The UK National Audit Office report of 29 January 2025 on government cyber resilience says the threat is severe and advancing quickly, progress is slow, and resilience is lower than previously estimated. Departments rely on hundreds of ageing legacy systems, and have no fully funded remediation plans for half of the vulnerable ones.
The headline findings
The NAO, a Value for Money report linked to the Cabinet Office, found:
- The cyber threat to government is severe and advancing quickly.
- The Cabinet Office has published and begun leading work on the first government cyber strategy, and central interventions such as GovAssure and Secure by Design should help.
- Progress is slow, and significant incidents are likely to happen regularly.
- Departments have significant gaps in system controls, and resilience is lower than previously estimated.
- Government will not meet its aim for critical functions to be resilient to cyber attack by 2025, and the Government Security Group considers the 2030 wider public sector target ambitious.
Legacy IT
The report says departments still use hundreds of ageing legacy systems that are likely less resilient. For half of these vulnerable systems there is no fully funded plan to remediate.
That is the finding with the clearest lesson for any organization: a risk without funding is an accepted risk, whether or not anyone chose it.
Barriers named
Government will struggle until it addresses a long standing shortage of cyber skills, strengthens accountability for cyber risk, and better manages legacy IT risk.
Applying it to a smaller organization
- Count your end of life systems: operating systems, databases, appliances.
- For each one, record an owner and one of three plans: replace by a date, isolate behind compensating controls, or accept in writing with an expiry.
- Review the funding line. A replace plan with no budget is an accept plan.
- Report the count to leadership every quarter and watch it fall.
Skills and accountability
A skills shortage is rarely fixed quickly, so decide what you will automate and what you will outsource. Make accountability explicit with a named executive for each critical system's cyber risk.
What tooling can and cannot do
Safeguard's asset discovery and SBOM and dependency scanning help find legacy components, and its compliance automation can track plans. Replacement budgets and migration work are organizational decisions.
Try it yourself
Click through the inventory and look for old components that nobody listed on purpose.
Click through it at your own pace, or open it full screen.
Quick check
Does the NAO say government is failing completely?
No. It says central interventions should help, but progress is slow and resilience is lower than estimated.
What is the main legacy IT finding?
Departments have hundreds of ageing systems and no fully funded remediation plans for half of the vulnerable ones.
Sources
Last reviewed: 19 October 2026.
