Business & Technology
What cyber resilience means in 2026
2025 was the year that exposed the gap between cyber strategy and operational reality. For UK security leaders, the lesson learned was that resilience, sustainability, and judgement mattered more than volume. Now, the challenge is responding to threats with clarity until one inevitably succeeds.
By the end of 2025, it became clear that cyber resilience was no longer a theoretical ambition. Now, it’s an operational reality being tested under sustained pressure.
Last year exposed the limits of security models built for a different pace, a different scale, and a different kind of attacker. Familiar access techniques, such as phishing and credential compromise, continued to dominate, but the damage came later. Attacks moved quietly, used trusted access, and blended into normal behaviour for long enough to evade traditional detection.
For many organisations, this can be classed as a failure of assumptions, as opposed to a tooling failure.
Once attackers were inside, security strategies built for prevention struggled. SOC teams were overwhelmed by volume, and they found it harder to identify the signals that mattered. Operating models stretched by skills shortages and alert fatigue began to show signs of strain.
2025 forced a shift in mindset. Rather than asking ‘How do we stop everything?’, the question became something more honest and useful. Now, it was ‘How prepared are we when something inevitably gets through?’
That shift will define cyber resilience in 2026.
Resilience replaces perfection
Resilience has long been discussed as a strategic goal. In 2025, it was seen as a practical measure of effectiveness.
The organisations that coped the best were those that could detect, contain, and recover with confidence. Having the largest number of controls didn’t determine success. They understood that incidents were sequences of behaviour unfolding over time.
Early visibility, clear escalation paths, and disciplined response mattered more than flawless prevention.
In environments where attackers relied on legitimate credentials and lateral movement, rather than malware, that was evident. When malicious behaviour looks like normal activity, resilience depends on context and judgement, not volume-based alerting.
The lesson we should take is uncomfortable, but important. Security programmes designed around perfection break under pressure. Those designed around preparedness adapt and thrive.
SOC sustainability became a leadership issue
Another defining theme of 2025 was the growing strain on security operations centres.
Alert volumes continued to rise as environments expanded across identity, cloud, network, and SaaS platforms. Analyst burnout, skills shortages, and cost pressures all became structural challenges rather than short-term issues. Decisions around data ingestion, retention, and prioritisation were now directly affecting visibility and response capability.
What many organisations discovered was that SOC sustainability is a leadership concern. When analysts spend most of their time validating low-value signals, the risks become hidden. Once teams are stretched thin, the ability to respond decisively degrades long before dashboards reflect a serious problem.
SOC effectiveness will be judged less by activity and more by focus. The ability to prioritise the right signals, at the right time, with the right context will matter more than the number of alerts processed.
AI: Accelerating outcomes, exposing weak operating models
AI featured prominently in security discussions throughout 2025, often framed as a solution to scale and skills challenges. In practice, it acted more like a stress test.
Where operating models were disciplined, AI helped reduce noise, accelerate investigation, and preserve analyst time for judgement. Where processes were unclear or poorly governed, AI amplified inconsistency and introduced new risk.
AI isn’t an immature solution. Instead, AI just doesn’t compensate for weak foundations.
Over-automation, particularly in areas that require explainability and accountability, proved risky. The most effective applications of AI were those that supported prioritisation and context. They shouldn’t be used as an attempt to replace human decision-making altogether.
As a result, the conversation is more grounded. AI is being increasingly understood as an augmentation layer that must operate within clearly defined guardrails.
Architecture and visibility shaped outcomes
One of the quieter but most consequential lessons from 2025 was the role of architecture in resilience outcomes. Applications are distributed, users are mobile, and identity has become the primary control plane.
Security controls that sit outside the network struggle to deliver the visibility and speed required. Attacks don’t respect tool boundaries. They move wherever identity, network, or cloud visibility are weakest.
Organisations that aligned networking and security more closely were better positioned to detect anomalous behaviour early and respond with confidence. This was less about adopting a specific framework, and more about reducing fragmentation and blind spots.
Architecture decisions will now increasingly be recognised as security decisions. Visibility, policy enforcement, and response speed are now tightly coupled to how environments are designed and operated.
What this means going forward
If 2025 was the year resilience was tested, 2026 will be the year it’s measured.
Boards and executives will ask harder questions about preparedness, rather than just focusing on coverage. CISOs will be expected to demonstrate how attacks are prevented and how incidents are handled when prevention fails. Security leaders will need to articulate how their operating models scale sustainably under intense pressure.
The organisations that succeed will be those that stop treating resilience as a set of controls. They need to treat it as a capability that spans people, process, technology, and partnerships.
Cyber resilience is no longer about stopping every attack. It’s about responding with clarity when one succeeds.
Security hasn’t become an impossible task. It’s just become more honest. Noise is easy to generate, and signal is hard to find. Resilience is built long before an incident ever occurs.
Which organisations will be rewarded? It’ll be the ones that have learned the lesson and acted on it.
To see these insights in more detail, read the full breakdown in Gamma Communications’ Cyber Resilience Report: Cyber Resilience for UK Enterprises – Gamma
Business & Technology
US fast food chain set to open its first UK restaurant
Louisiana-born chicken brand Raising Cane’s is setting up shop on Coventry Street in the heart of London, between Piccadilly Circus and Leicester Square.
Although no official opening date has been announced, branded hoardings have now appeared at the site, signalling that the long-awaited launch is edging closer.
The chain, loved by celebrities including Snoop Dogg, Post Malone and Halle Berry, opened its first store in 1996, and as it approaches 30 years in business, is coming to the UK for the first time.
US fast food chain Raising Cane’s set to open its first UK restaurant
The chain has already developed a UK-focused menu featuring both take-out and dine-in meal options, as well as customisable chicken finger combos.
Unlike many competitors, Raising Cane’s keeps its menu simple, offering chicken fingers, crinkle-cut fries, coleslaw, Texas toast, and its signature Cane’s Sauce.
The sauce, described by fans as “next level,” is a particular point of excitement among British diners, who have shared their enthusiasm online.
One food lover wrote: “Omg I absolutely love Raising Cane’s.”
Another said: “Had this in Vegas.
“It was so good.
“Definitely on a par with Slim Chickens imo.”
A third added: “The sauce is next level.
“I will travel just for that.”
The company is reportedly exploring additional central London locations, including Oxford Circus, Paddington, South Bank, and The Strand, as well as potential drive-thru sites across Greater London.
The London restaurant will be the starting point for the brand’s wider European rollout.
US fast food chain rivalling McDonald’s coming back to UK after 17 years
Raising Cane’s is the latest in a wave of US fast-food brands expanding into the UK market.
Recent arrivals include Popeyes, while Dave’s Hot Chicken and Chick-fil-A have also announced UK expansion plans.
Chili’s Grill & Bar is also looking to come back to the UK after more than 15 years, with hopes of eventually opening more than 100 restaurants across the country.
The chain originally arrived in Britain during the 1990s and operated restaurants in places including Cambridge, Reading and London’s Canary Wharf, but by 2009, every UK branch had closed.
Now, the company is making a fresh attempt at cracking the UK market, aiming to open a flagship restaurant within the next 12 to 18 months before it aims to roll out more sites, reports Need To Know.
Industry insiders say they believe the chain could open between 85 and 100 restaurants if successful, with potential locations including London, Manchester, Birmingham, Leeds, Glasgow, and Liverpool.
The Tex-Mex chain is well-known in the US for its burgers, ribs, fajitas, and margaritas.
What US restaurant or fast food chain would you most like to see come to the UK?
Business & Technology
UK firms struggle to map supply chain cyber threats
More than eight in 10 UK cyber security and third-party risk professionals say their organisation experienced at least one supply chain cyber incident in the past year, highlighting continued gaps in supplier oversight and incident response.
Risk Ledger‘s research Every Link Matters: The State of Supply Chain Security 2026 – UK Edition found 82.4% of respondents recorded at least one supply chain incident in the previous 12 months. Almost half, at 47.2%, reported two or more. The findings suggest supply chain cyber risk remains a persistent issue for organisations across sectors, despite stronger regulatory scrutiny of operational resilience and supplier dependencies.
Risk levels
The survey of 500 UK cyber security and third-party risk management professionals found 86% ranked supply chain cyber incidents among their top three concerns for 2026.
The data also shows a gap between concern and readiness. Only 6% of respondents said they could accurately map exposure across their supplier ecosystem in under four hours after a major supply chain cyber incident. Another 45% said it would take between four and 24 hours.
More than a quarter said it would take one to three business days. A further 23% said it would take more than a week and require manual outreach to suppliers.
Those delays can limit an organisation’s ability to respond when a supplier is compromised. Teams need to know which business services, systems and processes may be exposed. They also need to understand whether risk extends deeper into the supply chain.
Slow checks
Supplier due diligence remains slow. Only 38% of respondents said their organisation could complete security due diligence for a new supplier within two weeks.
Another 34.6% said the process took three weeks or more. Within that group, 12% said it took more than one month.
Risk Ledger’s analysis points to a structural weakness in many third-party risk management processes. They often remain manual and focused on bilateral assessment between one customer and one supplier. Many still rely on bespoke questionnaires and periodic reviews.
That approach can create duplicated work for suppliers. It can also leave customers relying on information that may not reflect current security controls.
Visibility gap
Visibility beyond direct suppliers remains uneven.
Some 30% of respondents said they had full visibility into the entire chain of subcontractors contributing to important business functions. Just over half, at 50.2%, said they had high visibility into all direct subcontractors of critical third parties.
A further 16% reported only partial visibility into some fourth parties of their critical suppliers. Only 3% said they had no visibility beyond direct critical third parties.
The findings come as regulators in the UK and EU put greater emphasis on operational resilience, concentration risk and the mapping of digital dependencies. This includes closer scrutiny of subcontractors and deeper-tier relationships that support critical or important services.
“Identifying systemic risks is really important. However in most cases, only industry-level associations have enough combined resources and adequate information sharing guardrails in place to efficiently identify actual systemic risks, agree actions and, with the help of regulators, influence large players in the supply chain,” said Yohann Le Grand, Senior Security & Resilience GRC Manager, Lloyds Wealth.
Network mapping
Risk Ledger sets out a model it calls Active Supply Chain Security. It is based on standardised assessments, continuous monitoring, network visibility, collective defence and faster incident response.
The survey suggests organisations are open to more collaborative approaches. Some 42% of respondents said their organisation would be very supportive of an industry-wide model in which supplier intelligence and assurance data are shared with peers. A further 50.2% said they would be somewhat supportive.
Risk Ledger also examined three groups using its platform: 26 government organisations, 25 local authorities and 30 financial institutions.
Across the government group, the platform identified 3,240 direct third parties and 5,886 additional dependencies across shared nth parties. It also identified 1,264 potential concentration risks, including 820 at third-party level.
Of those third-party concentration risks, 224 were rated critical. Risk Ledger said this means an incident at one supplier would be likely to disrupt essential services at multiple public sector organisations.
“Risk Ledger’s Network Visualisation Tool has enabled us to efficiently identify critical risks across our supply chain, helping us address potential concentration risks before they escalate,” said Chris Phillips, Third-Party Compliance and Assurance Lead, Home Office Cyber Security (HOCS) | Governance, Risk and Compliance (GRC).
Sector exposure
The local authority group had 1,004 direct third parties and 7,659 additional dependencies across shared nth parties. Risk Ledger identified 1,240 potential concentration risks, including 364 at third-party level. Of those, 99 were rated critical.
The financial services group had 2,780 direct third parties and 6,529 additional dependencies. The platform identified 1,322 potential concentration risks, including 727 at third-party level. Of those, 288 were rated critical.
The analysis also found control weaknesses among some critical concentration risks. In the financial services group, 120 suppliers classified as critical third-party concentration risks did not have Cyber Essentials certification. Two were not using Multi-Factor Authentication to secure remote access to their network or cloud environments. Ten did not regularly test or rehearse Business Continuity and Disaster Recovery plans.
“A big challenge with third-party risk management comes down to how corporations and other organisations tackle peer-to-peer communication from within their respective siloes. We (as customers of common suppliers) need to get better at working with each other and trusting what our peers are doing. Using feedback as a form of intelligence about shared interests would allow companies to focus more time on fixing the things we really care about,” said Jay Vinda, Global CISO and Cyber Risk Engineering Lead, Mosaic Insurance.
Read full report here.
Business & Technology
Ardmore Group files for administration after 52 years
Ardmore Group’s businesses, including its construction and major projects arms, have filed a notice of intention to appoint administrators.
This has left nine active projects in London in limbo, including a £500m scheme with laboratories and housing in King’s Cross, known as Tribeca.
It had also been working on high-end hotels in Mayfair and Kensington, flats at Earl’s Court and Hackney Wick, and offices at Chancery Lane, The Telegraph reports.
What is the Ardmore Group?
The Ardmore Group was founded in Catford in 1974 by Irish brothers Cormac and Patrick Byrne.
It was well-known for its building projects in London, such as the Raffles hotel and The Ned.
Alongside that, it was a partner for major housebuilders such as Barratt Redrow, Berkeley and Crest Nicholson.
Ardmore’s LinkedIn page shares that the firm specialises in “large-scale complex projects through our direct delivery capability, technical and engineering expertise, and pro-active approach to managing risk.”
It adds: “We’ve designed and built some of the UK’s most significant projects, establishing an unrivalled reputation as one of the country’s leading residential and hotel builders.
“Our traditional, hands-on approach to construction puts us at the heart of the action.”
Why did the Ardmore Group file for administration?
Scrutiny of apartment blocks that were built before the Grenfell disaster uncovered fire safety deficiencies at multiple buildings that Ardmore had built decades earlier.
Last year, Ardmore’s construction arm was put into administration in an attempt to protect the wider business group from being hit by client claims.
Despite this, Crest Nicholson won a landmark High Court challenge against the group over remediation costs at its Admiralty Quarter development in Portsmouth.
It was awarded close to £15m, and this paved the way for other builders to pursue claims against Ardmore.
Discussing the outcome of this High Court challenge, Ardmore shared: “The administration follows the profound impact of the recent Building Liability Order (BLO) judgment relating to the Admiralty Quarter project, which completed in 2009.
“The judgment has affected client confidence, payment terms and certified values across a number of live projects, materially affecting the construction group’s ability to continue trading in the normal way.”
On Thursday (June 11), Ardmore Group applied for a company moratorium, which is designed to give it temporary protection from creditor action while rescue options are explored.
This is also intended to give the group time to continue preparing its appeal against the BLO judgment.
An Ardmore spokesperson added: “This is a deeply disappointing outcome for the construction group, its employees and its stakeholders.
“Our focus is now on preserving value in the wider Group, protecting the continuing businesses where possible, and pursuing the appeal against a judgment which we believe raises important questions for the wider industry.”
Other UK companies that have closed or entered administration/liquidation in 2026
It has been a tough year for the UK high street, with several retailers entering administration and others announcing widespread store closures.
Major high street retailers LK Bennett and Claire’s both closed all their stores in April, having previously fallen into administration.
Quiz also revealed that it will be closing its 37 remaining stores by the end of June, after falling into administration in February (for the second time in 12 months).
Other retailers have been forced to close stores this year, including:
- River Island
- Primark
- Poundland
- Revolution
- BrewDog
- Franco Manca
Iguanas Holdings Limited, which runs 47 Las Iguanas restaurants across the UK, and Poundstretcher are also in danger of collapsing into administration if restructuring plans aren’t agreed, having “fallen into financial difficulties”.
Four UK travel companies have closed in 2026:
- Regen Central Ltd
- Gold Crest Holidays
- Asiara UK Ltd
- Simply Florida Travel Ltd
Luxury UK holiday company Salamander Voyages also shut down recently after entering administration.
Meanwhile, three UK airlines have fallen into administration or liquidation:
- Ascend Airways (liquidation)
- EcoJet Airlines (liquidation)
- Zenith Aviation Limited (administration)
UK delivery company Yodel is set to be phased out over the coming months after being acquired by InPost.
It’s also been reported that Morrisons is looking to sell some of its in-store pharmacies as it continues to cut costs.
It’s not been all bad news for the UK high street, with several major brands announcing new store openings for 2026, including Aldi, M&S, and Superdrug.
Plus-size clothing brand Evans has also returned to the UK high street in 2026 after closing all its stores and concessions in December 2020.
Have you noticed an increased number of businesses closing or going into administration in your area this year? Let us know in the comments.
-
Crime & Safety4 weeks agoWhat happens to Halifax customers if Lloyds makes changes?
-
Oxford News4 weeks agoActor steps down from major role in new Harry Potter series
-
Crime & Safety4 weeks agoOxfordshire bridge closure comes as management ‘weaknesses’ found
-
Crime & Safety4 weeks agoFlock of clay birds set to take flight in special exhibition
-
Oxford News4 weeks agoNHS fracture service helps support extra 1,000 patients
-
Oxford News4 weeks agoHenley pub once owned by Russell Brand reopens after 6 years
-
Crime & Safety4 weeks agoFriends of the Ridgeway appoint Matthew Barber as president
-
UK News4 weeks agoThe race to replace Starmer is on – but he still faces a momentous choice
