The UK Government has unveiled a £210 million cyber action plan to secure online public services and protect people’s data as more services move online.
The plan aims to strengthen defences across departments, respond faster to cyberattacks and support digitisation that could save up to £45 billion while cutting queues and paperwork.
After seeing the worst year on record for cyberattacks… what’s in store for 2026?
Jason Soroko, Senior Fellow at Sectigo and Security Technology Innovator Executive, is a leading expert on cybersecurity implications for businesses and governments.
He said: “For cyberattacks, 2025 was brutal. 2026 will be worse. Attackers now deploy AI at a speed defenders simply haven’t matched. It’s an asymmetry that widens by the month. Defenders have been slow to uptake stronger authentication, which is like failing to better locks on the doors. The attackers take advantage of this. Passwordless systems matter more than ever, but the difficulty in using passkeys in centralised enterprise environments leave gaps everywhere. Ransomware payouts climb, attack surfaces expand and defenders can’t keep pace. Without co-ordinated vendor collaboration, the curve bends in the wrong direction.
“2026 will mark a milestone no one wants: the first publicly acknowledged Fortune 500 material breach caused by prompt injection. Companies will deploy LLM-integrated systems without guardrails, and adversaries will discover how to coerce those models into executing harmful internal commands or leaking sensitive data. The industry is still treating prompt injection like a clever party trick rather than a security class. It’s not. Even without ‘attacking the model’, attackers will weaponise its instructions. And organisations still aren’t ready. Model-signing and treating small models like firmware will emerge as essential controls.”
