The UK government’s newly published Cyber Growth Action Plan represents an ambitious and much-needed strategic framework for addressing one of the most pressing challenges facing Britain’s digital economy. This comprehensive review, conducted by the University of Bristol and Imperial College London, deserves recognition for its depth of consultation and practical focus on connecting cyber security growth with national resilience.
What the report gets right
The report’s core insight is compelling: cyber security shouldn’t be viewed merely as a cost centre, but as an economic enabler. By framing cyber resilience as essential infrastructure for broader economic growth, the plan moves beyond defensive posturing to recognise the sector’s multiplier effects across the economy.
Three pillars stand out as particularly well-conceived:
Leadership and coordination. The proposed appointment of a UK Cyber Growth Leader and place-based leaders addresses a genuine fragmentation problem. Britain’s cyber community is talented but dispersed and creating focal points for coordination could unlock significant synergies.
The principle of “acting as one team.” This acknowledgment that government, industry, academia and civil society must collaborate rather than operate in silos reflects mature strategic thinking.
Recognition of the demand problem. Too many organisations still don’t prioritise cyber security fundamentals. The plan’s emphasis on stimulating informed demand through mandated standards like Cyber Essentials, coupled with better corporate reporting on cyber risks, addresses a market failure that has plagued the sector for years.
Areas of legitimate concern
However, several aspects warrant careful scrutiny and debate:
Resource commitments remain unclear. While the plan proposes expanding the NCSC’s role “without diverting attention from existing priorities,” this seems optimistic without substantial new funding. The NCSC already operates under significant pressure responding to daily threats. Adding growth responsibilities without commensurate resources risks diluting both missions.
The “picking winners” dilemma. The report advocates selecting a small number of Cyber Growth Centres in specific places, focusing on distinct technology areas. While concentration can drive excellence, this approach inevitably excludes regions and businesses. The plan acknowledges this but doesn’t fully address how to prevent creating a two-tier ecosystem where areas outside chosen centres struggle to access support.
Procurement reform lacks teeth. Despite recognising that government procurement creates structural barriers for SMEs, the suggestions remain relatively modest. The fundamental tension between risk-averse procurement processes and the need to support innovative startups isn’t resolved – it’s merely acknowledged and slightly adjusted.
The balance between regulation and burden. Mandating Cyber Essentials across more supply chains could drive much-needed improvement, but the plan doesn’t fully grapple with implementation capacity. As the report itself notes: “there is no point mandating higher standards of security if most organisations do not have the knowledge or capacity to meet them.” The skills gap and the regulatory expansion risk operating at different speeds.
Civil society engagement remains underdeveloped. While Recommendation 3 calls for fostering public participation, the mechanisms for achieving this are vague. Cyber security has an image problem and a mystification problem. Moving beyond “bolt-on” educational initiatives to genuine public engagement requires more concrete proposals than those offered.
The fundamental challenge
The plan rests on an assumption that may prove its greatest vulnerability: that informed demand can be stimulated through guidance, regulation and reporting requirements. But decades of cyber security policy suggest that organisations often know what they should do – they simply don’t do it until forced by incident or regulation.
The virtuous cycle the plan envisions, where better security enables growth, which funds more security innovation, depends on breaking the pattern where cyber remains an afterthought until disaster strikes. Whether guidance and mandates can achieve this cultural shift, or whether more fundamental interventions are needed, remains an open question.
A starting point, not a destination
This growth plan should be commended as a serious attempt to move beyond reactive cyber policy. The depth of consultation, the honest acknowledgment of market failures and the emphasis on coordination represent genuine progress.
However, implementation will be everything. The proof will lie in whether promised leadership roles receive genuine authority and resources, whether procurement reform actually happens rather than being studied further and whether the “act as one team” principle survives contact with departmental budgets and competing priorities.
The government deserves credit for commissioning this work and for the comprehensiveness of the analysis. The challenge now is to ensure the recommendations don’t become another well-intentioned strategy document that gathers dust while cyber threats continue to evolve faster than policy can respond.
The UK’s cyber future depends on turning these 24 suggestions and 9 recommendations into measurable action – with the courage to fund them properly and the discipline to hold all stakeholders accountable for delivery.
