Over 60 Organisations Sign UK Cyber Resilience Pledge

More than 60 UK organisations, including Microsoft UK, M&S, Nationwide, ITV, Cloudflare and Vodafone, have signed the Government’s new Cyber Resilience Pledge, committing to practical measures aimed at strengthening cyber resilience across the economy.

The voluntary initiative, launched at 10 Downing Street on 7 July 2026, comes as cyberattacks are estimated to cost UK organisations £14.7 billion ($19.6 billion) annually.

Rather than introducing new regulations, the pledge focuses on organisational behaviour. Signatories commit to board-level oversight of cyber risk, use of the National Cyber Security Centre’s Early Warning service and a risk-based approach to Cyber Essentials across their supply chains.

The announcement reflects the Government’s growing emphasis on cyber resilience as a leadership responsibility rather than solely a technical function.

Government Wants Cyber Risk Managed at Board Level

One of the most significant aspects of the pledge is its focus on organisational leadership.

Signatories are encouraged to adopt the Cyber Governance Code of Practice and ensure board members complete NCSC cyber governance training.

Technology Secretary Liz Kendall said the initiative demonstrates that cyber resilience is “no longer just an IT issue” but “a business imperative.”

The pledge places cybersecurity alongside other areas of organisational risk already overseen at board level, recognising that cyber incidents can disrupt operations, expose customer data and create significant financial consequences.

Rather than introducing new technical requirements, the initiative focuses on governance, accountability and decision-making.

AI is Reinforcing the Importance of Cyber Fundamentals

The Government also argues that AI is changing the cyber threat landscape.

AI can strengthen defensive capabilities, but it also enables attackers to identify vulnerabilities, generate exploit code and automate attacks more quickly.

The scale of the challenge is already considerable.

More than 5 million cyber crimes targeted UK businesses in the year to September, equivalent to one every six seconds. The NCSC handled 204 nationally significant incidents in the year to September, compared with 89 the previous year.

The average cost of a significant cyber attack on a UK business now approaches £195,000.

These figures help explain why the pledge concentrates on governance and operational preparedness. As attack timelines shorten, organisations face greater pressure to make timely decisions and respond effectively when incidents occur.

Practical Implementation Over New Regulation

The Cyber Resilience Pledge does not introduce additional legal obligations.

Instead, it focuses on three practical commitments:

• Board-level accountability for cyber risk
• Adoption of the NCSC Early Warning service
• A risk-based approach to Cyber Essentials across supply chains

The emphasis on supply chains reflects the growing complexity of modern organisations.

Many businesses now depend on extensive networks of suppliers, platforms and technology partners, meaning weaknesses in one organisation can have wider operational consequences.

The pledge also complements existing government initiatives, including the Cyber Governance Code of Practice, Cyber Essentials, the forthcoming National Cyber Action Plan and the proposed Cyber Security and Resilience Bill.

Industry Supports the Focus on Governance

Industry reaction has centred on leadership and practical implementation.

“For years, cybersecurity has often been treated as a technical problem to solve after the fact. The Cyber Resilience Pledge reflects something we’ve believed for a long time — resilience starts with leadership, good governance and getting the fundamentals right,” said Jamie Akhtar, Co-Founder and CEO of CyberSmart, said:

The comments reflect the practical focus of the pledge.

Rather than advocating new technologies, the initiative encourages organisations to strengthen governance, establish clear responsibilities and embed cyber risk into existing business decision-making.

Cyber Governance is Becoming Part of Leadership

The Cyber Resilience Pledge illustrates how responsibility for cyber risk is evolving within organisations.

Technology teams continue to play a central role in defending systems and responding to incidents.

The pledge focuses on the decisions that shape those capabilities: governance, investment, organisational priorities and supply chain oversight.

Whether through regulation, voluntary commitments or industry guidance, cyber risk is moving closer to the boardroom.

The organisations signing the pledge are committing to practical actions. The wider significance lies in how responsibility for cyber resilience is being distributed across organisations rather than remaining solely within technology teams.