Experts have reacted to the news that the UK has suffered an average of four nationally significant cyber incidents each week for the past year with calls for business leaders to act.

The figure was disclosed by the National Cyber Security Centre (NCSC) in its latest Annual Review. The UK’s cyber agency, a part of GCHQ, has revealed that the cyber threats facing the UK continue to escalate. The NCSC revealed it dealt with 204 ‘nationally significant’ cyber-attacks against the UK in the 12 months to August 2025 – a sharp rise from 89 in the previous year.

Of a total of 429 incidents handled, 18 were categorised as ‘highly significant’, meaning that they had the potential to have a serious impact on essential services. This marks an almost 50% increase on incidents of this second-highest level categorisation compared with the previous year, and an increase for the third year running.

A substantial proportion of all incidents handled by the NCSC last year were linked to Advanced Persistent Threat (APT) actors – either nation-state actors or highly capable criminal groups.
Dr Richard Horne, Chief Executive of the NCSC, said: “Cyber security is now a matter of business survival and national resilience.

“With over half the incidents handled by the NCSC deemed to be nationally significant, and a 50% rise in highly significant attacks on last year, our collective exposure to serious impacts is growing at an alarming pace.

“The best way to defend against these attacks is for organisations to make themselves as hard a target as possible.
“That demands urgency from every business leader: hesitation is a vulnerability, and the future of their business depends on the action they take today. The time to act is now”.

In response to the rising threat and in the wake of high-profile cyber incidents, the UK government has written to chief executives and chairs of leading businesses – including all FTSE350 companies – highlighting the importance of government and business working hand in hand to protect the UK economy and make cyber resilience a Board-level responsibility.

The report added:  “Highly significant incidents represent an even more serious threat, often requiring a coordinated cross-government response due to their potential to cause widespread disruption or long-term damage to national interests.”

Experts were quick to highlight the threats and to urge businesses to renew their efforts to increase cyber security.

Monica Landen, CISO at Diligent said: “The board’s role in cybersecurity isn’t to be technical experts, it’s to be stewards of risk, reputation, and resilience. Cybersecurity is no longer just an IT issue; it’s a boardroom necessity.

“That means ensuring cyber risk is embedded into enterprise risk management, that incident response plans are tested and resourced, and that leadership is empowered to act decisively. In a crisis, the board must provide stability, clarity, and oversight on legal, regulatory, and stakeholder obligations.

“But their job doesn’t end when the headlines fade. Boards must insist on rigorous post-incident reviews and make sure lessons are translated into action. Ultimately, the board’s role is to champion a culture of resilience: before, during, and after the storm”

As the NCSC warned that cyber security has become a matter of national resilience, Toby Gasston, principal product manager at Wireless Logic, added: “The UK being under near-constant cyber-attack comes as no surprise. As industries digitise, their most critical functions increasingly depend on connected devices and IoT infrastructure. This growing reliance expands the threat surface and demands a new level of vigilance, along with recognition that it brings vulnerabilities which can no longer be ignored.

“From energy and healthcare to retail and manufacturing, connected devices now form the backbone of daily operations. They control heating and power, monitor patients and optimise production lines. Yet many still sit outside traditional IT perimeters, creating blind spots where attackers can move unseen. With thousands or even millions of endpoints across supply chains, the challenge isn’t securing a single device but the entire network that connects them. The government is right to call for board-level focus – cyber resilience has become a strategic imperative.

“The way we think about IoT security must evolve from piecemeal protection to built-in resilience. Secure-by-design connectivity, supported by strong authentication, anomaly detection and continuous visibility, ensures every device on a network is identifiable and protected from compromise. It’s the only sustainable way to safeguard the UK’s connected economy against the kind of large-scale disruption the NCSC is warning about.”

Marc Jones, regional director of UK & Ireland at Armis on NCSC’s warning over threat posed by nation states: “The usual suspects – China, Russia, and North Korea – remain serious cyber threats, with 74% of UK IT leaders identifying China and 71% citing Russia as top concerns. But GenAI is shifting the balance – arming smaller nations to develop more advanced capabilities. With 66% of UK IT leaders believing AI is reshaping global power dynamics and 71% worried about AI-driven nation-state attacks, organisations must take the threat posed by states of all sizes seriously. This requires true cyber resilience, which begins with understanding and managing their own cyber exposure.”

xt