West Midlands Cyber
Join the Cluster

The Perfect Storm

AI, technological acceleration and geopolitical instability are changing the operating environment. Cyber fundamentals remain essential — but organisations differ dramatically in their ability to implement them.

Contents

Table of Contents

CYBERUK 2026: Can Cyber Fundamentals Keep Pace with the Threat?

The case for cyber fundamentals remains strong. Organisations that manage identities properly, patch exposed systems, maintain usable backups, restrict privileges, protect endpoints and prepare for incidents remove many of the opportunities on which attackers continue to depend. The persistence of phishing, credential theft and exploitation of known vulnerabilities gives little reason to abandon those disciplines in favour of more fashionable responses.

CYBERUK 2026 nevertheless exposed a harder question about the environment in which those fundamentals now have to operate. Artificial intelligence is increasing the speed and accessibility of some offensive techniques; geopolitical competition is making cyber operations more strategically consequential; organisations depend on increasingly complex technology and supplier ecosystems; and serious incidents can propagate through shared infrastructure rather than remaining confined to a single victim. The issue is therefore not whether the fundamentals remain valid, but whether organisations can implement them comprehensively enough, and adapt them quickly enough, to keep pace with a changing risk environment.

The originating analysis, CYBERUK 2026: The Perfect Storm and the Limits of Fundamentals, examined the tension between the continuing emphasis on basic cyber hygiene and the increasing complexity of the systems those controls are expected to protect. Recast institutionally, the central proposition is that cyber fundamentals should be understood as a foundation rather than a complete operating model. Their effectiveness depends on organisational capability, the architecture in which they are applied and the ability to respond when preventive controls do not work as intended.

That distinction has particular relevance to the West Midlands. A small professional-services firm, an advanced manufacturer operating connected production equipment and a supplier participating in a defence or automotive supply chain may all benefit from strong baseline controls, but the consequences of failure and the dependencies requiring protection can differ substantially. A regional resilience strategy therefore needs both a stronger baseline and a credible route beyond it for organisations whose operational circumstances demand more.

Key Takeaways

  • The latest UK evidence continues to justify strong cyber fundamentals: phishing was identified by 38% of businesses in 2025/26 and remains the dominant form of recorded attack.
  • Basic controls are widespread but incomplete, with 47% of businesses using two-factor authentication and only 24% reporting controls across all five technical areas associated with Cyber Essentials.
  • AI is altering both attack capability and organisational dependency, while adoption is advancing faster than explicit AI-security governance in many businesses.
  • Nationally significant incidents more than doubled between the NCSC’s 2023–24 and 2024–25 reporting periods, despite the total number of incidents receiving NCSC support remaining almost unchanged.
  • The practical challenge for the West Midlands is to distinguish organisations for which baseline controls are proportionate from those whose operational technology, supply chains or critical dependencies require deeper resilience engineering.

The Evidence Still Supports the Fundamentals

The argument for basic cyber hygiene rests on the continuing prevalence of attack methods that exploit familiar weaknesses. The 2025/26 Cyber Security Breaches Survey found that 43% of businesses had identified a cyber security breach or attack during the preceding year. Phishing was identified by 38% of all businesses, substantially ahead of impersonation attacks at 12% and other categories recorded by the survey. (gov.uk)

These attack patterns explain why the NCSC continues to promote controls covering areas such as authentication, secure configuration, software updates, malware protection, backups and access management. They address recurring mechanisms through which attackers obtain credentials, exploit vulnerable systems or turn an initial compromise into a more damaging incident.

Adoption of several controls is now widespread. In 2025/26, 81% of businesses reported up-to-date malware protection, 74% used secure cloud backups, 74% had password policies, 74% used network firewalls and 73% restricted administrative rights. Those figures demonstrate that basic security practice has become embedded across much of the business population rather than remaining confined to organisations with specialist security teams. (gov.uk)

Coverage becomes less comprehensive when the measures are examined as a system. Two-factor authentication was used by 47% of businesses, while only 24% reported having controls in place across all five technical areas associated with Cyber Essentials. Five per cent held Cyber Essentials certification. The distinction is important because cyber fundamentals derive much of their effectiveness from combination: strong malware protection does not compensate fully for weak identity controls, just as backups cannot prevent an attacker obtaining privileged access.

The problem is therefore not that fundamentals have become obsolete. It is that partial implementation can create a substantial gap between recognising the right controls and maintaining them consistently across an organisation’s technology estate.

Technology Dependency Has Expanded the Baseline

The meaning of a cyber baseline has changed because the systems businesses depend upon have changed. Earlier approaches to cyber hygiene were often centred on identifiable corporate assets: endpoints, servers, networks, user accounts and locally managed software. Contemporary organisations may depend additionally on cloud applications, identity providers, outsourced technology services, remote administration, software supply chains, APIs and platforms operated by third parties.

These dependencies do not invalidate established controls, but they change where those controls need to operate. Identity security, for example, becomes more consequential when a single account can provide access to multiple cloud services. Supplier assurance becomes more important where critical business functions depend on technology outside the organisation’s direct control. Backup strategy becomes more complex when operational data is distributed across software-as-a-service platforms and other hosted environments.

The Cyber Security Breaches Survey shows that governance of these dependencies remains substantially less mature than adoption of basic technical controls. Only 15% of businesses reviewed cyber risks associated with immediate suppliers in 2025/26, and 6% examined their wider supply chain. Among large businesses the figure for immediate suppliers rose to 48%, compared with 12% of micro businesses. (gov.uk)

This produces a structural limitation to a narrowly defined fundamentals approach. An organisation can patch its own devices, maintain backups and enforce strong passwords while remaining operationally dependent on suppliers whose resilience it does not understand. The security baseline therefore increasingly needs to include knowledge of critical external dependencies as well as protection of internally controlled technology.

AI Changes Both Attack Capability and the Systems Being Protected

Artificial intelligence complicates the picture in two different ways. The first concerns offensive capability. The NCSC has assessed that AI will make elements of cyber intrusion more effective and efficient, particularly reconnaissance, vulnerability research, social engineering, malware development and other stages of the attack process. It has also judged that AI will increase the frequency and intensity of cyber threats by lowering barriers to some forms of activity. (ncsc.gov.uk)

This does not mean that AI has replaced conventional attack methods. Its near-term significance is more likely to come from improving the speed, scale or persuasiveness with which established techniques can be used. That strengthens rather than weakens the case for controls such as multi-factor authentication, patching and least privilege because attackers able to automate reconnaissance or improve social engineering still need exploitable pathways into target systems.

The second issue is defensive dependency. The 2025/26 Breaches Survey found that 31% of businesses were using AI, adopting it or actively considering its use. Among that population, only 24% had cyber security practices or processes specifically intended to manage AI-related risks. (gov.uk)

Those figures do not demonstrate that the remaining organisations are necessarily insecure. Many AI risks can be managed partly through existing controls covering data, identity, software and suppliers. They do, however, show that explicit security governance is developing more slowly than adoption.

For businesses integrating AI into engineering, analytics, software development or operational decision-making, the security problem is therefore broader than defending against attackers using AI. Organisations must also understand the models, data, infrastructure and third parties on which their own AI-enabled processes depend. A control framework concerned only with conventional endpoints and networks will increasingly provide an incomplete representation of the environment requiring protection.

Serious Incidents Show a Different Trend from General Prevalence

Business survey data and national incident-response data provide different perspectives on the threat environment. The 2025/26 Breaches Survey found no statistically significant change in overall business prevalence from the preceding year, with 43% identifying a breach or attack. NCSC operational data, however, recorded a substantial change in the severity of incidents reaching national attention.

During the NCSC’s 2024–25 reporting period, 429 incidents required support from its incident-management team, almost identical to the 430 recorded during 2023–24. Within that broadly stable total, the number categorised as nationally significant increased from 89 to 204, while highly significant incidents increased from 12 to 18. (ncsc.gov.uk)

The datasets cannot be compared as if they measure the same population. The Breaches Survey records incidents businesses identify across the economy, while NCSC incident management is concentrated on activity meeting much higher thresholds of consequence. The contrast nevertheless demonstrates why a stable prevalence rate should not be interpreted as evidence that the risk environment itself is static.

Severity is affected by more than attack frequency. Increasing dependence on shared technology providers, digital infrastructure and interconnected supply chains can increase the potential consequence of a successful compromise even if the underlying attack technique is familiar. A relatively conventional intrusion affecting a strategically important supplier can produce consequences far beyond those associated with the same technique against an isolated organisation.

This shifts part of the resilience problem from preventing every attack to preventing individual failures from becoming disproportionately consequential.

Geopolitical Risk Changes the Consequence of Familiar Weaknesses

Cyber security also operates within a geopolitical environment in which state-aligned activity, espionage, disruptive operations and attacks against critical infrastructure have become persistent features. The NCSC has repeatedly highlighted threats from state actors and state-aligned groups alongside ransomware and other financially motivated activity.

For most businesses, this does not imply that they are likely to become the direct target of a sophisticated nation-state operation. The more relevant issue is that geopolitical cyber activity can affect organisations indirectly through technology providers, critical infrastructure, customers and supply chains. Companies can also become targets because of the organisations they supply, the information they hold or their position within strategically important sectors.

This distinction is particularly relevant to industrial regions. An SME participating in an aerospace, defence or advanced-manufacturing supply chain may possess engineering information, customer access or technical relationships that give it significance disproportionate to its own size. The appropriate security posture therefore cannot always be inferred from turnover, headcount or internal IT complexity alone.

Baseline cyber controls remain necessary in such environments because sophisticated attackers also exploit ordinary weaknesses when those weaknesses provide an efficient route to their objective. What changes is the level of confidence required. Organisations facing higher-consequence risks may need stronger monitoring, segmentation, threat-informed defence, incident exercising and supplier assurance in addition to the controls appropriate to the general business population.

Operational Technology Exposes the Limits of a Generic Baseline

The distinction becomes clearest in operational technology. Manufacturing and infrastructure environments often contain equipment whose primary purpose is to control physical processes rather than process information. These systems can have long operational lives, limited maintenance windows and safety or availability requirements that make conventional IT security practices difficult to apply unchanged.

Patching illustrates the problem. Regular security updates are an established cyber fundamental, but an industrial organisation cannot necessarily update production equipment whenever a vulnerability is disclosed. Changes may require vendor approval, compatibility testing or a planned shutdown. Where immediate patching is impractical, resilience depends on compensating controls such as segmentation, restricted access, monitoring and carefully controlled remote maintenance.

The national cyber-sector evidence indicates that this remains a specialist capability. DSIT’s 2026 sectoral analysis identifies SCADA and industrial-control-system security among the capabilities of 7% of UK cyber firms, while industrial and OT security appears in 10% of provider web offerings examined in its market analysis. (gov.uk)

For the West Midlands, this is one of the strongest reasons not to treat cyber fundamentals as a uniform end state. A region with substantial manufacturing and engineering activity contains organisations for which cyber security needs to be integrated with production resilience. The relevant question is not whether fundamentals apply, but how they are adapted where safety, availability and long-lived industrial technology constrain conventional implementation.

Organisational Capability Determines Whether Guidance Becomes Resilience

The effectiveness of any control framework ultimately depends on an organisation’s capacity to implement it. The 2025/26 Breaches Survey provides a useful measure of this gap. Although 72% of businesses regarded cyber security as a high priority for senior management, only 30% had undertaken a cyber security risk assessment during the previous year and 25% had a formal incident-response plan. (gov.uk)

Business size again produces substantial differences. Formal incident-response plans were held by 21% of micro businesses, 57% of medium businesses and 76% of large businesses. The variation indicates that organisations are operating from very different levels of maturity even before more advanced capabilities such as threat intelligence, security monitoring or operational resilience testing are considered. (gov.uk)

This creates a policy problem when guidance assumes that organisations can translate principles into implementation without assistance. Telling a business to manage supply-chain risk, prepare for incidents or secure cloud services is directionally correct, but each requirement can involve technical judgement, procurement decisions and governance processes that smaller organisations may not possess internally.

Regional cyber infrastructure can help reduce that translation gap. Practical support, access to specialist providers, shared learning, university expertise and connections between larger organisations and their suppliers can help businesses identify which controls are genuinely foundational and when their risk profile justifies progressing to more advanced forms of assurance.

A Stronger Baseline Needs a Route Beyond the Baseline

The continuing value of cyber fundamentals should not be confused with the proposition that fundamentals are sufficient for every organisation. The evidence supports a tiered interpretation.

For much of the business population, improving baseline adoption remains a rational priority. Multi-factor authentication is still not universal, Cyber Essentials coverage remains limited and significant numbers of organisations lack formal incident plans. Raising performance in these areas would remove avoidable weaknesses without requiring every SME to build specialist security operations.

The position changes where operational consequence, regulatory exposure or strategic dependency is greater. Organisations running operational technology, providing critical digital services, handling sensitive intellectual property or participating in high-assurance supply chains need to understand risks that cannot be reduced to a checklist of basic controls. In those environments, resilience depends increasingly on architecture, monitoring, testing, recovery, supplier management and the ability to operate through disruption.

The useful distinction is therefore between fundamentals as a minimum level of capability and fundamentals as a complete security strategy. The first remains strongly supported by the evidence; the second becomes progressively less credible as organisational complexity and consequence increase.

The Test Is Whether Fundamentals Scale with Dependency

The central issue raised by CYBERUK 2026 is not whether organisations should move beyond basic cyber hygiene in search of a more sophisticated doctrine. Many still need to implement the basics more consistently, and the persistence of phishing, weak authentication and incomplete incident preparation demonstrates why those controls remain necessary.

The more consequential question is whether the definition of good practice expands as digital dependency expands. An organisation whose principal technology exposure consists of laptops, email and standard cloud services requires a different depth of resilience from a manufacturer whose production environment depends on operational technology, remote maintenance and specialist suppliers. Applying the same baseline to both may provide useful minimum protection, but it cannot produce equivalent confidence in their ability to withstand disruption.

For the West Midlands, this creates a practical basis for regional cyber capability development. The objective should not be to replace nationally recognised fundamentals with a distinctive regional framework. It should be to help organisations implement those fundamentals effectively and then identify where industrial, supply-chain or other higher-consequence environments require additional capability.

That progression provides a more defensible response to a threat environment shaped simultaneously by persistent basic attacks, AI-enabled acceleration, geopolitical uncertainty and increasingly complex technological dependencies. Cyber fundamentals have not lost their relevance. The standard against which they need to operate has become more demanding.