This article is based on a webinar hosted by Lloyds to explore the evolving threat landscape for public sector organisations. Giles Taylor, Head of Resilience & Security at Lloyds joined forces with Jake Taylor, Corporate Consulting Manager at Gallagher, who administer Lloyds Business Insurance Services, to share practical steps to strengthen your defences and build a robust response plan.
Cyber security is no longer just an IT issue – it’s a strategic priority that starts at the top.
That reflects the increasing cyber threat to public sector organisations, with the National Cyber Security Centre reporting a 50% increase in attacks with the potential to have a serious impact on essential services[i].
So, why is the cyber threat increasing?
Part of the problem are hostile nation states, which are increasingly using cyberattacks to cause disruption however they can. Some attacks are targeted, seeking to destabilise democracies by disrupting systems like healthcare and local authority services. In other cases, organisations can be caught up in attacks that are more indiscriminate.
Bad actors are also trying to generate income through ransom attacks that take control of your systems and demand a ransom to let you back in, or stealing sensitive data, which they threaten to release unless a ransom is paid.
It is thought that around one in four organisations resort to paying these ransoms[ii].
And it is now easier than ever to launch a cyberattack; the tools can easily be acquired on the dark web, and technical expertise is no longer a barrier with technologies such as RaaS (Ransomware as a Service) and AI able to craft increasingly sophisticated attacks.
While modern public sector service provision is increasingly being digitised, higher connectivity can also provide hackers with more access routes.
On the other hand, older systems not designed to be internet connected and running on legacy software, can equally expose vulnerabilities that hackers can exploit.
Taken together, these factors can increase the likelihood of a successful cyberattack.
So, what’s the answer?
Backups
When a cyberattack happens, it is crucial to react quickly to shut down and isolate affected systems.
You now have an active adversary working against you who will likely already be inside your system, listening to your conversations and working to disrupt your recovery.
Their priority will be to identify your backups and work to destroy them, which will give them greater leverage to force you to pay their ransom, so offline backups of the most important data that you hold are a critical layer of security.
In the immediate response to an attack, disruption to communications can be a big issue.
Modern phone systems utilise internet networks, leaving them incapacitated during an attack, which will likely mean resorting to personal phones and paper backups of contact lists for critical management and incident response teams, as well as your pre-established incident response plan.
Training
One of the key vulnerabilities of any organisation is the human element.
It’s estimated 95% of cyberattacks succeed because of human error, including opening phishing emails[iii].
In the era of AI, that risk is bigger than ever, because malicious messages can be tailored to appear incredibly realistic and include information designed to convince the recipient they are safe to open.
In addition, attacks tend to be more prominent at times of change, whether that’s during organisational restructures or because of legislative changes, such as the upcoming government targeted ban on ransomware payments for all public sector bodies and Critical National Infrastructure (CNI) organisations.
Therefore, a regularly trained and vigilant workforce could be a powerful first line of defence.
Financial resilience
In the event a cyberattack takes place, your financial provider can be a key asset towards recovery.
Lloyds has a comprehensive cyber response framework, accessible to customers through their relationship manager, who will connect them with the incident management team, and while they can’t support with the technical recovery itself, they can work to support their banking needs.
In the wake of an attack, there will likely be a huge call on the liquidity of the business to bolster cyber defences, as well as paying staff and suppliers.
Given the potential for PAYE details to be compromised or doctored to funnel payments to hackers, Lloyds can help to ratify this information so the business can make payments with confidence.
Technical resilience
When it comes to your technical recovery, organisations may not have this kind of expertise in house.
However, having an insurer such as Lloyds Business Insurance Services on board, arranged by Arthur J. Gallagher, means that upon notice of a breach, and depending on the level of cover, they can facilitate a response hotline to support the critical response team through the process by setting up work streams that can begin the process of bringing your networks back online.
The insurer can also provide legal advice on the relevant authorities that need to be notified about any data losses, as well as law enforcement where applicable.
They can also support your internal and external communications, which could include setting up a response hotline for service users and providing guidance on how to answer frequently asked questions.
Typically, insurers can also provide a threat negotiator to support conversations with the cyber attackers and in the worst of cases, offer guidance on paying the ransom in ways that minimise financial disruption.
Ultimately, the aim is not just to get your IT back up and running, but also to maintain essential functionality during and after an attack, or as much of it as is possible.
To this end, it is important for any organisation to fully assess and understand their key risks and vulnerabilities and likely impacts to their business. Followed by testing of your incident response plan to make sure it can adequately manage and minimise the impacts to your organisation & services within your risk appetite.
Visit the Lloyds cyber risk hub at lloydsbank.com/cyber for more guidance.
Or if a Lloyds customer, you can now book a 30-minute cyber defence check with A.J Gallagher for an initial report on potential vulnerabilities. Please email [email protected] for more information.
[i] https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly
[ii] https://www.coveware.com/blog/2025/10/24/insider-threats-loom-while-ransom-payment-rates-plummet
[iii] https://researchbriefings.files.parliament.uk/documents/CBP-9821/CBP-9821.pdf
Please note that any data sent via e-mail is not secure and could be read by others.
Lloyds and Lloyds Bank are trading names of Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone: 0207 626 1500.
Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under Registration Number 119278.
Lloyds Bank plc is an introducer to Arthur J. Gallagher Insurance Brokers Limited who arrange and administer Lloyds Bank Business Insurance Services and source products from a panel of insurers.
