Watchdog Warns UK Police and Fire Services Must Urgently Improve Cybersecurity

Britain’s police forces and fire and rescue services are being told to treat cybersecurity as a core part of the job, not as a technical side issue. A new report from His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS), published on 27 October 2026, says the cyber threat to both services is significant and expanding rapidly, and that many forces and services still need to urgently redouble their efforts. The warning lands at a moment when public services hold more sensitive digital data than ever before, and when a single successful attack can disrupt operations, put people at risk, and cost a large amount of money to put right.

What the watchdog found

The report, titled Cybersecurity in Police Forces and Fire and Rescue Services, is based on a three-phase inspection carried out between January and May 2026. Inspectors spoke to dozens of people, carried out what they call reality testing, and examined more than 260 police and fire service documents. That is a wide evidence base, and it gives the findings weight. The headline message is mixed rather than purely bleak. Inspectors say there have been gradual improvements, but they also say progress is uneven and too slow in places where the risk is highest.

Michelle Skeer, His Majesty’s inspector of constabulary, put the point plainly. She said cybersecurity should be viewed as a core organisational priority and not solely a technical risk, and that leaders need to prioritise and invest in their cybersecurity arrangements so their organisations can prevent, detect, respond to, and recover from attacks. In other words, buying a new security tool is not enough on its own. The way leaders plan, fund, and talk about cyber risk matters just as much.

The report also stresses that a major cyberattack on a police force or fire service is not a hypothetical scenario. According to the inspectorate, successful attacks have already been disruptive, have put the public at risk, and have been expensive to fix. That framing matters because it moves the conversation away from abstract warnings and toward something operational leaders can recognise: lost systems, delayed responses, and long recovery work.

Legacy systems and third-party risk

One of the clearest problems inspectors identified is old technology. Legacy ICT systems were described as a strategic risk, largely because they are hard to patch and hard to connect to newer, more secure systems. A system that still works day to day can quietly become the weakest link, because the vendor may no longer support it and replacing it outright can feel too costly or too disruptive to attempt.

Third-party risk sits alongside that. Police forces and fire services rely on outside suppliers for much of their technology, including suppliers that handle sensitive police data. Inspectors also flagged basic control issues: underdeveloped backups and incident response, plus access management and accounts that are not closed promptly. These are unglamorous topics, but they decide whether an attacker who gets in is stopped quickly or can move around freely.

The leadership gap

Perhaps the most striking finding is about leadership rather than technology. Inspectors found that several senior police and fire leaders they interviewed did not consider cybersecurity to be part of daily operational decision-making. Financial investment, the report suggests, has instead been directed toward other, more operational and tangible priorities. That is understandable in services under constant pressure, where a new vehicle or extra staff feel more visible than a security upgrade. It is also, in the inspectorate’s view, part of the problem.

Senior leaders in both services often come from operational backgrounds, with deep expertise in operational risk. The report found that many of them rely on younger, less experienced staff who know more about IT to identify and explain cybersecurity risks. That creates a gap between the people who understand the risk and the people who control the budget, and until it closes, cybersecurity will keep losing out to priorities that are easier to see and explain.

What inspectors want to change

The report makes a series of recommendations. It calls for all police forces and fire services to reach baseline standards for cybersecurity, so that the level of protection does not depend on where a person happens to live. It also calls for better management of third-party contractors, and for a national centre for digital management for the fire service, similar to the centre that already exists for policing.

The timing also matters. The report notes that major reform of the police service and an overhaul of local government could offer a chance to improve cybersecurity arrangements, if leaders use the moment while structures are already changing.

Why this matters for the public

For most people, this report will never be read in full, and that is fine. What matters is what happens next. Police forces hold some of the most sensitive personal information in the country, from victim details to intelligence material. If those systems are disrupted, response times can suffer, records can be lost, and public trust can take a hit that is hard to repair.

The watchdog’s message, in the end, is not that police and fire services are failing across the board. It is that gradual improvement is not enough while the threat keeps growing. Readers who follow public service reform will want to watch whether the next inspection finds that gap closing, or finds the same warnings being repeated.

Frequently Asked Questions

What is the HMICFRS cybersecurity report about?

It is an inspection of cybersecurity in UK police forces and fire and rescue services, published on 27 October 2026. It is based on work carried out between January and May 2026, including interviews and scrutiny of more than 260 documents, and it warns that many forces and services must urgently improve their cyber defences.

Why did inspectors highlight leadership as a problem?

Inspectors found that several senior leaders did not see cybersecurity as part of daily operational decision-making, and that investment had gone to more visible operational priorities. They also found senior leaders often relied on junior technical staff to explain cyber risks, which left a gap between understanding the risk and funding the response.

What changes does the report recommend?

It recommends that all police forces and fire services reach baseline cybersecurity standards, that management of third-party contractors improves, and that a national centre for digital management is set up for the fire service, similar to the existing police centre.