Report urges cyber resilience rethink for UK critical infrastructure
A Filigran report says 84% of cyberattacks exploit known but unprioritized risks and urges the UK to put cybersecurity at the core of its critical infrastructure plans.
The report argues that the threat landscape demands a new approach. Energy providers, water companies, transport operators, and healthcare organizations sit at the center of complex digital ecosystems, and their ability to deliver essential services depends on thousands of suppliers, technology vendors, and third parties. When one organization is compromised, the effects can spread well beyond its own network. As examples, the report cites the SolarWinds attack, in which attackers compromised trusted software updates to gain access to thousands of organizations worldwide, and the ransomware attack on Synnovis, which disrupted pathology services across several NHS trusts, leading to cancelled operations, delayed appointments, and widespread disruption to patient care. Neither incident remained confined to the initially compromised organization, showing that critical infrastructure now depends on interconnected supply chains as much as physical assets.
Filigran's head of public sector for EMEA said in the article that public ownership does not make cyber risk disappear; if anything, it raises expectations that essential services will be more resilient, coordinated, and better prepared to withstand disruption. The report suggests that existing security programs are showing their limitations. Organizations have invested heavily in detection technologies, vulnerability management platforms, and threat intelligence feeds, yet many still struggle to translate the collected information into confident operational decisions. The cybersecurity industry has spent years focusing on visibility, assuming that discovering every vulnerability and collecting every threat feed will naturally lead to better security. The evidence suggests otherwise. Security teams are surrounded by alerts, vulnerability reports, and intelligence updates, and without context, everything starts to look important. Analysts spend valuable time investigating issues that may never be exploited while genuinely dangerous attack paths remain hidden among the noise.
The report argues that threat intelligence should shape decisions long before an incident. Every hour spent investigating a low-priority issue is an hour that cannot be spent reducing real business risk. Organizations are not simply overwhelmed by the volume of information; they are overwhelmed by the number of decisions they are expected to make every day. The report recommends moving beyond isolated security programs towards a model where organizations share intelligence, understand common risks, and coordinate their responses before disruption spreads. If the UK government is serious about strengthening national infrastructure, cybersecurity must become part of the conversation from day one, ensuring that resilience is built on understanding and managing the relationships between organizations rather than protecting individual estates in isolation.