At 2am on a quiet ward, the only thing separating a hospital's imaging system from a locked screen and a cancelled operating list is a piece of software nobody in the building has ever heard of. That gap, invisible until it matters, is where the NHS now finds itself concentrating its attention. Across the health service, cyber security teams are overhauling defences to meet a threat that has grown considerably more capable than the crude phishing emails of a decade ago, and the shift says as much about the state of Britain's public infrastructure as it does about the criminals probing it.

The reasons the NHS attracts attackers are not mysterious. It holds vast quantities of sensitive patient data, runs services that cannot simply be switched off, and depends on a sprawling, uneven estate of legacy systems and newer digital tools bolted together over years of underfunded IT investment. That combination of high value and operational fragility makes it an obvious target, and the tactics used against it have matured accordingly. Rather than mass phishing campaigns hoping to catch the unwary, attackers are now running targeted social engineering operations against IT help desks, impersonating staff to obtain password resets or system access, and probing internet-facing infrastructure for the kind of overlooked vulnerability that a smaller, better-resourced organisation might have patched months earlier. These are the same methods that brought down major retailers and manufacturers in recent high-profile breaches, a reminder that the weakest point in most systems is rarely the code itself but the human processes wrapped around it.

That last point is where NHS leadership has quietly revised its own thinking. The conventional cyber security narrative treats staff as a liability, the fallible click that lets ransomware through the door. Health service leaders are now making a more interesting argument: that frontline and IT staff, precisely because they know their own systems intimately, are often the first to notice when something is wrong. A scanner behaving oddly, an unfamiliar prompt, a support call that does not quite add up, these are early warning signs that trained staff can catch before a technical control does. The practical advice flowing from this is unglamorous but sound: apply scepticism to unexpected system behaviour, refuse to run unverified commands received online, and treat unsolicited software downloads with real suspicion. None of this is exotic. All of it depends on consistent training and a culture where raising a concern is easy rather than awkward, which is a leadership question as much as a technical one.

The centralising force behind this effort is the NHS Cyber Security Operations Centre, which gathers threat intelligence and pushes it out to integrated care systems and regional bodies so that an attack technique identified in one trust becomes a known pattern everywhere else within hours rather than weeks. This kind of coordinated intelligence sharing matters more with every year that passes, because the 10 Year Health Plan commits the service to a genuinely digital future built on artificial intelligence, data-driven care pathways and genomics. None of that ambition survives contact with a ransomware attack that takes a trust offline for a fortnight. Cyber resilience is not a supporting workstream to digital transformation; it is the precondition for it, and funding decisions in the coming spending review will test whether ministers understand that ordering.

There is a wider context that sharpens the urgency. National cyber authorities have recently warned of rising attacks on operational technology, the physical machinery rather than the back-office networks, and healthcare is unusually exposed on this front. Scanners, infusion pumps and automated laboratory equipment increasingly sit on networked systems that were never designed with today's threat environment in mind, and retrofitting security onto physical equipment is harder and slower than patching software. For NHS leaders, life sciences suppliers and policymakers alike, the implication is the same: procurement standards, not just IT policy, are now a matter of patient safety. A health service that wants to modernise cannot treat security as the last item on the list.

‍