Matt Warman: Why cyber resilience must be a national priority to secure our future | Conservative Home

Matt Warman is the new Chair of the CyberSecurity Business Network and former journalist, digital minister, and MP for Boston and Skegness

What’s the single biggest threat to Britain’s place in the digital world?

It’s not the imperfections of the Online Safety Act, where ultimately the government has tried to make a little progress in the battle to protect children online rather than prioritise free speech absolutism.

It’s not what Artificial Intelligence might bring, nor is it a quantum future or a Russian anchor ‘accidentally’ severing a key internet cable.

Those last two are closer to the truth, however: just as national security must be the top priority of any government, cybersecurity deserves ever greater focus. Hackers know no borders. Cyber increasingly is the first frontier for conflict.

Thankfully, we are, for now, a cyber superpower.

The UK industry has been growing over the years generating £13.2 billion in revenue in the most recent year (a 12 % rise from 2017-2023).With 67,300 people employed full‑time – an increase of about 6,600 jobs (11 %), and investment of £206 million raised across 59 deals in 2024, the sector clearly underpins innovation, attracts capital and fuels good jobs.

All the more reason not to be complacent.

Recent months have shown that cyber attacks can disrupt our largest retailers, leaving supermarket shelves empty and IT systems paralysed; however, these are not isolated events, and food security is not an abstract thing.

So Cyber is no longer just a technical concern.

It is about protecting the resilience of services people use every day, the safety of personal data, and the UK’s ability to lead in an ever more digital world. Getting this right is essential for economic growth, national security, and public trust, in turn making the UK more resilient.

During my time as Digital Minister, I saw first-hand how quickly the threat landscape can shift. When I published the Government Cyber Security Strategy in 2022, our goal was to embed resilience throughout the public sector. But today, the advances in artificialintelligence, quantum computing, and new business models are making the threat landscape more complex.

Cyber criminals are better organised, better funded, and able to exploit weaknesses across borders. There’s an urgent need for enhanced industry collaboration, resilience and the right regulatory approach.

In my current role as Chair of the Cybersecurity Business Network, my focus is on ensuring industry collaboration by linking Government and the industry work together to strengthen the UK’s resilience. The fact is that the government needs – and probably has always needed – to work more closely with the private sector.

There is here an opportunity for the Cybersecurity Industry.

The forthcoming Cyber Security and Resilience (CSR) Bill offers a rare opportunity to modernise our laws for today’s environment. The Bill will embed corporate governance at the heart of corporate decision making, provide legal protection for threat intelligence and empower cyber professionals to address the growing amount of emerging threats.

But there’s a risk: it could lean too heavily on compliance and prevention, and not enough on growth, innovation, and support. A recent report published by the All-Party Parliamentary Group (APPG) for Cyber Innovation has highlighted the cautious optimism of the sector, with 46% of respondents stating that they believed that the CSR Bill will support economic growth, with another 44 per cent seeing its potential to do so.

The message from industry is clear and consistent: Members of Parliament must take the time to listen carefully to those who work in cyber security every day and understand the practical realities they face.

The success of any legislation will ultimately depend on getting the details right – this includes having precise definitions, appropriate thresholds for when incidents must be reported, and clear criteria for compliance and enforcement.

We need legislation that enables businesses to adapt to new threats, establishes straightforward processes for incident reporting, and fosters joined-up thinking across Government, regulators, and the entire cybersecurity industry.

Cyber security must become central to corporate governance, with clear accountability and incentives for continuous improvement.

This is why engagement with Members of Parliament matters.

The last major Government consultation on cybersecurity in 2022 provided a valuable foundation, but the cybersecurity landscape has since evolved dramatically. Technological advances such as quantum computing and artificial intelligence, alongside the introduction of the EU’s NIS2 Directive, have significantly raised regulatory standards across Europe.

To remain competitive and secure, the UK must keep pace by ensuring future policy development is agile, collaborative, and reflective of these rapid changes.

When done correctly, new British laws have the potential to deliver strong and effective protection for the nation’s digital infrastructure while avoiding unnecessary regulatory burdens on businesses and organisations.

However, if the legislation is poorly designed or too rigid, there will be unintended consequences.

For example, while the ambition of the Online Safety Act to protect vulnerable users, especially children, is admirable, it requires businesses to collect more personal data, potentially exposing organisations to new security risks.

So what should MPs and policymakers focus on? Here’s six simple pointers.

First, engage widely: Consult with a variety of voices in the sector throughout the legislative process. The detail matters, and the best insight comes from the front line.

Second, future-proof regulation: Prioritise flexible, outcome-focused rules that allow organisations to adopt modern, evolving security practices. Technology moves so fast – laws take years to pass.

Third, align with international standards: Help UK businesses stay competitive and compliant across borders while strengthening our collective cyber posture, but retain the right to do what is necessary to protect our national interests in every sense.

Fourth, support information sharing: Enable regulated entities to share threat data safely with regulators and peers, while protecting privacy.

Fifth, invest in resilience: Upgrade digital infrastructure, particularly in the public sector, and ensure funding for cyber skills, research, and innovation.

And finally, sixth, champion continuous improvement: Use real-world evidence to regularly review and update regulations. Foster a culture of learning, not just compliance.

These are not party-political asks. They are what the cyber sector needs from any Government that is serious about security and growth. Because there is a chance for UK Leadership here.

The UK can lead in setting global standards, creating next-generation technologies, and building public trust in digital services. But this will only happen if Parliament and industry work hand in hand. Cyber security is a shared responsibility; it should be part of the culture itself.

The decisions we take now will determine whether the UK remains a secure, prosperous, and trusted digital nation in the years ahead.