber risks faced by business – and the government’s plan for itself can similarly serve as a basic template for the private sector.
The first lesson is that security is costly, but not impossibly costly. The government has injected £210 million (approximately $282 million) into its plan.
Resilience must be a focus of attention. “The UK has experienced repeated, systemic failures in our digital resilience and we know from experience that they pose unacceptable costs…” Secure by design is a starting point. Lack of resilience comes from systemic challenges such as
- Institutionalized fragmentation
- Persistent legacy, cyber security and resilience risk
- Siloed data
- Under-digitization
- Inconsistent leadership
- A digital skills shortfall
- Diffuse buying power
- Outdated funding models
More specifically, there is widespread lack of maturity in asset management, protective monitoring, and response planning. That similarly applies to the private sector.
“Nearly a third (28%) of the government technology estate is estimated to be legacy technology, and therefore highly vulnerable to attack.” Private industry must also ensure that its security is not dependent on outdated equipment.
There is a focus on reducing the adversaries’ dwell time. Given the speed with which modern AI-assisted attacks can occur and progress, all business must do similar.
The government’s plan also includes a focus on the software supply chain, highlighting the issues caused by the CrowdStrike incident in 2024 (it cost the UK economy between £1.7 and £2.3 billion). It “showed how a single supplier dependency can create widespread disruption.” That is certainly a valid issue worth considering, but strangely the Plan makes no mention of the open source software supply chain, nor the potential danger from rising use of vibe coding. The implication here is that the government’s view of security somewhat lags private industry’s knowledge of security.
The Cyber Action Plan can tell us nothing new, and contains its own gaps, but is worth a quick read to check our own business security stance. Strangely, while it doesn’t tell us how to solve security issues, it could increase private industry’s difficulties. Everyone suffers from the skills gap in quality recruitment. But government has an edge that it promises to activate: it is determined to make itself an attractive employer and career path for the best talent.
“The total employee offer will be more competitive with the private sector, as well as emphasizing benefits where government typically out-competes the private sector such as pensions and flexible working.”
While the UK Government Cyber Action Plan does nothing to directly improve private industry cybersecurity, it may do something that will make business security more difficult to achieve.
Related: From Tech Podcasts to Policy: Trump’s New AI Plan Leans Heavily on Silicon Valley Industry Ideas
Related: Security Maturity Models: Leveraging Executive Risk Appetite for Your Secure Development Evolution
Related: Dangerous Liaisons: The Interaction Between Threat Actors and High-Risk Devices
Related: Vibe Coding: When Everyone’s a Developer, Who Secures the Code?
