Unpacking the UK’s new Cyber Action Plan and what it means for security

The UK government has launched a £210 million Cyber Action Plan to tighten security around online public services and critical infrastructure. A new central Cyber Unit will lead the work, aiming to give government departments and the wider public sector a clearer view of cyber risk, faster incident response, and more consistent standards. The timing aligns with the proposed Cyber Security and Resilience Bill, which would set firmer expectations for any business providing services to government, from data centres to healthcare, energy and water.

Alongside the plan, ministers are pushing closer collaboration between the public sector and industry. A new voluntary Software Security Ambassador Scheme is intended to promote the Software Security Code of Practice and reduce software supply chain attacks, with companies such as Cisco, Palo Alto Networks, Sage, Santander and NCC Group signed up as ambassadors. The strategy leans on shared intelligence, secure development practices and greater accountability for fixing vulnerabilities, with automation and AI framed as support tools rather than substitutes for people and process.