The UK Government has delivered an unprecedented package of resilience strategy documents this month: The UK Government Resilience Action Plan, UK COVID-19 Inquiry Response – Module 1 Implementation Update, and Chronic Risks Analysis. As well as the UK National Security Strategy 2025, launched earlier in June. These publications demonstrate that the government has learned hard lessons from the devastating impacts of COVID-19 and is attempting genuine transformation to “close many of the gaps in our vulnerabilities and work together to make the UK a more resilient, more secure country.”
The scale of financial commitment is impressive – £4.2 billion for flood defences, over £1 billion for biosecurity infrastructure, and £520 million for life sciences manufacturing. The plan recognises that “government cannot do it alone,” marking a mature understanding of how modern risks work across organisational boundaries. But ambitious plans require rigorous implementation and robust oversight, and there is more work to be done. Below, we review key aspects of the government’s resilience plans, covering the positive progress and where we need to go further.
Resilience as a National Priority
The Progress: For the first time, resilience is explicitly positioned as a fundamental element of the National Security Strategy 2025, with “security at home” recognised as essential to national defence. The plan speaks of building “deep strength” and a “truly resilient country” as a societal endeavour, signalling that resilience has moved from the margins to the mainstream of government thinking.
Where We Need to Go Further: Despite this progress, resilience still feels like the junior partner to traditional security and defence. The plan positions resilience as supporting “security at home” rather than as an equal pillar of national strategy. This matters because it affects resource allocation, ministerial attention, and public understanding.
Britain should position resilience alongside security and defence as an equal component of our deterrence posture. A resilient nation that can bounce back quickly is inherently a harder target and this connection needs to be made explicitly.
Governance
The Progress: The establishment of a three-tier assurance model represents genuine structural improvement, and is a welcome reflection of our previous policy recommendations which have consistently called for the deployment of a three-line approach. The first and second tiers have been strengthened through cross-cutting catastrophic risk boards focused on whole-of-system risks, while the third tier introduces external expert panels to review risk preparedness. Crucially, reports from these external expert panels will be published, adding transparency to what has traditionally been an opaque process.
The Chronic Risks Analysis provides clearer frameworks for long-term risk ownership across government departments, recognising that the categorisation of chronic risks helps departments understand their responsibilities.
Where We Need to Go Further: While these reforms address some UK COVID-19 Inquiry criticisms, four critical governance gaps remain that would significantly strengthen the UK’s ability to manage extreme risks:
- National Security Adviser Title Reform: Add resilience to the title of the NSA, making them the National Resilience and Security Adviser. This would signal that resilience has equal priority with traditional security threats and ensure resilience considerations are embedded at the highest levels of national security decision making.
- Chief Resilience Officer: Appoint a government Chief Resilience Officer at Deputy National Security Adviser level. In 2022, the UK Resilience Framework recommended installing a CRO in every Local Resilience Forum. The plan reinforced government commitment to this through “stronger LRF trailblazers” in five areas with “Permanent Chief Resilience Officers.” This recommendation recognises the need for dedicated resilience leadership at the local level, and we remain disappointed that this logic has not been extended to the national level, despite previous recommendations from the House of Lords Committee on Risk Assessment and Risk Planning, the JCNSS, the National Preparedness Commission and ourselves.
- AI Security Coordination Unit: Establish an additional coordination unit in Cabinet Office to coordinate ownership of cross-cutting AI risks, modelled on the successful Biological Security Coordination Unit. The AI governance landscape is currently fragmented across multiple departments and agencies, yet AI risks increasingly cut across all aspects of national resilience.
- Independent Statutory Body: Create an independent statutory body to provide scrutiny of the government’s risk management, established through a National Resilience Act. The government rejects this COVID-19 Inquiry recommendation, arguing it cannot “outsource” responsibility. However, independent oversight shouldn’t mean outsourcing, it means robust, informed challenge. For extreme risks like advanced AI systems or engineered pandemics, where the stakes are potentially catastrophic and the timelines compressed, we need institutional mechanisms that can provide urgent, authoritative challenge to government assumptions and preparedness.
Assessment
The Progress: The Resilience Action Plan’s commitment to develop a baseline resilience measurement will create a consolidated, data driven picture of our resilience baseline, considering individual, household, local and national resilience indicators. This will allow us to assess the success of various initiatives, which has been previously impossible.
The establishment of a Cyber Resilience Index specifically targeting Critical National Infrastructure will provide a cross-sector, holistic overview of cyber resilience for UK CNI to target resilience building efforts. The groundbreaking Chronic Risks Analysis document identifies 26 chronic risks, and the accompanying guidance provides systematic scenarios and impact mapping showing how chronic and acute risks interact.
The piloting of the new risk assessment methodology based on preparedness is promising, with delivery taking place during autumn 2025, before a full assessment of response capabilities during January and February 2026. The development of a “Risk Vulnerability tool” by Cabinet Office and the Office for National Statistics to estimate the number of individuals vulnerable to selected risks is a welcome response to the COVID-19 Inquiry’s recommendations.
Where We Need to Go Further: The National Risk Register 2025 still doesn’t adequately address AI threats despite their rapidly growing significance to national security and resilience, and their capacity to outpace safety measures, mentioned in the Chronic Risks Analysis. Acute AI risks should be added to the NRR urgently.
We agree with the National Preparedness Commission, who note that whilst the “NRR 2025 does at least list the chronic risk categories,” the methodology for “combining or cascading risks” remains “unclear.”
Chronic risks should be added to the NRR as a distinct section covering a longer time horizon, rather than published as a separate report – and effectively kept in a separate register. Practitioners need unified risk assessment tools.
The government needs to do more work to clarify risk ownership and mitigations by sector in its risk registry. The NRR lacks sufficient detail and businesses and local responders need more actionable guidance on who owns which risks and specific strategies for their sectors.
Overall, there is a worrying lack of acknowledgement in these outputs of the i) severity, ii) acuteness and iii) breadth of impacts that frontier AI could bring. They should reflect the level of expectation we are seeing from No.10, which foresees significant impacts from AI in every sector within a few years. They also need to get to grips with the increasingly rapid release of radically different generations of technology which AI development entails. This demands a continuous and iterative approach to related risk assessment across both acute and chronic categories.
Exercising
The Progress: The government’s commitment to annual Tier 1 exercises represents a fundamental shift. The national exercise for 2025, PEGASUS, will be a pandemic preparedness exercise and is set to be the biggest in UK history. It will test our ability to respond to a pandemic arising from a novel infectious disease, moving away from our previous over commitment to influenza preparation.
Future exercise selection will be responsive to changes in the National Security Risk Assessment (NSRA), ensuring we test against current priorities. The findings from the PEGASUS exercise will inform the DHSC Pandemic Preparedness Strategy, which is set to be published in autumn this year.
Where We Need to Go Further: Internal assessment risks institutional blindness – we need outside experts to spot what government participants might miss. The current 12 month timeframe for publishing results is far too slow. Lessons lose urgency and momentum when they take a year to emerge. We need findings published within 3 months, as recommended by the COVID-19 Inquiry.
Exercise recommendations must be allocated to specific individuals or organisations with defined timelines, both inside and outside government, to ensure implementation. We need a formal action plan post-PEGASUS with a designated authority responsible for driving implementation of identified improvements and addressing capability gaps.
Critical National Infrastructure (CNI)
The Progress: The development of the CNI Knowledge Base represents world leading innovation, creating “an interactive map of all CNI in the UK” that will help the government “understand vulnerabilities between the 13 CNI sectors, not just within them.”
We welcome investment in securing telecoms networks, which demonstrates the Department for Science, Industry and Technology’s £370m commitment to better secure the UK’s telecommunications networks through research and investment in new technology and infrastructure.
Where We Need to Go Further: Sectoral regulators should be required to receive regular vulnerability assessments of CNI by operators, involving stress testing against realistic scenarios. Without this regulatory backstop, the valuable insights from the CNI Knowledge Base may not translate into actual resilience improvements on the ground.
Biological Security Strategy
The Progress: The integrated approach spanning fifteen outcomes, including the Biothreats Radar, UK Microbial Forensics Consortium, and National Biosurveillance Network demonstrates comprehensive planning for biological threats. The commitment of over £1 billion to maintain national biosecurity infrastructure (National Biosecurity Centres) demonstrates that the government has internalised the lesson that prevention is better than cure and that maintaining such capabilities remains critical to national security and resilience.
Annual parliamentary reporting on strategy implementation provides crucial accountability, while the development of respiratory response plans by DHSC shows the Government is learning from COVID-19’s specific characteristics and the COVID-19 Inquiry Module 1 report.
Crucially, biosecurity features as one of the seven key chronic risk themes, providing long-term context for biological threats beyond immediate pandemic response.
Where We Need to Go Further:
Three concerns remain: ensuring the strategy is properly resourced, that comprehensive implementation updates are delivered and that outcomes are geared for successful delivery. The success of the UK Microbial Forensics Consortium and the National Biosurveillance Network will require sustained investment over many years, along with clear capability sponsorship to pull them through. They will remain vital to the UK in maintaining effective deterrence as well as a comprehensive biosecurity threat radar.
Supply Chain
The Progress: We welcome the establishment of a new Supply Chain Centre to diagnose acute vulnerabilities, which addresses a critical gap exposed by COVID-19 and the war in Ukraine. The £520 million Life Sciences Innovative Manufacturing Fund specifically targets pandemic preparedness gaps in medical countermeasures. The Economic Security Advisory Service will provide a new mechanism for government-business collaboration on supply chain resilience.
Where We Need to Go Further: The plan lacks a comprehensive strategy to boost supply chain resilience for medical countermeasures. The current investments, while welcome, need systematic coordination to ensure reliable access to essential medical supplies during future crises, including incentives for domestic production and strategic stockpiling arrangements. We call for a more detailed exploration of the economic and resilience benefits of reshoring critical production.
Communication and Education
The Progress: We welcome the commitment to increased transparency and engagement with the public on risks faced by the UK. Increasing the profile of the Prepare website and regularly testing the Emergency Alert system is a promising step towards opening the national conversation around resilience.
We are excited by the publication of the results of the first annual public survey of risk perception, resilience and preparedness. Establishing baseline public perception levels is an important part of understanding our current state of national resilience – without this, it will be difficult to evaluate the impact of public communications going forward.
Where We Need to Go Further: Preparedness and resilience should be added to the National Curriculum. Research consistently shows that preparedness education in schools serves as both an individual protection mechanism and a community wide resilience strategy. Addressing these topics in formal education creates a multiplier effect that transforms individual students into community assets, as children carry these essential skills home to their families and communities.
The current gov.uk/prepare website misunderstands how people engage with preparedness information. It functions as a passive repository of checklists and guidance that users must actively seek out, rather than an integrated system that embeds preparedness into people’s daily digital routines.
To meaningfully contribute to national resilience, the platform needs to evolve into an interactive, personalised preparedness ecosystem that provides live location-specific risk alerts, connects users to local resilience networks, and transforms preparedness from an abstract concept into actionable, contextual guidance.
The government could dramatically expand its preparedness reach by leveraging the digital platforms where people already spend their time – integrating preparedness messaging into social media feeds through targeted content on TikTok, Instagram, and YouTube for younger demographics, whilst developing simplified mobile apps or delivering information through trusted intermediary channels like health apps, banking platforms, and utility company communications could allow greater engagement with older demographics.
The Path Forward
The UK Resilience Action Plan represents genuine progress in building national resilience. Its whole-of-society approach, significant financial commitments, and recognition of interconnected risks mark a mature response to 21st-century challenges.
But good plans require great implementation. The test of this strategy will not be in its impressive scope but in whether it drives real change in how Britain prepares for, responds to, and recovers from the disruptions that will inevitably come.
Our recommendations – from establishing a Chief Resilience Officer to adding resilience to the National Curriculum – would strengthen what is already a solid foundation. More importantly, they would help embed resilience thinking throughout society, moving beyond government initiatives to create a truly resilient national culture.
In an age of unprecedented threats, half-measures are not enough. This plan takes us further than we’ve ever gone before in building national resilience. Now we must ensure it goes far enough to meet the challenges ahead.
Photograph credit: Pei Yan//Shutterstock
