Building NHS resilience to ransomware: central oversight and shared capability (King's College London, 31 March 2026)

Summary

The King’s College London Cyber Security Research Group has published a white paper, Building NHS Resilience to Ransomware: Central Oversight and Shared Capability.

The paper identifies ransomware as the most acute cyber threat facing NHS Trusts. This is driven not only by the nature of the threat itself, but by inconsistent implementation of established security controls and uneven governance maturity across organisations. The report finds that the primary constraint is often cultural rather than technical or financial.

Content

While the NHS has a strong patient safety culture, this has not yet fully extended to digital systems and third-party dependencies. As a result, cyber risk is still too often treated as an IT or procurement issue, rather than as a direct risk to service continuity, public trust, and patient safety.

The paper proposes a Cyber Leadership Framework centred on Board-level ownership and empowered CIO or CISO leadership. It emphasises the need to connect technical controls with the operational realities of care delivery. It also argues for greater centralisation of core cyber capabilities and shared services to reduce fragmentation and support weaker Trusts in reaching consistent standards.

The report highlights the importance of organisational culture alongside technical capability. This includes leadership tone, clear accountability, translating cyber risk into operational terms, and moving beyond compliance towards demonstrable resilience in care delivery. Ultimately, the paper argues that the future digital legitimacy of the NHS will depend not only on improved tools, but on embedding cyber resilience within the culture of safe care.

Former Health Secretary Alan Milburn welcomed the report, noting in particular its focus on governance and cultural change as key to reducing risk, rather than relying solely on increased resources.