The public sector’s AI transformation starts with cybersecurity

AI can supercharge the UK’s public services – but it needs a secure foundation first

The AI era is here and for the public sector it brings an opportunity to reimagine the delivery of vital services in healthcare, education, local government and more.

In some cases, it’s already happening. Health technology provider Volpara Health uses Microsoft AI technology to analyse mammography data and help clinicians better understand women’s breast cancer risk. In UK schools, AI is helping create better, more personalised learning experiences for students, while city planners are increasingly deploying it in the management of public utilities, traffic systems and emergency services.

However, with great potential comes great responsibility. To successfully integrate AI into the country’s public services, the sector must first establish a robust foundation of cybersecurity that protects the security and privacy of users.

Mind the gap
After all, it is not only the UK’s public and private organisations that are seeking to unlock AI’s incredible potential. Cybercriminals, too, see it as a way to launch ever-more sophisticated and networked attacks.

As Paul Kelly, director, Security Business Group at Microsoft UK, explains: “The public sector must be ready to fight fire with fire, deploying the same AI-enabled technologies being used by bad actors, to protect themselves and their customers from cyber-attacks.”

That advice could not be more timely. As the capabilities of AI rapidly expand, a recent study commissioned by Microsoft UK, entitled Mission Critical: Unlocking the UK AI Opportunity Through Cybersecurity, finds that just 11% of those surveyed in public sector organisations are currently using the technology to strengthen their cyber defences, a figure much lower than the national average of 27%.

Using a model of cybersecurity developed by independent researchers from Goldsmith’s, University of London, the study also reveals that just 13% of UK organisations overall, including many in the public sector, are currently resilient to AI’s shifting threat. Meanwhile, 48% are classed as vulnerable and 39% at high risk of falling victim to a breach.

This resilience gap goes further than simply jeopardising public organisations’ own security too. From health data to payment details, many public organisations handle thousands of citizens’ sensitive information every day, meaning any successful breach can have catastrophic effects on both service delivery and their relationships with the people and communities they serve.

Likewise, according to Goldsmith’s researchers, cyber-attacks currently cost the national economy at least £87bn every year, a key barrier to the UK’s aim of becoming a global AI superpower by 2030.

The road to resilience
Yet alongside the causes for concern lie reasons for optimism too. The Microsoft UK study finds organisations using AI-enabled cybersecurity are twice as resilient to attacks than those that do not. They also suffer 20% fewer costs when breached. Embedding these defences could therefore have a transformative effect on the sector’s security, finances and reputation.

As for how, the Microsoft UK study outlines five practical steps public organisations can take to bolster their cybersecurity and, in doing so, support the UK’s vision of AI leadership.

1 Understand the threat: constantly monitor and assess the organisation’s unique threat landscape, investing in AI solutions that help forecast risks and response. This includes budgeting for cybersecurity upgrades to keep pace with advancements in the technology itself.

2 Commit to widespread adoption: embed AI-enabled cybersecurity tools, such as Microsoft Copilot for Security, at the heart of the entire organisation’s operations, prioritising the detection and mitigation of risk.

3 Plan in advance: establish clear guidelines and protocols for recovery and business continuity following a cyber-attack, sharing them across the organisation. This can significantly reduce the operational, financial and reputational disruption of any breach.

4 Let workers experiment: everyone in the organisation has a part to play in protecting it, meaning they must all feel comfortable and confident using AI. Use safe spaces for experimentation to help staff overcome any fear of AI and create a culture of understanding and trust.

5 Identify the right talent: understand the capabilities required by an AI-enabled workforce, then look to the technology itself or to on-the-job training to equip employees with the necessary skills. This includes Microsoft’s free AI learning pathways in partnership with LinkedIn.

Securing the future
Laying this solid foundation of cybersecurity is vital for any organisation hoping to unlock AI’s benefits to build resilience to its shifting threat. As a sector operating within the very fabric of UK society, often supporting some of the country’s most vulnerable people, the need for public organisations to get the proper defences in place is supercharged.

Doing so will undoubtedly be worth it; AI offers a real and lasting opportunity to improve the quality, consistency and reach of public services, boost trust among citizens and increase both productivity and job satisfaction among under-pressure employees. For the public sector, a more efficient and more prosperous tomorrow awaits. But it has to be secured today.