As we approach 2026, digital resilience has become a strategic imperative. The convergence of heightened regulatory scrutiny, high-profile cyber incidents, and emerging technologies is reshaping how organisations approach operational continuity and security.
Cyber incidents were historically primarily concerned with data protection. However "digital resilience" recognises a broader focus on operational and security issues, including those affecting service availability, and the need to prepare accordingly so that critical services can recover from disruption. This is particularly vital in essential sectors such as healthcare, financial services and the public sector – as well as the digital infrastructure on which those sectors rely.
The regulatory landscape intensifies
Digital resilience is no longer simply best practice - it is becoming a legal obligation across multiple sectors and jurisdictions. Navigating this landscape is not straightforward and penalties for non-compliance can be significant.
To date, digital resilience has been a particular focus in sectors like financial services. However the overarching trend is towards a wider range of entities being brought in-scope of legislation, imposing more stringent obligations.
In the UK, the proposed Cyber Security and Resilience (Network and Information Systems) Bill (CSR Bill) represents a significant step towards mandatory resilience standards for in-scope entities, across sectors including healthcare, utilities, energy, water and digital infrastructure. Building on the existing NIS Regulations 2018, the Bill proposes expanding the range of entities in scope and introducing more prescriptive requirements around risk management, incident response, and governance. See our article here.
Meanwhile, the EU's NIS2 Directive continues its phased implementation across Member States, with transposition deadlines driving substantial compliance activity. NIS2's expanded sectoral coverage - encompassing medium and large entities in 18 sectors - means thousands of organisations are now grappling with enhanced security requirements for the first time.
Models to determine which parties are in scope are also shifting to take into account the extent to which services are relied on for critical services/sectors. For example, a provider of IT services to critical sectors like energy or healthcare could find itself in scope as a "designated critical supplier" under the CSR Bill. A similar model already exists for the EU and UK financial services sector (and 2026 will see oversight activities commence), but this creates challenges for technology suppliers that don't necessarily have visibility of how their services are used by customers. For businesses that are currently unregulated, the shift could be significant.
Predictions for 2026
- Oversight activities by regulators will increase, although the extent and severity of enforcement for non-compliance remains to be seen. Organisations will want to avoid being 'made an example of' under new regimes with significantly tougher penalties.
- Harmonisation challenges will persist, with organisations operating across the UK and EU needing to manage divergent requirements.
- More sector-specific guidance and best practice will emerge, providing clearer expectations but adding complexity for multi-sector businesses.
- UK authorities will continue to watch implementation of NIS2, and will hopefully address ongoing learnings in the UK's cyber regime (including under new powers for the Secretary of State which are intended to enable greater flexibility).
Universal relevance: beyond regulated organisations
Digital resilience matters for all organisations, regardless of regulatory status.
The Jaguar Land Rover incident serves as a stark reminder that cyber disruption can cripple operations, damage customer relationships, and tarnish hard-won reputations. When a ransomware attack disrupted JLR's systems, the impact extended far beyond IT - affecting production, supply chains, and customer service. The impact on the broader automotive manufacturing industry was significant.
Organisations outside the regulatory perimeter are recognising that digital resilience is fundamental to business continuity and strategy. Customers increasingly expect seamless digital services, and tolerance for outages is diminishing. Reputational damage from a significant incident can take years to repair, while operational disruption translates directly to lost revenue.
Predictions for 2026
- Board-level oversight of digital resilience will become standard practice. Governance structures within organisations may need to evolve, with resilience being embedded across organisations and business processes.
- Cyber insurance premiums will continue to rise, with insurers demanding evidence of robust (or at least baseline) resilience measures.
- Customer-facing businesses will compete on resilience credentials, making security and uptime a market differentiator.
High profile cyber incidents will continue
The cyber threat landscape is intensifying. The 2025 Annual Review by the UK National Cyber Security Centre (NCSC) reported 204 "highly significant incidents" in the year to September 2025, with a higher proportion of incidents supported by the NCSC (48%) classified as nationally significant.
Predictions for 2026
- Ransomware and multi-faceted extortion will intensify and remain the most financially disruptive cyber threats. Following consultation, the UK may seek to legislate to set up a ransomware reporting regime, a payment prevention regime and a ban on the public sector paying ransoms.
- Nation-state cyber operations will escalate globally, with foreign adversaries targeting utilities and critical infrastructure.
- Essential services will be subject to heightened threats to critical infrastructure and operational technology.
Critical services: prioritisation is key
The scale of the challenge means organisations are moving away from attempting to protect everything equally and towards risk-based prioritisation of critical services.
Resource constraints and the expanding threats make comprehensive protection unrealistic. Leading organisations are conducting rigorous assessments to identify their most critical services - those where failure would cause unacceptable harm to safety, security, economic stability, or societal wellbeing.
This criticality-based approach aligns with regulatory expectations under NIS2 and similar frameworks, which require entities to identify essential services and apply proportionate protective measures. In the financial services sector for example, the UK operational resilience regime focuses on identification, protection and recovery of "important business services".
Predictions for 2026
- Business impact analysis will become more sophisticated, incorporating interdependencies and cascading failure scenarios.
- Investment will concentrate on protecting critical services, with legacy systems receiving less attention unless they support critical functions.
- Resourcing and skills limitations will heighten pressure on organisations, increasing demand for specialist third-party support and adding to the existing skills shortage.
- "Resilience by design" principles will be embedded in new service development, rather than bolted on retrospectively.
Incident management and reporting obligations
Stringent incident reporting regimes are creating new compliance burdens. Reporting duties will arise for a broader range of incidents such as availability and operational incidents, where previously data protection was the primary reporting regime (outside of specific sectors like financial services).
The recent CSR Bill in the UK would introduce tight reporting timelines: 24 hours for initial notification and 72 hours for full notification. The clock would start ticking from when the organisation first became aware of the incident. However, for complex incidents that develop at pace, even determining when an organisation is first aware or has detected an incident is often not straightforward. 24 hours does not allow much time.
Similarly in the EU, the NIS2 Directive introduced tight reporting timelines: early warning within 24 hours, incident notification within 72 hours, final report within one month. Despite intentions for more streamlined reporting using digital portals, in practice many Member States are still yet to build or open their incident reporting portals, and the prescribed format for incident NIS2 reporting can add additional pressures in already highly stressful circumstances.
These timelines demand well-rehearsed incident response capabilities and clear escalation procedures.
Beyond regulatory reporting, organisations face obligations under GDPR for personal data breaches, contractual notification requirements, and reputational imperatives to communicate transparently with stakeholders.
The European Commission is well aware of the issues and proposed a single-entry point for incident reporting including under the GDPR, NIS2, DORA, eIDAS as part of its Digital Omnibus proposal, however, this change is some way off as it would only be introduced 18-24 months after the publication of the Digital Omnibus proposal in the Official Journal – which in itself is some way off. See here for more on the Digital Omnibus.
Predictions for 2026
- Automated incident detection and reporting tools will become essential infrastructure to meet tight deadlines.
- Incident response playbooks will need to be tested regularly through realistic simulation exercises.
- Communication plans will become essential to manage internal and external comms as part of reputation management.
- Regulatory scrutiny of incident reports will intensify, with authorities using reported data to identify systemic weaknesses and target enforcement.
Managing supply chain risk
Third-party and supply chain vulnerabilities are increasingly recognised as critical resilience risks.
High-profile incidents such as Crowdstrike have demonstrated that attackers exploit supply chain relationships to access multiple victims simultaneously. Organisations are only as resilient as their weakest supplier, yet many lack visibility into their suppliers' security postures.
The UK's CSR Bill proposes new powers for regulators to identify and designate specific high-impact suppliers as "designated critical suppliers", and recognises that even much smaller suppliers can present a significant risk.
Both the UK's CSR Bill and the EU's NIS2 explicitly require entities to manage supply chain risks. This is driving a fundamental shift in procurement practices.
Predictions for 2026
- Supplier security assessments will become more rigorous. Organisations will need to find risk-based, scalable and proportionate ways to manage third-party risk, often with the challenge of limited resources.
- Contractual provisions will increasingly include specific security controls, incident notification obligations, and audit rights, where mandated under relevant legislation and industry guidelines.
- Supply chain mapping will extend beyond tier-one suppliers.
Artificial Intelligence: a double-edged sword for resilience
AI is simultaneously enhancing resilience capabilities and introducing new vulnerabilities.
On the positive side, AI-powered tools are improving threat detection, automating incident response, and enabling predictive risk analysis. Machine learning algorithms can identify anomalous behaviour that human analysts might miss, while AI-driven automation accelerates response times.
However, AI also presents risks. AI systems themselves can be targets for adversarial attacks, training data can be poisoned, and over-reliance on AI tools may create new single points of failure. Additionally, the use of AI by threat actors is making attacks more sophisticated and harder to defend against.
Recognising this, the UK government has developed a voluntary Code of Practice setting baseline security requirements, recognising that AI has distinct differences and presents security risks to software. Industry engagement shows some support for the Code, although uptake is still in early stages.
Predictions for 2026
- The 'AI arms race' between defenders and attackers will intensify. AI-powered attacks will increase, with adversaries embracing AI to enhance the speed, scope and effectiveness of their operations. AI-enabled social engineering and deep-fake services for business email compromise will escalate attacks on enterprise systems.
- AI-augmented security operations centres will become mainstream, with human analysts focusing on complex decision-making while AI handles routine tasks.
- Organisations will need to develop specific resilience measures for AI systems, including model validation, adversarial testing, and fallback procedures.
- More regulatory guidance on AI security will emerge, potentially as part of broader AI governance frameworks.
Conclusion: building resilience for an uncertain future
Digital resilience in 2026 will be characterised by regulatory complexity, universal relevance, and technological evolution. Organisations that thrive will be those that embed resilience into their culture and operations - not as a compliance exercise, but as a strategic enabler of trust, continuity, and competitive advantage.
The path forward requires clear-eyed risk assessment, focused investment in critical capabilities, robust incident management, careful supply chain governance, and thoughtful adoption of AI tools. As the threat landscape evolves and regulatory expectations rise, digital resilience will increasingly separate the prepared from the vulnerable.
