Why cyber resilience is now a boardroom priority for UK public services

The UK public sector has reached a cyber resilience inflection point. A new Prime Minister has taken office, and significant machinery-of-government changes have already been announced, including the scrapping of DSIT, the department that had become the center of government digital, technology and cyber policy. Its responsibilities are now being redistributed across other parts of Whitehall, creating a new policy and delivery landscape for public sector leaders to navigate.

For years, cyber security was treated as a specialist operational discipline that was essential but largely delegated to technical teams. That model is no longer sustainable. Pressure is now coming from three directions at once, as policy raises expectations for boards and senior leaders, organizational reform reshapes how services, systems and suppliers connect, and technology change, from cloud and hybrid work to AI, expands both opportunity and exposure.

Together, these forces mean cyber resilience can no longer sit below board level. Public services, from healthcare and benefits to transport, education, local government and emergency response, are now so digitally dependent that a cyber incident is not simply an IT outage. It is a risk to public trust, public safety and the continuity of government itself.

Recent history shows what this means in practice. The 2024 ransomware attack on Synnovis, a pathology services provider to parts of the NHS, significantly reduced the capacity to process blood, urine and specimen tests, caused disruption across south-east London and contributed to delays affecting more than 11,000 outpatient and elective procedure appointments. Incidents like this turn abstract cyber risk into real-world service disruption, making resilience a boardroom issue rather than a back-office concern. Cyber resilience is no longer a technical aspiration, but a leadership obligation shaped by policy, organizational and technology change.

Policy change has made cyber resilience a leadership obligation

The direction from government and the National Cyber Security Centre is clear. The Cyber Resilience Pledge asks organizations to make cyber security a board-level responsibility, register for NCSC Early Warning and take a risk-based approach to Cyber Essentials across their supply chains. The NCSC’s Cyber Governance Code of Practice reinforces the point that cyber risk must be governed like any other material organizational risk. The Cyber Security and Resilience Bill will further expand expectations across essential and digital services, strengthening incident reporting and bringing more critical suppliers into scope.

This matters because the scale and impact of cyber threats facing the UK are increasing sharply. The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, up from 89 the previous year. That means the UK is now experiencing an average of four nationally significant cyber attacks every week.

Policy has therefore changed the boardroom question. Leaders should no longer ask only whether an organization has invested in security tools. They need to ask whether they can prove resilience, evidence accountability and continue delivering critical services when systems are under pressure, suppliers are compromised, data access is disrupted or attackers are already inside the network.

Organisational change is creating hidden cyber risk

The second force is organizational change. Local Government Reorganisation is redrawing structures and responsibilities across England. Rail renationalization and other shifts in public ownership are changing who owns, manages and secures critical data and systems. Departmental priorities and delivery models are also evolving under a new Prime Minister, with DSIT being dismantled and functions including digital transformation, public sector AI adoption, information resilience and online harms moving into different departments and central government structures.

Every one of these transitions creates potential gaps. Systems need to be integrated. Identity and access privileges need to be reassessed. Data needs to move between teams, agencies and suppliers. Contracts and responsibilities need to be redefined. During periods of change, the attack surface expands, and accountability can become blurred.

This is why cyber resilience must be built into public sector reform from the outset. The question is not simply how to restructure services efficiently. It is how to ensure citizens can continue to access those services securely throughout the transition. Reorganization without resilience is a risk to the public.

Technology change demands continuous assurance

The third force is technology change. Public sector work now happens across hybrid environments, shared services, cloud platforms, partner ecosystems and complex supply chains. Traditional security models were built for a more stable world of fixed offices, predictable networks, known users and clearly defined organizational boundaries. That world no longer exists.

AI makes this problem more urgent. AI is already being used across the public sector to improve productivity, analyze information and support better service delivery. But without governance, organizations can quickly lose track of which tools are being used, what data they can access and whether sensitive information is being exposed. Shadow AI is not a future risk. It is a present governance challenge.

Resilience in this environment requires continuous assurance. Access should not be granted simply because a user is on a trusted network. Every request should be verified based on identity, context, device posture and risk. Users should only receive the access they need, when they need it. Applications should be protected from unnecessary exposure. Data should be segmented so that compromise in one area does not automatically spread across the organization.

What public sector boards should do now

Making cyber resilience a board-level priority does not mean every director needs to become a technical expert. It means senior leaders need the right governance, evidence and accountability to respond to the three forces reshaping risk across the public sector. That starts with treating cyber resilience as a standing board agenda item, linked directly to service continuity, citizen trust, regulatory exposure and reform delivery. It also requires boards to understand which critical services depend on which systems, suppliers and datasets, where single points of failure exist, and how disruption in one part of the ecosystem could affect citizens’ ability to access essential services.

Supply chain assurance must be part of that same conversation. Public services are delivered through ecosystems, so resilience cannot stop at the boundary of a single department, council, agency or trust. Cyber Essentials, supplier checks, contractual obligations and clear incident reporting expectations should be embedded into procurement and contract management. At the same time, public bodies need to move away from implicit trust based on networks or locations and towards continuous verification based on identity, context, device posture and risk. Users should have only the access they need, when they need it, and AI adoption should be governed before it scales so innovation does not create unmanaged routes to sensitive information.

Resilience is now a test of public sector leadership

The UK’s policy environment has changed. Public sector organizations are changing. Technology is changing even faster. The only way to manage that complexity is to build cyber resilience into the way public services are governed, transformed and delivered.

The public sector cannot afford to treat resilience as something to retrofit after legislation tightens, reform programs are complete or AI adoption has already accelerated. It must be designed in from the outset, measured at leadership level and tested continuously.

Cyber resilience is not just about protecting systems. It is about protecting the public’s ability to rely on government when policy, organizations and technology are all changing at once. That makes it a board-level priority by definition.

More Information on how Zscaler supports public organizations can be found here.

Contributed by Zscaler