Russia, Shai-Hulud, AI: Is the Cyber Action Plan adapted to new threats? Tech experts react
IT pros discuss if the government’s scheme will be sufficient amid evolving cyberattacks that have recently hit public bodies and channel firms
Unveiled last week, the UK government’s Cyber Action Plan aims to defend citizens, data and critical services from evolving cyber threats.
The scheme also forms part of a broader push to expand digitisation across public service delivery, with a new Government Cyber Unit tasked with driving its implementation by coordinating action across departments and the wider public sector.
This comes amid a surge in cyberattacks in recent months, affecting not only government entities but technology firms including AWS, SonicWall, Ingram Micro, Cisco, Microsoft, Juniper and ConnectWise.
While the £210m plan has already sparked debate among channel partners, another question remains: is the Cyber Action Plan enough to tackle not only today’s threats, but tomorrow’s as well?
CRN spoke to IT pros from Advania UK, Trustmarque, SEP2, Assured Data Protection, Phoenix Software, Arc and Redcentric to assess whether the scheme can keep pace with an increasingly complex threat landscape.
Tristan Watkins, director of services innovation, Advania UK
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“The Cyber Action Plan clearly re-states the government’s view of ‘the systemic challenges underpinning our current resilience status’ from the State of Digital Government Review in January 2025.
“This includes institutionalised fragmentation, persistent legacy, cyber security and resilience risk, siloed data, under-digitisation, inconsistent leadership, a digital skills shortfall, diffuse buying power and outdated funding models.
“28 per cent of the government technology estate is estimated to be legacy technology, and therefore highly vulnerable to attack.
“We can’t argue with any of this. It is the government’s own assessment in their own words, and it clearly isn’t sugar-coated.
“The only thing I would add is the recent impact of supply chain attacks.
“Although addressing these risks is clearly part of the plan, the rate and magnitude of attacks like Shai-Hulud and its successors in recent months should be listed among these challenges.”
Does the action plan reflect what you are hearing from public sector customers about their security priorities, or are there areas you feel have been overlooked?
“It’s difficult to clearly compare current plans with guidance and responsibilities that haven’t been defined yet.
“But if current plans have de-prioritised security objectives explicitly, then public sector organisations should consider whether they should change those plans now, or re-work later.
“Although it is conceivable that some current government requirements might be relaxed once risk management is split between cross-government and departmental scopes, it’s reasonable to assume that relaxation would be the exception to the rule.”
Have you observed an increase in cyberattacks or a shift in attack techniques targeting public sector bodies in recent months? If so, how are these threats changing?
“Over the last week we’ve seen SOCRadar report on a coordinated DDoS campaign from Russia, with 85 per cent of targets located in the UK, government infrastructure comprising more than half of all targets and extending to critical infrastructure like seaports and rail networks.
“We can only expect more of this unless current geopolitical trends change dramatically.”
Chris Jones, head of public sector, Trustmarque
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“The core challenge is capacity: public sector teams understand the risks and the need to modernise, but limited budget, resources and in‑house expertise make it hard to keep pace with evolving threats.
“Attacks increasingly target not just government systems but the wider supply chain, adding pressure to already stretched teams.
“Services like Trustmarque SecureXpert help bridge this gap by providing specialist skills and proven methodologies, allowing organisations to maximise existing tools, adopt new capabilities faster and maintain a consistent security posture.
“I fully support the new Software Security Ambassador Scheme to drive adoption of the Software Security Code of Practice
“My recommendation is to accelerate its rollout and consider making it mandatory.
“Strong collaboration between the public and private sector is essential to safeguarding UK services.”
Does the action plan reflect what you are hearing from public sector customers about their security priorities, or are there areas you feel have been overlooked?
“We have already seen the drive for more coordinated services across UK government, this is fully aligned with what we hear from our customer base.
“A consistent and programmatic approach to address cyber risk means all areas are elevated following the mantra that government is only as strong as its weakest link.”
Have you observed an increase in cyberattacks or a shift in attack techniques targeting public sector bodies in recent months? If so, how are these threats changing?
“Yes, there is clear evidence of both an increase in cyberattacks targeting public-sector bodies and a shift in the techniques threat actors are using.
“Across multiple reports and security analyses in 2024–2025, trends show a 40 per cent increase of attacks in 2025 compared to the previous year.
“Governments, local authorities, schools, healthcare entities, and other publicly funded organisations are facing more frequent, more sophisticated and more destructive attacks.
“A more centralised, funded and joined up programme across public and private sector is key to tackle this threat landscape.”
Paul Starr, CEO, SEP2
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“The most significant deficit stems from the intersection of a critical skills shortage and insufficient supply chain visibility.
“The public sector's inability to attract and recruit specialists in areas like cloud security and incident response has created a severe lack of in-house expertise.
“This issue is amplified by inadequate oversight of third-party ecosystems; many organisations lack the capacity to effectively audit the security posture of their numerous smaller vendors.
“Therefore, the primary capability gap is not merely a technological one, but a failure of operational resilience, the inability to sustain visibility across fragmented, legacy IT environments and to respond to breaches at the speed required to combat modern, AI-enhanced threats.”
Does the Action Plan reflect what you are hearing from public sector customers about their security priorities, or are there areas you feel have been overlooked?
“The Action Plan correctly identifies the ‘what’, the need to ‘defend as one’ and centralise response.
“This aligns with what we hear from local authorities and NHS trusts, as they know they cannot fight nation-state actors or AI-automated syndicates in isolation.
“However, my fear is that the plan’s £210m investment is spread too thin to remediate the sector's vast legacy debt, and neglects the 'long tail' of smaller supply chain vendors who lack the resources to meet these new standards.”
Have you observed an increase in cyberattacks or a shift in attack techniques targeting public sector bodies in recent months? If so, how are these threats changing?
“AI is a double-edged sword when it comes to cybersecurity.
“The bad guys aren't just sending out automated phishing emails anymore; they're launching complex, ‘agentic’ attacks.
“Plus, AI is making it remarkably easy to create totally convincing fake voices and videos for social engineering scams.
“On top of that, we're seeing a massive flood of attacks, from simple stuff to those really advanced, AI-powered operations.”
Stew Parkin, global CTO, Assured Data Protection
What are the most pressing cybersecurity needs facing public sector organisations right now?
“The most pressing need is to stop sweating legacy assets in environments that no longer resemble the world they were designed for.
“Identity-centric attacks, ransomware, and data extortion all assume modern infrastructure and weak recovery posture.
“Yet many organisations are forced to extend the life of platforms well beyond their security usefulness.
“Recovery, resilience, and regular testing are still underfunded compared to prevention, even though incidents are now assumed rather than hypothetical.”
Does the action plan reflect what you’re hearing from public sector customers?
“It reflects the diagnosis, but not always the root cause. Public sector teams are acutely aware of their risks and priorities.
“What’s often overlooked is how procurement cycles, framework limitations, and annual budgeting prevent them from keeping pace with attackers who don’t have those constraints.
“Without meaningful reform in how cyber capabilities are funded and purchased, plans risk describing the problem repeatedly rather than fixing it.”
Have you observed changes in attack techniques targeting public sector bodies?
“Yes, attackers are exploiting exactly these structural weaknesses.
“We’re seeing more identity compromise, slower and more deliberate intrusions, and attacks designed to evade legacy detection tooling.
“These techniques assume defenders are constrained, understaffed, and slow to modernise - which is why improving recovery capability and operational resilience is becoming more important than chasing perfect prevention.”
Jonny Scott, head of cyber advisory, Phoenix Software
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“One of the most pressing needs is improving basic resilience at scale.
“Many organisations are still dealing with legacy systems, stretched teams and fragmented security tooling, which makes it difficult to respond quickly to incidents.
“The greatest gaps tend to be around consistent incident response planning, supply-chain risk management, and the ability to maintain continuous visibility of threats across complex environments.
“Addressing these gaps often requires a combination of people, process and technology, rather than any single solution.”
Does the action plan reflect what you are hearing from public sector customers about their security priorities, or are there areas you feel have been overlooked?
“Broadly, the action plan aligns well with what we are hearing from public sector customers.
“There is a strong focus on resilience, coordination and reducing systemic risk, all of which are recurring themes in customer conversations.
“If there is one area that will need ongoing attention, it is ensuring that smaller organisations and local bodies are able to keep pace with national ambitions.
“Clear guidance, practical support, and sustainable funding models will be essential to avoid widening the gap between well-resourced and under-resourced organisations.”
Have you observed an increase in cyberattacks or a shift in attack techniques targeting public sector bodies in recent months? If so, how are these threats changing?
“We continue to see a steady increase in both the volume and sophistication of attacks targeting public sector organisations.
“While ransomware and phishing remain prevalent, there is a noticeable shift towards attacks that exploit trusted relationships, third-party suppliers, and identity weaknesses.
“Attackers are also becoming faster and more opportunistic, often utilising multiple techniques to maximise impact.
“This reinforces the need for strong fundamentals, good visibility, and rehearsed response plans, rather than relying solely on perimeter-based defences.”
Mark Darrah, CTO, Arc
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“The most pressing cybersecurity needs facing public sector organisations are around legacy systems and, specifically, the amount of these systems that cause multiple security holes allowing for breaches due to the overhead of security admin.
“Heavy consolidation and modernisation of the IT systems used within the sector need review and migration.
“Hiring of cyber security experts is also a huge issue in this sector and many should look to outsourced businesses such as Arc to help support them rather than relying on individuals, which are a single point of failure.”
Does the action plan reflect what you are hearing from public sector customers about their security priorities, or are there areas you feel have been overlooked?
“I do think the plan is a great step forward and it has been well thought out.
“I think the biggest thing that has been overlooked is the fact this is not only a public sector issue - private and public sector planning needs to align, too.”
Have you observed an increase in cyberattacks or a shift in attack techniques targeting public sector bodies in recent months? If so, how are these threats changing?
“Over the last year, threats continue to be high in all sectors and attack techniques have increased across the board, especially with 'ransomware as a service' and new AI techniques.”
Paul Mardling, CTO, Redcentric
What are the most pressing cybersecurity needs facing public sector organisations at the moment? Where do you see the greatest gaps in capability?
“The needs in the public sector are mirrored by that of the private sector, the difference often being the political and societal risks involved in any attack.
“Ensuring the outputs of this plan are central to board conversations and the right capabilities and accountabilities are put in place to move to more pro-active management will be vital.
“Scale is another obvious differentiator from many commercial organisations, as we look for more frictionless services across the public sector, this involves connecting more data sources, therefore increasing the risk profile at a central level.”