Kurtis Toy, Chief Executive of the Cyber Centre of Excellence, has published Analogue 72. It’s a ‘Green Paper’, arguing that Britain plans emergencies from the top down, while the resilience people actually rely on is built from the bottom up.
When Storm Arwen tore through Scotland in November 2021, Kurtis Toy was not reading about it in a briefing. He was living in it: a cyber security professional in a remote community, without power, without a working phone network, and with no way to find out what was happening or when services would resume. It was, he says, the moment the question changed. He had spent his career assessing how organisations could be attacked and that became a focus when he founded Onca Technologies Ltd, in 2016. That week he experienced what happens after the systems stop โ not to an organisation, but to the people who depend on it. The following year he joined up with a community-interest-company, iESE, to help found what became the Cyber Centre of Excellence (CCoE) for Local Government.
As its Chief Executive, he sets out what he has built from that experience: Analogue 72 (A72), a recurring national diagnostic that tests what households, communities, councils and essential operators can still do during 72 hours of severe digital disruption. He argues that realistic planning expectation is not one catastrophic event but compound disruption, hostile and accidental and climatic, arriving in communities that are more digitally dependent every year. He says: “I have spent my career telling organisations how they could be attacked. During Arwen I found out what it is like to be on the other side of it โ no power, no phone signal, no way of knowing anything. What struck me was not that the response failed. It was that the people around me were organising long before anybody official could reach us. That is the capability nobody is measuring.โ
About Arwenย ย
Aberdeenshire Councilโs own published account of Storm Arwen records the scale of it. Around 60,000 homes lost power in the first 48 hours. The network suffered some 200 separate faults โ the equivalent of two yearsโ worth in a single night. Around 8,000 homes were still without electricity a further seven days later. And, critically, the loss of power took down digital and mobile telephony across several rural areas – Aberdeen went back to Analogue. That final detail is the foundation of the A72 Green Paper. The outage removed the very channels through which the response would ordinarily have been coordinated and through which residents would ordinarily have been informed. Nobody attacked anything. The weather produced, in the north-east of Scotland, the conditions A72 is designed to test. The Green Paperโs point is that Britain already knows what this looks like. It has simply never treated the experience as a diagnostic โ never asked, systematically, what worked, what people did for themselves, and what the law and the systems around them allowed.
The storm came first, then the measurement
The sequence matters. Arwen came in November 2021. The CCoE was founded in late 2022. The first passive scan of UK local authorities followed in 2023, and this yearโs was the fourth annual cycle. The lived experience of a multi-day outage preceded both the organisation and the measurement programme, and shaped what they were built to look for. The passive scan assesses externally visible vulnerabilities without touching internal systems, awarding each authority a health score from five (strong outward-facing cyber health) to one (significant improvements required). The most recent cycle, reported in July 2026, found some councils more vulnerable to cyber attack than a year earlier, but many more had improved.
The scans answer one question and raise another. They show where an authority is exposed but they cannot show what happens to residents when exposure becomes disruption โ which is the question Arwen had already put to Kurtis. Four cycles of data have shown rising awareness, uneven remediation, and essential services growing more digitally dependent each year.
Background
As Kurtis points out, in July 2026 a small UK power plant was taken offline for four days after a cyber attack reported as linked to the Iranian regime. Ministers confirmed a cyber incident affecting a small-scale generator and said there was no risk to the wider energy system. The generator reportedly fell below the size threshold at which cyber activity must be notified to government โ meaning local responders would have had almost no consequence information to work from. The UK official National Cyber Security Centre (NCSC) says it managed more than 200 incidents affecting UK critical national infrastructure and its supporting ecosystem in the year to May 2026.
Invitation
The CCoE invites public bodies, essential operators, regulators, researchers and community bodies to challenge its framework, submit benchmarks and evidence, identify relevant precedents the author may have missed, and volunteer as pilot areas.
About Kurtis Toy
He’s a Virtual Chief Information Security Officer (vCISO), CEO of Onca Technologies Ltd โ which he founded in 2016 โ and Chief Executive of the CCoE. He holds an MSci in biological sciences and an MSc in Information Technology, is a CISSP, and holds GDPR Practitioner (Data Protection Officer), ISO 27001 Lead Implementer and ISO 9001 Internal Auditor qualifications. He began his career in the energy sector, becoming Global IT Coordinator and later Global IT Team Leader with responsibility for cyber security. He joined iESE in late 2022 to help found what became the CCoE, has led its annual local-authority passive scan since the first cycle in 2023.
Visit: www.ccoe.org.uk.
