UK Businesses Grapple with Worsening Cybersecurity Skills Gap
A significant majority of UK businesses report a lack of confidence in basic cybersecurity skills, a trend that has worsened over the past year, according to a government survey.
A recent UK government survey has revealed a concerning trend: over half of the nation's businesses, precisely 57 percent, now lack confidence in their ability to perform fundamental cybersecurity tasks. This figure represents an increase from the previous year's 49 percent, despite ongoing efforts to bolster national cyber resilience and repeated government advisories. The skills gap affects an estimated 808,000 businesses, highlighting a widespread vulnerability across the UK's commercial landscape.
The survey identified nine basic technical skills crucial for cybersecurity, including secure data storage, firewall configuration, and malware detection and removal. The findings indicate that a substantial portion of businesses struggle with these core competencies. While the researchers suggest this increase might stem from heightened awareness due to recent high-profile breaches prompting closer scrutiny of security postures, the underlying issue of insufficient skills remains.
Malware detection and removal emerged as the most significant challenge, with 38 percent of businesses, 47 percent of charities, and 23 percent of public sector organizations expressing low confidence in their ability to handle such threats. Experts point to the rapid evolution of malware, increasingly aided by AI, as a key factor making detection more difficult. This evolving threat landscape demands constant vigilance and up-to-date expertise, which may be lacking in organizations where cybersecurity is not a dedicated role.
Compounding the skills shortage are resource limitations and increasingly complex IT environments. As businesses adopt cloud infrastructure, SaaS platforms, APIs, and manage a growing number of identities, maintaining consistent security fundamentals becomes a formidable task. Cybersecurity consultants draw parallels to vehicle maintenance, suggesting that advanced security features are ineffective if basic elements like tire pressure or windshield visibility are neglected.
Charities, in particular, reported the widest skills gaps across most measured areas, though businesses showed less confidence in securely handling personal data. Even the public sector, which generally scored better, saw its basic skills gap nearly double from 14 percent to 27 percent, despite documented weaknesses in critical government systems and recent high-profile incidents affecting agencies like the NHS and the Foreign Office.
In response, the UK government has launched initiatives such as the £210 million Cyber Action Plan to strengthen central government systems and is progressing with the Cyber Security and Resilience Bill. This legislation aims to impose stricter security requirements on operators of essential services and their supply chains. However, experts argue that regulation alone may not suffice for smaller entities.
Practical, affordable support tailored to the needs of small businesses and charities is deemed essential to bridge the skills gap. This could involve accessible managed services, simplified security tools, or incentives from insurers to make baseline security more attainable. Without such measures, the UK's overall cyber resilience remains compromised, leaving it more susceptible to breaches and slower to recover.
The widening gap in basic cybersecurity proficiency poses a significant risk to the UK economy, making it easier for threat actors to exploit vulnerabilities and harder for organizations to defend themselves and recover from attacks. Addressing this fundamental skills deficit is crucial for enhancing national cyber resilience.