National infrastructure needs a new approach to cyber resilience

The British government's proposal to bring more critical infrastructure under public ownership has sparked discussions about investment and governance, but the conversation around cybersecurity has been notably absent. Regardless of political perspectives, it is evident that public ownership does not shield essential services from cyber risks.

On the contrary, it raises the bar for resilience, coordination, and preparedness against disruption. This expectation is grounded in the current threat landscape. Energy providers, water companies, transport operators, and healthcare organizations are all embedded in intricate digital ecosystems. Their capacity to deliver essential services relies on thousands of suppliers, technology vendors, and third parties. A compromise in one organization can have cascading effects across its network.

To bolster national infrastructure, cybersecurity must be integrated from the outset. This involves transitioning from isolated security programs to a collaborative model where organizations share intelligence, comprehend shared risks, and coordinate responses before disruption escalates. Critical infrastructure extends beyond organizational boundaries, as evidenced by recent high-profile cyber attacks.

The SolarWinds incident compromised the software updates of thousands of organizations globally, while the ransomware attack on Synnovis disrupted pathology services across multiple NHS trusts, leading to cancelled operations, delayed appointments, and widespread patient care disruptions. Neither attack remained contained within the initially breached organization.

Existing security programs often fall short in addressing these interconnected risks. Despite significant investments in detection technologies, vulnerability management platforms, and threat intelligence feeds, organizations struggle to convert this data into actionable decisions. Filigran's State of Threat Management report revealed that while organizations consume an average of fourteen threat intelligence feeds, fewer than half have successfully operationalized this intelligence.

Additionally, 84% of surveyed organizations reported that attacks exploited known risks that had not been prioritized, and 84% also faced challenges in determining exploitability of identified exposures. These findings underscore a broader industry issue: the focus is shifting from discovering risk to determining which risks require immediate attention.

Security teams are inundated with alerts, vulnerability reports, and intelligence updates, often wasting valuable time investigating low-priority issues while critical threats remain undetected. While threat intelligence typically serves Security Operations Centers to aid in detecting or investigating malicious activities post-infiltration, its value extends far beyond this stage.

When effectively utilized, threat intelligence can inform decisions earlier in the security lifecycle, helping organizations identify vulnerabilities actively targeted by attackers, assess the most significant business risks, and prioritize remediation efforts for maximum exposure reduction. This approach moves away from treating every vulnerability as equally urgent and enables security teams to focus on threats that genuinely impact their environment.

Continuously managing threat exposure, rather than relying on assumptions or theoretical risk scores, provides a structured framework for integrating threat intelligence, exposure management, validation, and remediation into a seamless process.