Too little, too late? Partners weigh in on Government Cyber Action Plan
Tech vets debate whether the new initiative will boost the public sector’s capabilities, or prove vain given the scale of the task
On Tuesday 6 January, the UK government kicked off the year by announcing a new Cyber Action Plan.
Backed by more than £210m of central investment, the scheme will aim to protect citizens, data and critical services from escalating cyber threats.
It also forms part of a broader push to expand digitisation across public service delivery.
A new department, the Government Cyber Unit, will drive implementation by coordinating action across departments and the wider public sector.
Key priorities include improving visibility of cyber and digital resilience risks across government, as well as boosting incident response.
But is the initiative enough to tackle the challenges facing the public sector, or is it merely a drop in the cybersecurity ocean?
To answer these questions, CRN gathered the views of IT experts from Arc, SEP2, Assured Data Protection, Advania UK and Phoenix Software.
Mark Darrah, CTO, Arc
How do you view the new £210m Government Cyber Action Plan in the context of today’s threat landscape? Do you believe the level of investment is sufficient to address evolving risks, including those linked to AI?
“This is nowhere near enough to cover off the problems and scale of the issue.
“If compared to other countries - who are spending in the billions - it shows how much more seriously they are taking the issue.
“We already massively lag behind in the public sector in terms of security, and I fear that pot will not even cover off the remaining Windows 10 devices that are still in operation in that sector.”
Do you see this action plan as an economic or commercial opportunity for your business?
“This is a commercial opportunity and Arc has already been working with many public sector organisations to improve and increase the security frameworks around their organisations.
“From an economic standpoint, this is a necessity and has been for some time.”
How prepared is your organisation to engage with or support initiatives led by the new Government Cyber Unit? Have you previously worked with UK government bodies on public cybersecurity projects?
“We have worked with many NHS organisations developing and improving legacy IT and paper-based systems and then securing them within Microsoft Azure.
“We have worked heavily helping support the DSPT initiative advising on best practice whilst utilising Microsoft toolsets to help them secure their systems cost effectively.”
Paul Starr, CEO, SEP2
How do you view the new £210m Government Cyber Action Plan in the context of today’s threat landscape? Do you believe the level of investment is sufficient to address evolving risks, including those linked to AI?
“While this initiative does feel like a case of ‘too little, too late’ to genuinely mitigate the risks, it could serve as a valuable initial step.
“I would hope that successful implementation will stimulate greater investment, particularly within the public sector, where capital expenditure depends heavily on government funding.
“My primary concern is that a significant proportion of contracts will likely be routed through existing government procurement channels.
“Although these mechanisms are efficient, they often favour large ‘strategic suppliers’ who may lack the specialised expertise and flexibility that smaller, more focused vendors can provide.”
Do you see this action plan as an economic or commercial opportunity for your business?
“SEP2 views the Government Cyber Action Plan as a significant commercial opportunity.
“As an established MSSP, we are well-positioned to support the public sector and its supply chain, leveraging our experience gained from implementing advanced protection measures for the financial services sector under the stringent requirements of DORA.
“Given that DORA's high standards for operational continuity and third-party oversight align closely with both NIS2 and the new Cyber Security and Resilience Bill, we possess a proven, ‘battle-tested’ framework ready for wider public sector application.
“Over the next 12 to 24 months, we anticipate a significant surge in demand across several core sectors.
“MDR is our key priority. This service has become essential due to the new bill's mandate for a continuous, 24-hour initial incident notification.
“This requirement will necessitate a fundamental transition from standard ‘nine-to-five’ IT operations to comprehensive, 24/7/365 managed security services.”
How prepared is your organisation to engage with or support initiatives led by the new Government Cyber Unit? Have you previously worked with UK government bodies on public cybersecurity projects?
“SEP2 has a number of UK public sector customers, we are listed on GCloud and Cyber Security Services 3 and so feel we're well placed to execute with public sector buyers.
“At the heart of our services is our UK-based SOC.
“As a UK-based, CREST-accredited facility, we provide the ‘sovereign capability’ that government departments increasingly require to ensure sensitive data remains protected by UK-vetted experts around the clock.”
Stew Parkin, global CTO, Assured Data Protection
How do you view the new £210m Government Cyber Action Plan in the context of today’s threat landscape? Is the investment sufficient?
“There’s a risk that this becomes another well-intentioned action plan when what’s really needed is direct, sustained investment into frontline cyber capability.
“The threat landscape is moving faster than policy and public sector organisations are being asked to defend modern, cloud-connected environments using toolsets and platforms that are often several years behind the market.
“£210m sounds significant but spread across departments and initiatives it doesn’t go very far unless it translates into real buying power for those actually operating the systems.”
Do you see this action plan as an economic or commercial opportunity for your business?
“Potentially - but only if it results in budgets being unlocked rather than more layers of governance.
“Right now, many public sector organisations know what they should be doing but are constrained by funding models and procurement processes that make it difficult to adopt modern security platforms.
“If this plan helps remove those constraints, we expect demand to increase most around cyber recovery, resilient backup, and services that demonstrably reduce operational risk rather than just add controls.”
How prepared is your organisation to engage with initiatives led by the new Government Cyber Unit?
“We’re prepared to engage, but the success of any central initiative will depend on how closely it’s aligned with operational reality.
“Security outcomes won’t improve through coordination alone - they improve when organisations are able to deploy, operate, and evolve the right technologies at pace.
“We’ve worked with public sector bodies before, and the consistent challenge is less about intent and more about execution under tight financial and procurement constraints.”
Tristan Watkins, director of services innovation, Advania UK
How do you view the new £210m Government Cyber Action Plan in the context of today’s threat landscape? Is the investment sufficient?
“The government’s new cyber investment is ambitious and unprecedented in the UK.
“Although you could argue that £210m is a drop in a £26bn digital technology bucket, we need to be mindful that this is net new spending.
“Given our current budgetary realities, this is a sound place to start.
“But even though the funding is critical to attracting the right talent and setting up the structures put forward in the plan, that shouldn’t be what captures minds.
“The plan is more about coherence, consistency, accountability and setting out the urgency of the task at hand.
“Although AI will change the threat landscape in a more profound way in 2026, this plan is more about security fundamentals, foundations, hierarchy, and collective requirements.
“The government’s Department for Science, Innovation & Technology (DSIT) already created the AI Security Institute in 2023, which produces some of the best AI security research and guidance in the world.
“It’s a good thing the new Cyber Action Plan hasn’t created any blurriness with their existing function, and that this all sits within DSIT, which is also the home of wider digital transformation.”
Do you see this action plan as an economic or commercial opportunity for your business?
“Given that the milestone for establishing the Government Cyber Unit doesn’t arrive until April 2027, we need to be realistic about how quickly the plan might translate into widespread commercial opportunities.
“This may be different for the government’s ‘strategic suppliers’ (based on criticality or scale of services).
“They will have cybersecurity and resilience requirements built into their agreements, which we can expect to come into force by March 2027.
“Is there an implied commercial opportunity for those suppliers in there? Perhaps.
“It’s unlikely any of the suppliers would be expected to do less than what they do today, but whether any net new obligations can be commercialised is unclear.
“There is also a potential that this pool of £210m funding may create net insourcing in some areas, so the consideration is not all about opportunity.
“For some suppliers there may also be some loss. This should all be clearer next year.”
How prepared is your organisation to engage with initiatives led by the new Government Cyber Unit?
“Advania will continue to offer technology transformation services, GRC, penetration testing, AI advisory/build and change/adoption services to our government clients.
“What we do is linked to many of DSIT’s objectives. We know that the Government Cyber Unit will be working on identifying legacy systems as part of this initiative, so we can certainly see opportunity to assist with some of those legacy technology upgrade needs.
“We also help public sector organisations embrace their Microsoft platform investments, especially in the identity, device management, data protection, and security stacks.
“We can only assume this effort will trigger a need for more of this modernisation and maturity work. In other words, we will continue delivering work with the public sector to support these project needs.
“As an MSP, we do expect some changes will come from the implementation phase of this plan, but these specifics haven’t been defined yet, so that is a hard question to answer at this time.”
Jonny Scott, head of cyber advisory, Phoenix Software
How do you view the new £210m Government Cyber Action Plan in the context of today’s threat landscape? Do you believe the level of investment is sufficient to address evolving risks, including those linked to AI?
“The Cyber Action Plan is a timely and positive step that recognises the scale and persistence of today’s threat landscape, particularly for public services that are increasingly digital and interconnected.
“The investment sends a clear signal that cyber resilience is now seen as foundational to public service delivery.
“£210m, however, is a relatively modest investment.
“Cyber threats are continuous, industrialised and increasingly augmented by AI-driven tooling, therefore the investment will need to be spent extremely effectively and sustained year over year to drive the strategic outcomes it is set out to achieve.”
Do you see this action plan as an economic or commercial opportunity for your business?
“I see this less as a short-term commercial opportunity and more as a longer-term shift in expectations around cyber maturity across the public sector.
“As standards rise, organisations will need support translating policy and guidance into practical, operational controls.
“Over the next 12 to 24 months, we expect demand to increase around incident readiness, supply-chain assurance, secure cloud adoption and ongoing cyber resilience rather than one-off technology purchases.
“Advisory services that help organisations prioritise risk and make best use of limited budgets are likely to be particularly important.”
How prepared is your organisation to engage with or support initiatives led by the new Government Cyber Unit? Have you previously worked with UK government bodies on public cybersecurity projects?
“Phoenix Software has a long history of working with public sector organisations, and that experience has given us a good understanding of the operational, regulatory, and budgetary constraints they face.
“We are well positioned to support initiatives that focus on improving resilience, visibility and preparedness rather than purely compliance-driven outcomes.
“We have previously supported public sector customers across a range of security and risk-focused programmes, and we expect collaboration between industry and government to play an increasingly important role as the Cyber Action Plan progresses.”