Loading story…
The UK government advanced its Cyber Security and Resilience Bill after publishing policy materials in 2024 and formally introducing the legislation to Parliament in November 2025, later adding an impact assessment, factsheets, supporting research, and notice that the Regulatory Policy Committee rated the assessment fit for purpose. The bill is part of a broader push to strengthen cyber resilience obligations as the government also signaled tougher online safety enforcement and wider expectations that critical services and digital platforms improve security governance.
Government survey data published in 2026 showed why the pressure is increasing: 43% of UK businesses and 28% of charities reported a cyber breach or attack in the previous year, with phishing remaining the most common and disruptive threat. While ransomware among businesses fell to 1%, the survey found repeat victimisation drove an estimated 5.19 million cyber crimes against UK businesses, and more advanced controls such as two-factor authentication, formal incident response plans, VPN use, and supplier risk reviews remained uneven, especially among smaller organisations. Industry reporting said the findings are sharpening focus on resilience measures including Cyber Essentials Plus, phishing-resistant MFA, network segmentation, tested backups, dependency mapping, and board-level reporting on recovery and operational survivability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The UK government published the Cyber Security Breaches Survey 2025/2026, reporting that 43% of businesses and 28% of charities identified a cyber security breach or attack in the previous 12 months, with phishing remaining the most common and disruptive attack type.
Fieldwork for the UK Cyber Security Breaches Survey 2025/2026 was conducted between August and December 2025 to assess cyber resilience among UK businesses and charities.
The UK government published a news announcement stating it was taking action to keep children safe online, framed by the Prime Minister's statement that no platform would get a free pass.
The GOV.UK bill page was updated to note that the Regulatory Policy Committee had rated the Cyber Security and Resilience Bill's impact assessment as fit for purpose, with a green rating.
The UK government's Cyber Security and Resilience Bill was introduced to Parliament, and the related GOV.UK page was updated with links to the Parliament bill page, impact assessment, factsheets, and supporting research.
The UK government first published its Cyber Security and Resilience Bill collection page, establishing a central location for policy and supporting materials related to the proposed legislation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcegov.uk
Open sourcegov.uk
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has introduced the Cyber Security and Resilience (CSR) Bill to Parliament, representing a major update to national cybersecurity legislation. The bill expands the scope of regulated entities to include datacenters and managed service providers (MSPs), in addition to existing coverage of operators of essential services such as healthcare, energy, transport, water, and digital service providers. The legislation aims to ensure these sectors meet robust cybersecurity standards, with new rules also extending to organizations overseeing smart appliances like electric vehicle charging points and smart heating systems. The CSR Bill grants ministers emergency powers to intervene during major cyber incidents and imposes stricter compliance requirements, including mandatory reporting of significant cyber incidents within 24 hours. Non-compliant organizations face substantial penalties, including daily fines up to £100,000 or turnover-based penalties, marking a shift toward enforcement that scales with organizational impact. The bill is expected to receive Royal Assent in 2026 and is positioned as a key component of the UK’s strategy to strengthen national resilience and protect critical infrastructure from evolving cyber threats.
Jun 30, 2026
UK reporting highlighted persistent weaknesses in baseline cyber hygiene and a growing expectation that **phishing and social engineering** will succeed against many organizations. A Vodafone Business-commissioned snapshot cited by Tech Radar/SC Media reported that **63% of UK businesses** feel more exposed to cyberattacks than a year ago, **71% of leaders** think employees are vulnerable to phishing, and staff reuse work passwords across an average of **11 personal accounts**; only **45%** of organizations said all staff had completed basic cyber awareness training. The same coverage noted increasing concern about **AI-enabled scams and deepfakes**, with **70%** reporting greater suspicion of video calls impersonating senior leaders, and pointed to the UK government’s planned *Telecommunications Fraud Charter* as part of broader anti-fraud efforts. Separately, the Bank of England’s 2025 CBEST review (summarized by The Register) found that regulated financial firms and **financial market infrastructures (FMIs)** still commonly fail on fundamentals observed during **13 CBEST assessments and regulator-backed penetration tests**, including **weak access controls**, poor password practices, **misconfigured and inconsistently patched systems**, and gaps in **intrusion detection** and vulnerability management. The report emphasized that firms should be prepared to **handle breaches** rather than relying only on preventive controls, and that weak security culture enables attackers to bypass controls via social engineering; it also warned that inadequate helpdesk identity-verification processes can enable fraudulent credential access, with the NCSC noting such tradecraft aligns with groups like **Scattered Spider**.
Jul 12, 2026
The UK government has launched a voluntary **Cyber Resilience Pledge** at 10 Downing Street, asking companies to elevate cybersecurity to a board-level responsibility, enroll in the National Cyber Security Centre’s **Early Warning** service, and push suppliers toward **Cyber Essentials** certification or an equivalent baseline. The initiative includes a 30/60/90-day timetable for organizations to register for warning services, assess supplier coverage, and implement the Cyber Governance Code of Practice with annual board training. More than 60 organizations signed at launch, including over 20 of the government’s 39 strategic suppliers and companies such as Aviva, London Stock Exchange Group, Marks & Spencer, and Capita. The rollout drew scrutiny because uptake among major British firms was limited, with fewer than 15 **FTSE 350** companies joining despite ministers having written to every FTSE 350 chair and chief executive months earlier. The pledge has no enforcement mechanism, raising questions about whether it is primarily a public commitment ahead of possible future regulation through the proposed **Cyber Security and Resilience Bill**. The launch comes as cyber incidents continue to rise in the UK, with attacks estimated to cost organizations **£14.7 billion annually** and the NCSC reporting **204 nationally significant incidents** in the year to September 2025, up from 89 the previous year.
Jul 9, 2026