This week saw the announcement of the much-awaited Strategic Defence Review (SDR) 2025. It places cyber security as a cornerstone of the United Kingdom’s national defence policy, reflecting the increasingly contested and volatile digital landscape. As cyber threats from hostile states, criminal networks, and non-state actors escalate in scale and sophistication, the UK government has outlined a clear strategy to enhance resilience, integrate cyber operations into defence planning, and invest in the tools and talent necessary to compete in the digital domain.

Key areas of interest:

NATO First: A recurring theme throughout the review is interoperability and collaboration, not just within the UK armed forces but also across NATO and allied cyber defence units. The UK aims to lead by example in setting norms for responsible cyber behaviour and to work multilaterally in response to large-scale cyber incidents. To reinforce cyber security across the public and private sectors, the government will introduce the Cyber Security and Resilience Bill, aimed at creating a robust regulatory framework for critical infrastructure, expanding incident reporting obligations, and granting more oversight power to regulators. This move signals a shift toward proactive governance and accountability in the face of a rising tide of ransomware and supply chain attacks.

Technical Innovation: The SDR 2025 places a strong emphasis on integrating emerging technologies. Artificial intelligence (AI), machine learning, quantum computing, and autonomous systems are identified as crucial enablers for modern cyber operations. AI will be employed not only for cyber defence, detecting and responding to threats in real time, but also to support intelligence gathering and decision-making at all levels of command. Additionally, the ability to dominate and defend the electromagnetic spectrum is cited as critical, especially with reference to lessons learned from recent conflicts such as in Ukraine.  The creation of a new Cyber Electromagnetic Command will be at the forefront of this initiative aligned with £400m to invest in UK-based companies.

Engine for Growth:  The Government recognises that defence has a crucial role in developing a thriving and resilient economy, therefore the wider defence industry is going to be supercharged to meet demand. Reformed procurement processes will ensure new technologies get into the hands of the user more quickly to ensure rapid effects and development cycles. This will be the lynchpin of a new defence industrial strategy.

In conclusion, the SDR 2025 marks a decisive evolution in the UK’s approach to cyber security. By significantly investing in digital capabilities, fostering innovation, and strengthening legal and operational frameworks, the UK aims to protect its digital interests, deter adversaries, and ensure strategic advantage in an increasingly contested cyber domain. The Amethyst Risk Management team, combining its cyber security expertise and its strong Government and Defence lineage is ready to meet this challenge head-on, empowering our clients with expert guidance, robust security strategies, and the confidence to thrive in a more accountable digital world.