NCSC’s ‘tech on the cheap’ warning is a wake-up call, says Rich Giblin, Head of Public Sector and Defence at the platform SolarWinds.
The head of the UK official National Cyber Security Centre (NCSC) has called for an “urgent investment in resilience” after warning that a focus on “tech on the cheap” has left UK organisations exposed to cyber threats. Unveiling the NCSC’s State of the Cyber Nation annual review, Dr Richard Horne warned that the UK’s critical national infrastructure should be braced for a ransomware attack involving AI-powered malware within the next couple of years. The report said that AI adoption by hostile actors is “highly likely” to increase the scale and efficiency of their operations, including ransomware attacks, social engineering and vulnerability exploitation.
And it urges organisations to plan their response and recovery in case the worst happens. The stark reminder comes as the UK Government has been working to strengthen its response to – and recovery from – cyberattacks, following repeated warnings about weaknesses that could leave public services facing prolonged disruption.
In January 2025, the National Audit Office (NAO) warned that the cyber threat to the UK government was “severe and advancing quickly”, adding that recovery is “often lengthy and costly”. Four months later, the influential Public Accounts Committee (PAC) echoed many of the NAO’s concerns, warning that the government’s cyber resilience was insufficient to respond and recover effectively.
Turning policy into action
Since then, the government has introduced the Cyber Security and Resilience Bill, which is currently making its way through Parliament, and the Government Cyber Action Plan, which sets out how departments and public bodies should strengthen their preparedness, response and recovery capabilities.
This included a section devoted to the importance of recovery in the event of a successful breach, acknowledging that government organisations “consistently struggle to develop effective response plans and to embed these through exercising”. While the strategy document is strong on direction, it lacks the necessary detail organisations need to cope with a disruptive cyberattack.
That, though, has been addressed recently by the National Cyber Security Centre (NCSC), which published a raft of advice in early October 2026. Titled “Disruptive cyber attacks – reducing their impact, reducing the risk”, the NCSC’s guidance helps organisations “recover from, prepare for and reduce the risk of highly disruptive cyber attacks”. This single online document is aimed at anyone who might face “significant operational disruption if critical digital systems became unavailable”, including those charged with keeping critical national infrastructure (CNI) safe. And it’s easy to understand why.
For example, one of the NCSC’s central recommendations is to maintain reliable, regularly tested backups. But simply having copies of critical data is not enough. Cybercriminals frequently target backup systems during attacks, attempting to encrypt or delete the very information organisations need to recover. That’s why backups need to be kept separate from primary systems and, crucially, checked regularly to establish whether they’re fit for purpose.
Developing recovery plans
Part of any business’s strong operational resilience comes from having a clear plan for restoring services, whether from a cyberattack or another system-wide disruption. Ideally, organisations should take steps to identify which services are most important so it can decide in advance what needs to be restored first and take a phased approach. This is much easier to do and will stress out your IT teams less than attempting to bring everything back online at once.
In addition, recovery plans should establish a clear chain of command. This will help eliminate confusion in the event of an incident and give everyone a clear lane to do their part to get systems back online. By outlining ownership, who has the authority to take systems offline, who can restore them, and who should approve their restoration, you will set your team up for success.
Once a plan has been made, it’s no good to anyone if it just sits there collecting dust. And with so much at stake, it is best to set a regular plan for recovery and backup testing. This is to make sure that everyone is on the same page and, in the event something happens, most of the procedural knots have been worked out. And practice, like with anything, will improve performance on the day. To further improve security and operational resilience, it’s a good idea to incorporate simulated cyberattacks to recreate high-pressure scenarios.
Building recovery time data
Any organisation’s leadership could turn to us tomorrow and ask – so, in the event of a cyberattack or other critical disruption, what would our recovery time be? Essentially, how much money and time will this cost us? Teams that have reliable backups and a clear recovery plan may still struggle to find a definitive answer to the specific question, or even to come up with a best guess about how long it will take to fully restore essential services.
For public sector organisations, that means identifying which services need to be restored urgently and which can remain offline for longer without causing serious disruption. It could be argued that having a target for recovery is one thing, and knowing whether it is feasibly achievable is another.
Simply using a backup to restore data isn’t the same as having all that data instantly ready to use again. In some cases, connections will need to be restored, some areas rebuilt, and a new security check performed before anything can go live. All these parts will have to be done in phases, which will take time. That’s why simulations of disruptions are important, it will help map out a clear journey to system recovery.
AI is unearthing new threats and vulnerabilities
Threats are now occurring at a rapid pace, and recent research into public sector organisations backs this up. A study from earlier this year, which asked UK public sector IT professionals about AI-related security incidents, found that nearly half said that it had increased in the last year.
With news of AI breaking sandboxes and discovering new critical exploits on older technology that’s been around for decades, it’s easy to understand why so many people think “AI-related security incidents” are attacks. Increasingly, this is not the case, and, as the security industry has long said, internal security issues and “threats from within” can also wreak havoc. The age of AI has created many new problems as organisations rush to adopt the technology and must address the never-before-seen security weaknesses it introduces.
The research also found that AI guardrails weren’t in place for more than a third of public sector respondents, and a similar number said that accommodations were being made to relax controls to facilitate the adoption of the technology.
Further compounding the problem is the lack of visibility of AI once it’s in the system. Insufficient visibility into AI tool behaviour and activity was flagged by four in ten UK public sector IT professionals as being a major AI cybersecurity vulnerability. For me, this suggests that more must be done to shore up defences. We can’t bury our heads in the sand on this one; what’s more, the head of the NCSC agrees.
