When the NCSC Says Act Now, Boards Should Listen

The context

A gap that is widening, not closing

The NCSC’s Annual Review 2025 identifies a widening gap between the rising NCSC severe cyber threat levels and UK resilience. Boards and leadership teams should pause on that phrase before moving to the next agenda item. It is not a polite warning from a government agency doing its job. It means that the UK is moving in the wrong direction, despite years of cybersecurity investment across UK organisations.

The NCSC’s characterisation of what it calls “severe cyber threat” is specific and worth understanding precisely.

This is not the routine cyber activity that every organisation now accepts as background noise. Severe cyber threat refers to highly capable actors, state-aligned and otherwise, whose intent and capability to cause real operational disruption to organisations of national economic significance are increasing. Extended downtime. Significant financial loss. Long-term reputational damage. Risks to public safety and national security.

That last category, risks to public safety, is the one that tends to make board members sit up. Cyber incidents at energy providers, transport operators, healthcare systems, and financial institutions do not stay contained within the organisation. They spread outwards, affecting people who have no visibility of the organisation’s security posture at all.

The strategic shift: The threat is widening, not slowing

Resilience is not the same as prevention

One of the most important signals in the NCSC’s guidance is the explicit framing of resilience over prevention. This is a meaningful shift in emphasis that organisations need to internalise.

For years, cybersecurity investment has been focused on defence. Build stronger walls, reduce attack surface, detect threats earlier. That work remains essential and should continue. But the NCSC is now saying clearly that prevention alone is not sufficient. Organisations must build the capability to continue operating through disruption, not just to avoid it.

This has practical implications. It means mapping and understanding your most critical systems. Not in theory. In practice: what happens if those systems were degraded or taken offline? It means planning how operations would continue if IT or OT systems were unavailable. It means rehearsing defensive actions like network segmentation, isolation, and system rebuilds under pressure. These capabilities must exist before a crisis, not be built during one.

The NCSC is direct about the cost of inaction. Measures that are complex to implement under normal conditions become impossible to implement under pressure. That is the real risk of inaction. Not that something bad might happen, but that when it does, the organisation will not be able to respond effectively because it never built the capability to do so.

The leadership question

Who owns this in your organisation?

The NCSC frames severe cyber threat explicitly as a leadership responsibility. Not a technology responsibility, not an IT department responsibility. A leadership responsibility. This distinction matters. It changes where accountability sits and what adequate preparation looks like.

Adequate preparation, in the NCSC’s framing, requires clear commitment from the organisation’s leaders. It requires organisation-wide collaboration rather than a security function operating in isolation. It requires engagement with suppliers and partners, because supply chain vulnerabilities are consistently among the most exploited vectors in significant cyber incidents.  It requires advance planning. Not reactive planning, but deliberate, rehearsed, tested planning that has been invested in before the pressure arrives.

From a commercial perspective, I would add one further dimension. The CAF is the NCSC’s Cyber Assessment Framework. It provides a baseline for cyber resilience under normal operating conditions. The new guidance specifically asks organisations to revisit those CAF principles through the lens of severe cyber threat. An organisation may satisfy CAF expectations in normal conditions but may not have fully considered how its risk profile and required response would change under sustained, high-capability attack.  If that gap exists, it is worth finding and addressing it now rather than discovering it mid-incident.

The Northdoor perspective

What this means for organisations we work with

At Northdoor, we work with organisations across financial services, the public sector, healthcare, and critical infrastructure. Many fall within the NCSC’s definition of organisations of national economic significance. The guidance is consistent with conversations we have had with clients over time. It adds urgency and executive-level authority to those discussions.

The organisations we see handling cyber risk most effectively share a common characteristic. They treat resilience as a business continuity question, not a technology question. Their boards understand critical dependencies. Their leadership teams make decisions in advance about the trade-offs they would accept between security and operational continuity under different threat scenarios. Their incident response plans have been tested, and the people responsible for executing them know exactly what their role is.

The organisations most exposed are those in which cyber risk sits primarily with the IT function. Where the board receives periodic updates without genuine engagement, and where resilience planning exists on paper but has not been operationalised or tested. The gap between those two positions is not primarily a technology gap. It is a governance gap that leadership decisions can close.

The NCSC’s message is clear, and I think it is correct: the time to close that gap is now, not when an incident is already underway.

AJ Thompson – Personal viewpoint

My take: What I think boards are still getting wrong

The NCSC’s guidance is well-crafted, and its message is correct. But I want to be direct about something that the formal guidance, understandably, does not say: the reason most organisations are not adequately prepared for severe cyber threat is not primarily a lack of information. It is a governance problem. Specifically, the persistent tendency to treat cyber risk as a technology problem rather than a leadership problem.

I sit in conversations with boards and senior leadership teams regularly, and I see the same pattern.

Cyber risk appears on the agenda, presented by the CISO or IT director, acknowledged, and moved past. The board receives assurance that measures are in place, notes that the budget has been approved, and proceeds to the next item. What rarely happens is genuine board-level engagement with what those measures actually protect against, what they leave exposed, and what the organisation would actually do in the first 24 hours of a severe incident.

The NCSC is right that preparation requires clear commitment from the organisation’s leaders. But commitment is a specific thing. It is not approving a cybersecurity budget line. It is not receiving a quarterly update.

It is the board understanding, in operational terms, what the organisation’s critical dependencies are, what the decision-making authorities are under different threat scenarios, and what trade-offs between security and continuity it has already made, so that those decisions do not need to be made for the first time under pressure.

The AI dimension deserves more attention.

The other thing I would add is this: the AI dimension of the NCSC’s warning deserves more attention than it typically receives. The guidance notes that frontier AI risks increasing the speed, scale, and ease of attacks. This is not speculative. AI is already being used to craft more convincing phishing campaigns, to accelerate vulnerability discovery, and to automate attack sequences that previously required significant human skill. The asymmetry between attacker capability and defender readiness is shifting — and it is shifting faster than most organisations’ cybersecurity strategies have adapted to.

The framing change matters

The organisations I see responding most effectively are those where the CEO and board have made a deliberate choice to treat cyber resilience as a strategic business priority — not a compliance function, not a technology investment, but a genuine operational capability that sits alongside financial resilience and business continuity planning as a leadership responsibility.

That framing changes everything: the questions asked, the resources committed, the decisions made in advance.

The NCSC’s message is that the time to act is now. I agree, and I would add that acting now means the board making decisions, not delegating them.