CBN Newsletter | February 2026

Our monthly update bringing you the relevant, high-level policy and business news from across the cyber sector. 

This month, we analyse the first two hearings at committee stage for the Cyber Security and Resilience Bill, as well as taking a look at the WEF’s Global Cybersecurity Outlook, and examining some big announcements across the industry.

If you have any questions about the content, or believe we should add to our coverage, please do not hesitate to get in touch.

never miss a thing

Sign up for news and upcoming events

Sign up

Headlines

Witnesses provide oral evidence for the Cyber Security and Resilience Bill at committee stage

The first two oral evidence sessions on the Cyber Security and Resilience Bill at committee stage, held on Tuesday 3 February, brought together witnesses from industry, regulators, public bodies and academia.

While they broadly welcomed the Bill’s aims, they also raised significant questions about its scope, its impact on supply chains, and the practicality of its incident reporting mechanisms. Witnesses further explored how the Bill could help foster a stronger cyber risk culture within organisations, and the role it might play in promoting cyber skills development and training.

Witnesses generally agreed that the Bill’s effectiveness would be improved by revisiting and adjusting its scope. Jen Ellis, Associate Fellow at RUSI argued that the Bill should move away from static sector lists towards size or impact‑based thresholds, such as FTSE 350 companies or widely used tech providers. There were also concerns raised by techUK and Nine23 around the Bill’s broad definition of a managed service provider (MSP), creating issues around clarity, and its narrow size threshold, which may leave many MSPs out of scope.

There was a broad welcome of bringing key supply‑chain providers into scope, but that was met with a recognition of the complexity of the issue. Ofcom stated that they would adopt a pragmatic regulatory approach, starting from the suppliers that operators themselves worry most about, and building a more cohesive methodology from there. However, not all witnesses agreed on which supply-chain providers should be in-scope, and how that should be determined.

However, there was a broad agreement that the incidence reporting mechanism needed to be streamlined. ISC2, techUK and others were uneasy about phrasing within the legislation around incident reporting, such defining cyber incidents as ‘capable of having a significant impact’, without providing clearer metrics (e.g. number of customers affected, geographic spread, duration). They warned this could drive over‑reporting, regulator overload and box‑ticking, especially among SMEs.

Written evidence will now be considered by the Public Bill Committee, with the first reading on Thursday, 5th February. In general, the voices of industry mirrored the concerns raised in the written evidence submitted by the Cybersecurity Business Network last week – which outlined recommendations around modifying the Bill’s scope, aligning the regulation with pre-existing resilience standards, streamlining incident reporting requirements, and ensuring board-level accountability.

If you have any questions around the Bill, or any amendments proposed at committee stage, please contact secretariat@cb-network.org.

Cyber‑fraud overtakes ransomware as top concern for business leaders

Phishing and cyber‑enabled fraud have overtaken ransomware as the leading cybersecurity concern for global business leaders, according to the World Economic Forum’s Global Cybersecurity Outlook 2026.

The report, released on 12 January 2026 ahead of the WEF Annual Meeting in Davos, warns that levels of cyber‑enabled fraud have reached record highs, and continue to erode trust in digital systems. The survey of global executives found that 77% have seen an increase in cyber‑enabled fraud and phishing, and 73% say they or a peer have been directly affected. 

Phishing is the most commonly reported threat, with the report emphasising the growth in email, voice (vishing) or SMS (smishing) scams. Other major issues include invoice and payment fraud tied to business email compromise (37%), identity‑related attacks (32%), insider or employee‑led fraud and romance or impersonation scams (both affecting around one in five), and growing concern about cryptocurrency and investment fraud.

The report also highlights the rapid escalation of AI‑driven cyber risks. Eighty‑seven percent of respondents experienced rising AI‑related vulnerabilities last year and 94% expect AI to be the dominant force shaping cybersecurity in 2026. The WEF argues that cyber risk is now a strategic, economic and societal challenge rather than a purely technical one, calling for coordinated action between governments, businesses and technology providers. 

New Chinese embassy sparks communication concerns

The plan to build a new Chinese embassy next to the Tower of London was approved by the government, following a lengthy debate around potential security risks.

The new site would be China’s largest embassy in Europe, hosting over 200 staff and consolidating seven existing diplomatic sites into one. The Security Service, MI5, says that this could make monitoring easier. Critics warn the complex could become a hub for espionage, cyber activity and intimidation of dissidents.

The Telegraph newspaper ran an article spotlighting concerns around a subterranean basement room being built within the embassy that will run alongside sensitive fibre optic cabling, transmitting data between the City of London and Canary Wharf – the city’s main two hubs of financial services.

Critics have raised potential communications interference or internet traffic monitoring, however, British intelligence services noted that it was ‘not realistic to expect to be able wholly to eliminate each and every potential risk’, in a letter addressed to the Home Secretary and Foreign Secretary.

Policy & Political

The UK and Japan agree to boost joint cybersecurity measures following state visit

On the 31st January, the governments of the UK and Japan agreed to accelerate co-operation on cybersecurity measures in the UK-Japan strategic cyber partnership. This followed Prime Minister Keir Starmer’s visit to Japan, and meeting with new Japanese prime minister Sanae Takaichi. The new partnership comes as tensions between Japan and China have heightened since Takaichi became prime minister, and fears around China’s offensive capabilities grow.

The strategic partnership commits both the UK and Japan to work together to address global cyber threats, based on three main pillars. Firstly, detecting, deterring and defending against cyber threats, secondly, enhancing whole-of-society cyber resilience, and finally, building an innovation ecosystem.

Both nationals have agreed to use their available cyber capabilities to help deter cyber threats facing both nations, and have reaffirmed their commitment to close collaboration, including around developing new technical standards, information sharing policies, and protecting both nation’s critical national infrastructure. 

The new measures reaffirm the previous Japan-UK Cyber Partnership as part of the so-called Hiroshima Accord, established by former prime ministers Rishi Sunak and Fumio Kishida in 2023. Closer collaboration between the Japanese and British cyber sectors could create greater market access for UK vendors, as well as offering more investment and partnership opportunities and a stronger deterrence posture against hostile states.

Parliamentarians urge stronger Cabinet action to tackle cyber-crime

Parliamentarians pressed the Government to step up efforts to combat cyber-crime, highlighting both the growing scale of the threat and the importance of home-grown cyber skills.

Responding to questions in the House, Dan Jarvis, the Minister of State for Security for the Cabinet Office, reaffirmed that the Government is ‘absolutely committed’ to using all available tools to disrupt cyber-threats and keep the public safe. He pointed to the upcoming national cyber action plan, designed to address evolving cyber-threats and emerging technologies, and confirmed that ministers are working closely with police to deliver ‘real-world impact’ against cyber-criminals.

Jim Shannon, DUP MP for Strangford, drew attention to the scale of the problem, noting that cyber-crime and fraud now account for around 50% of all offences in the UK, costing the economy billions each year. 

Jarvis reiterated the seriousness with which the Government treats cyber-crime and pointed to existing support for victims, including free guidance, tools and incident response advice courtesy of NCSC, alongside targeted awareness campaigns.

NCSC Updates

Business & Industry

RUSI publishes new Cyber Strategy paper

The Royal United Services Institute (RUSI), the world’s oldest and the UK’s leading defence and security think tank, published a new paper calling for comprehensive updates to the UK’s current cyber strategy. 

With cyber attacks costing UK businesses billions each year, and incidents like the Jaguar Land Rover breach exposing serious gaps in resilience, RUSI is advocating for the upcoming National Cyber Action Plan to become a critical opportunity to reset the UK’s cyber resilience strategy.

They call for a sharper focus on economic security, a new threat-response model that properly balances state-backed attacks and cybercrime, and a cross-government joint assessments unit to improve coordination. 

The paper also urges tougher accountability in both the public and private sectors: stronger cyber performance in government, mandated board-level responsibility for cyber risk, and more transparent reporting from companies.

Finally, it argues that regulators must be properly funded and empowered, including through annual fees from regulated organisations to support enforcement. Taken together, these steps would help fix market failures, strengthen resilience and better protect the UK’s infrastructure, economy and national security.

JLR still feeling the impact of 2025 cyberattack

Jaguar Land Rover is still feeling the impact of last autumn’s major cyber attack, reporting a further £64 million in related costs and a sharp downturn in performance. The incident forced a five‑week production halt from 1 September, contributing to an underlying pre‑tax loss of £310 million in the quarter to 31st December, compared with a £523 million profit a year earlier. 

Revenues for the quarter fell 39% to £4.5 billion as sales volumes were hit, with production only back to normal by mid‑November. JLR has now booked £260 million in direct cyber‑related costs this year (£196 million previously plus £64 million this quarter), helping push year‑to‑date losses to £444 million, versus £1.6 billion in profits a year earlier.

JLR’s new chief executive has said it had been a ‘challenging quarter’ but stressed that production is now back at normal levels and that JLR expects a significant improvement in performance in the final quarter, with ‘clear plans to manage global challenges.’

Events

CBN March Member Meeting

CBN will be holding its second bi-monthly members meeting of 2026 soon for paying members – keep an eye on your emails for further details.

If you’d be interested in attending our next meeting,, please drop us an email at secretariat@cb-network.org.

To become a member and ensure you won’t miss any of our events, please visit ​​cb-network.org/join-us/.

About CBN

The Cybersecurity Business Network is a coalition of leading UK-based organisations committed to strengthening the nation’s cyber resilience, fostering innovation and supporting economic growth. Through collaboration and knowledge sharing, we empower our members to drive growth and set standards for excellence across the UK cyber sector.

As a member-led network, our ambition is to serve as the unified voice of the UK cyber industry, championing its interests, amplifying its potential, advocating for greater engagement and support from government, media, and the wider business community.

If you are interested to hear more about CBN or want to become a member, then please reach out to secretariat@cb-network.org for more info.