The UK government is pushing ahead with its AI ambitions yet is dragging its feet on replacing aging IT systems that leave departments vulnerable to cyberattacks, according to a damning assessment from Parliament's spending watchdog. Sir Geoffrey Clifton-Brown, chair of the House of Commons Public Accounts Committee (PAC), warns in his second annual report that Whitehall is failing to tackle its longstanding technology problems, even as AI gives criminals and hostile states new ways to attack government systems. "AI is approaching government like a tsunami, and I remain sceptical that government is prepared for the enormity of this challenge," Clifton-Brown writes. The Conservative MP says ministers have announced reforms to improve digital capability but have yet to explain how they will close the civil service's skills gap, or when. He also fears another Whitehall reshuffle, this time involving the creation of the Department for Business, Innovation, Science and Trade, will make matters worse. The numbers aren't encouraging. Just 6 percent of civil servants work in digital and data roles, well short of the government's 10 percent target. Senior specialists are particularly thin on the ground, and the PAC warns that meeting the target will mean recruiting, and retaining, many more of them. And then there's the technology itself. "Government is also showing a worrying lack of urgency in addressing the long-standing issue of legacy IT systems, which create significant risks for its cyber security and mean it cannot reap the benefits of new technologies," the report states. The report also warns that generative AI is giving fraudsters increasingly sophisticated tools, while government departments risk falling further behind. Fraud and error already cost taxpayers an estimated £55 billion to £81 billion annually, according to figures cited by the PAC. Clifton-Brown isn't impressed with efforts to reduce those losses either. The Department for Work and Pensions reckons it overpaid £9.9 billion in benefits through fraud and error in 2025-26, or 3.2 percent of its spending. Its plan is to get that down to 2.8 percent by 2028-29, but Clifton-Brown points out that even if that succeeds, billions will still be going out the door. Things aren't looking much better at the Home Office, where years of asylum backlogs and mounting costs have prompted what Clifton-Brown calls "counterproductive quick fixes." The Home Office and Ministry of Justice spent around £4.9 billion on asylum in 2024-25, and ministers have since promised an entirely new system without explaining how it will work. That criticism comes as digital rights campaigners at Open Rights Group have called for the Home Office to scrap its AI asylum tools over concerns about accuracy, transparency, and human oversight. Elsewhere, the report offers another reminder that government IT modernization has a habit of going wrong. Take National Savings & Investments (NS&I), which began overhauling its IT in 2020 in the hope of cutting running costs. By December 2024, the price tag had reached an eye-watering £3 billion, £1.3 billion more than first expected. The project has been rated red since 2022-23, meaning successful delivery looks unlikely, and NS&I couldn't even give MPs an up-to-date spending figure or a realistic completion date. The Bank of England, by contrast, managed to overhaul its Real-Time Gross Settlement system for £431 million, finishing the job in April 2025. The PAC was impressed enough to direct its recommendations at Whitehall rather than the Bank, suggesting ministers might want to take notes. Whitehall could start by applying those lessons to the systems it already runs. ®

The US Cybersecurity and Infrastructure Security Agency (CISA) has killed many of the industry partnerships it used to enhance security, but don't tell the organization's acting director. Speaking on Tuesday at a virtual public sector cyber resilience summit hosted by infosec firm Rubrik, Nick Andersen claimed that CISA’s public-private partnerships are the most critical aspect of his agency’s mission. “We don’t see everything. We’re not a law enforcement agency, intelligence agency, or a regulator,” Andersen said during a discussion at the summit. CISA, he added, relies on intelligence and insight not only from other government agencies and international partners, but from the private sector as well. CISA’s mission simply can’t succeed without motivating those various partners to share what they’ve seen, heard, and dealt with in order to build a comprehensive threat model. “It’s all carrots and partnerships,” Andersen added, referring to motivating partners to get on board with programs like CISA’s CI Fortify initiative for building resilient critical infrastructure. Were that actually the case, we wouldn’t really have a story to write here, but anyone who’s been following CISA’s trials and tribulations during the second Trump administration is likely to have raised an eyebrow at Andersen’s claims. Trump returned to office riding a wave of plans to cut government spending, which included massive reductions at CISA. Among the first CISA programs axed was the Cyber Safety Review Board, a public-private body set up by the Biden administration. In addition to that closure, the Trump administration also shuttered the Artificial Intelligence Safety and Security Board, Critical Infrastructure Partnership Advisory Council, National Security Telecommunications Advisory Committee, and US Secret Service Cyber Investigations Advisory Board, all bodies consisting of government and private players working together toward cybersecurity goals. Some of those bodies have since been stood up again or reformed under new names, wasting time and money that could have been better spent by cyber defenders doing things like, you know, advising CISA and other government agencies on security matters. CISA also terminated funding for and ties to the Center for Internet Security in late 2025. One of CISA’s bodies affected by the cut was the Multi-State Information Sharing and Analysis Center, a public-private partnership that shares threat intelligence and filters essential alerts down to the local government level. CISA staff has also been slashed considerably, with around a third of the Agency’s headcount, about 1,000 people, departing since Trump returned to office. CISA has since committed to rehiring around 300, but the Trump administration’s most recent budget request proposes eliminating an additional 900 positions at the agency, along with slashing nearly a billion dollars from CISA’s 2027 budget. When we asked about the apparent contradiction, CISA reached out to point us to initiatives like its reformed councils, CI Fortify, and security exercises it hosted with industry partners to test cyber resilience to point to the continued priority the agency places on its public-private partnerships. “CISA works with critical infrastructure owners and operators to assist them in securing both the physical security and cybersecurity of the systems and assets that support essential services,” an agency spokesperson told us. “Our regional teams assist industry and government partners across the country by assessing risks, helping entities bolster defenses and improve resilience, and responding promptly to threats.” But with so many outreach employees and general staff still missing, Andersen’s claims ring a bit hollow. Either the acting administrator is misrepresenting the continued importance of private industry partnerships at CISA, or he’s in denial about the state of his agency. Neither is great, especially with more budget and staffing cuts looming, and the price will be unprepared critical infrastructure. ®