The Next Phase Of UK Cyber Strategy

Why It Matters

A robust, resilience‑oriented cyber strategy safeguards the UK’s economy and national security, while guiding businesses to protect critical operations against increasingly disruptive attacks.

Key Takeaways

• 2025 attacks exposed critical UK cyber‑resilience gaps
• Shift from data‑protection focus to operational continuity imperative
• Success metrics must combine incident count and impact reduction
• Reliance on US hyperscalers raises sovereign cloud concerns
• National Cyber Action Plan needs broader economic‑legal perspective

Summary

The panel discussion, hosted by Rusei’s Jamie McColl, examined the United Kingdom’s current cyber‑security posture in the wake of high‑profile 2025 breaches at major retailers and Jaguar Land Rover. Participants—including NCSC chief technical officer Ollie Whitehouse, former NCSC chief Kieran Martin, MP Dan Aldridge, and BAE Systems’ Mary Hey—debated how these incidents have forced a reassessment of the nation’s cyber‑resilience and the forthcoming UK National Cyber Action Plan.

Key insights highlighted a fundamental shift in threat priorities: executives now face a stark choice between protecting personal data and preserving core operational capabilities. Kieran Martin warned that the historic emphasis on data‑privacy is insufficient, urging a move toward reducing both the frequency of incidents and their blast radius. Ollie Whitehouse cited the “share‑and‑defend” programme’s success in averting billions of potential losses, while Mary Hey stressed the interdependence of cyber, digital and data spending, warning that squeezing one budget inflates risk elsewhere. The panel also flagged the strategic vulnerability of relying on US‑based hyperscalers, noting emerging pressures for sovereign cloud solutions and the associated cost premiums.

Notable remarks underscored the urgency of a new strategic framework. Martin described 2025 as a “choice point” demanding interventionist policies beyond public‑private exhortations. Whitehouse highlighted that the previous national strategy laid a solid foundation but fell short of addressing evolving operational threats. Mary Hey illustrated the “balloon” analogy, emphasizing that under‑investing in any of the cyber‑digital‑data triad destabilises the whole ecosystem. These perspectives collectively argue for metrics that capture near‑misses, impact mitigation, and cross‑sector coordination rather than raw incident tallies.

The implications are clear: without a refreshed, holistic cyber action plan, the UK risks further economic damage, erosion of public trust, and diminished strategic autonomy. Policymakers must embed resilience‑focused metrics, incentivise sovereign cloud adoption, and align cyber spending with broader digital transformation goals. For businesses, the shift signals a need to integrate cyber risk into overall operational planning, ensuring continuity even as threat actors target critical services and supply chains.

Original Description

A panel event to celebrate the launch of a forthcoming RUSI paper on the next iteration of the UK National Cyber Strategy.

Speakers:

Ciaran Martin, Professor of Practice, Blavatnik School of Government, University of Oxford

Ollie Whitehouse, Chief Technology Officer, National Cyber Security Centre

Mary Haigh, Director of Digital Delivery and Deputy Global Chief Information Officer, BAE Systems

Dan Aldridge MP, Chair of the APPG for Cyber Innovation

Moderator: Jamie MacColl, Senior Research Fellow, RUSI

RUSI Events: https://my.rusi.org/events.html

Recorded at RUSI, 61 Whitehall, London, on 10 February 2026