UK public sector unprepared for cyber-attacks, survey reveals

Research from Trend Micro has highlighted significant weaknesses in cybersecurity defences across the UK public sector, with six in ten IT leaders considering a successful cyber-attack to be inevitable.

Survey findings

The survey, conducted by Opinion Matters on behalf of Trend Micro, engaged 250 IT decision-makers with direct cybersecurity responsibilities in public sector organisations, including 100 from healthcare. The findings show that 60% of those surveyed believe that a cyber-attack is "only a matter of time", citing that cybercriminal tactics are outpacing internal capabilities and expertise.

Phishing attacks are seen as the most significant threat over the next two years, with 60% of respondents selecting it as their primary concern. Ransomware follows, with 41% indicating it as a major risk. These figures suggest that many public sector IT leaders perceive external malicious activity as the greatest threat to organisational security.

Reactive posture

The research points to a predominantly reactive approach within the sector. Nearly one third (31%) acknowledge their organisations are exposed because they lack proactive threat hunting and risk management strategies. When questioned about breach detection, almost a quarter (24%) admitted it would take between one and three days to identify a ransomware attack, with the average response time being one day and six hours.

Jonathan Lee, UK Cybersecurity Director, Trend Micro, said:

"The public sector continues to be a prime target for threat actors, from exploiting weaknesses with NHS suppliers to steal patient data, to infiltrating The British Library to capture 600GB of data. We don't know if the Government's proposed ban on ransomware payments will curb such activity, and in the meantime, gangs have a steady supply of victims capable of paying up. This underscores the urgent need to make cybersecurity a priority, with more investment in culture and technologies. As government systems evolve, often built on legacy infrastructure, they remain vulnerable, and no organisation can afford to treat cybersecurity as an afterthought. When 60% of IT decision-makers tell us that a successful cyber-attack is "only a matter of time", the real question is no longer if an attack will happen, but how well-prepared we are when it does."

Workforce and culture

The findings highlight that internal practices and culture are contributing to vulnerabilities. 42% of IT leaders identified that an absence of a "cybersecurity-first" culture across the workforce is a key issue. Employees intentionally bypassing security protocols, even after receiving cyber training, was highlighted by 47% of respondents, while 39% noted human error as a significant factor in everyday risk.

The disconnect between security awareness and practical implementation appears to be a persistent problem, which suggests that current training programmes are viewed more as compliance obligations rather than effective tools for cyber risk reduction.

Resources and strategy

Almost half of the public sector IT leaders surveyed (49%) reported that the pressure of dealing with daily threats prevents them from focusing on developing long-term cybersecurity strategies. This overwhelming workload not only limits the capacity for proactive risk management but also restricts planning and investment for future cyber resilience.

By 2027, 38% of organisations surveyed plan to implement advanced technologies, including Generative AI, to improve their ability to detect and respond to threats. The study indicates a growing recognition within the sector that existing defences may not be sufficient to address increasingly sophisticated threats.

Background and scope

The research is published as the UK Government considers a potential ban on ransomware payments in the public sector and seeks to improve the resilience of the national digital infrastructure. The sample for the survey included public sector organisations outside of healthcare, with a broad cross-section represented.

The study was conducted between January 2 and January 14, 2025. Its findings provide a benchmark for evaluating the current state of cybersecurity preparedness across government organisations, at a time when the incidence and impact of cyber-attacks are increasing.