There’s a line in the Security Minister’s speech to CYBERUK 2026 that’s easy to miss, but it changes the whole conversation:
“The cyber security of British business is a matter of national security.”
Not “important”. Not “good practice”. National security.
I’ve sat with plenty of small businesses across Chesterfield, Sheffield and beyond, and most don’t see themselves anywhere near that conversation.
They’re thinking about invoices, staffing, getting through the week.
Meanwhile, the threat actors the Minister talks about aren’t thinking small at all.
They’re thinking:
- supply chains
- identity access
- weak entry points
- fast wins
That gap, between how businesses see themselves and how attackers see them, is where most problems start.
What struck me about this speech wasn’t the AI headlines.
It was the comparison to Glasgow’s past.
Cullen didn’t wait for food to rot before inventing refrigeration.
Lister didn’t accept infection as inevitable.
Gale didn’t wait for outbreaks before fixing water systems.
They built systems that stopped the problem showing up in the first place.
That’s the bit we still haven’t fully embraced in cyber.
Most organisations are still set up to react.
Alerts come in.
Something looks odd.
Someone checks it.
That worked when threats moved at human speed.
It doesn’t work when:
- attacks are automated
- credentials are sold in minutes
- AI is finding weaknesses faster than teams can patch them
You can’t investigate your way out of a machine-speed problem.
The government is putting £90m behind resilience.
There’s a Cyber Resilience Pledge coming.
Cyber Essentials is being pushed harder.
All good moves. But the speech is clear on one uncomfortable truth:
Government can set the standard. It can’t make the decision for you.
That still sits with the business owner, the board, the leadership team.
Here’s what I’m seeing on the ground right now:
- Microsoft 365 accounts protected by MFA… but no visibility of suspicious sign-ins
- Email filtering in place… but targeted phishing still getting through
- Backups configured… but never tested under pressure
- Security tools deployed… but nobody watching them
Nothing obviously “broken”, but plenty that can be quietly worked around.
Exactly the kind of gaps attackers love to exploit.
The AI piece matters, but not in the way most headlines frame it. Yes, it’s making attacks faster and easier. But it’s also exposing something we’ve ignored for years:
We’ve been relying on people and process to compensate for a lack of visibility and response.
That doesn’t scale anymore.
The “Clyde-built” idea in the speech is a good way to think about this.
It wasn’t just about building ships. It was about building to a standard.
Cyber needs the same shift.
Not:
- “We’ve got antivirus”
- “We’ve turned MFA on”
But:
“We know what’s happening in our environment and we can act on it quickly.”
The bit I agreed with most was the closing message:
whether you are a sole trader or a multinational – you are part of our national defence
That’s not political language. It’s operational reality.
Most attacks don’t start with critical national infrastructure.
They start with:
- a small supplier
- a compromised inbox
- a reused password
- a rushed decision
And they work their way in from there.
If there’s one takeaway from this speech, it’s this:
Cyber security isn’t an IT upgrade anymore. It’s part of how your business stays operational.
Same as cash flow.
Same as staffing.
Same as health and safety.
And the businesses that get ahead of this? They’re not the ones buying the most tools.
They’re the ones quietly building systems that:
- reduce the chance of something going wrong
- spot issues early
- respond properly when they do
That’s what resilience actually looks like.
Not headlines. Not hype. Just fewer bad days.
