Nine out of ten UK critical national infrastructure organisations were hit by a cyber attack in the past year. That is not a projection or a worst-case estimate — it is the headline finding of the Bridewell Cyber Security in CNI Report 2026, published this week. For the energy, water, transport, and financial infrastructure sectors, the message is unambiguous: this is no longer a risk to be mitigated at some point — it is a reality being managed right now.
For those of us working in cyber security recruitment, the data confirms what we have been hearing from clients for the past eighteen months: demand for specialist talent across OT/ICS, SOC, and AI-native security disciplines is accelerating sharply, and the talent pool is not keeping pace.
Bridewell CNI Report 2026 — Key Findings
93%
of UK CNI organisations experienced a cyber attack in the past year
50%
suffered IT outages or operational disruption as a direct result
11
average phishing or BEC attacks per organisation per year
39%
now cite AI-related risk as a top concern — entering the top tier for the first time
35%
cite regulation as the primary driver of cyber investment — up from 26%
The Scale of the Threat
The Bridewell findings put hard numbers on what security teams across CNI sectors have known anecdotally for some time. Attacks are not occasional — they are constant. With an average of eleven phishing or business email compromise (BEC) attacks per organisation per year, CNI security teams are operating under persistent siege conditions.
The 50% operational disruption figure is the one that should concern boards most. It means that for half of the UK's critical infrastructure operators, a cyber attack has already crossed from the digital realm into the physical — causing outages, halting processes, or forcing manual operations fallback. In energy generation and distribution, water treatment, or transport management, those are not inconveniences. They are public safety events.
The financial losses embedded in that disruption are substantial, though Bridewell notes that many organisations still struggle to quantify the true cost of a cyber incident — a gap that itself reflects resource and capability constraints.
AI: Both Weapon and Shield
The emergence of AI-related risk in the top tier of CNI concerns — cited by 39% of respondents for the first time — reflects a dual reality that security teams are having to navigate simultaneously.
On the threat side, AI is lowering the barrier to sophisticated attacks. Spear-phishing campaigns that previously required significant human effort to personalise and execute are now being generated at scale using large language models. Adversarial AI is enabling faster vulnerability identification and more adaptive attack payloads. The 11 phishing attacks per organisation per year figure likely underestimates what is coming as AI-enabled attack automation matures.
On the defence side, AI-driven security tooling — anomaly detection, automated threat hunting, predictive vulnerability prioritisation — is becoming essential in environments where the volume of events exceeds human analyst capacity. But deploying these tools effectively requires a skill set that sits at the intersection of security operations and AI/ML, and that combination is genuinely scarce.
Regulation as the New Driver
One of the more significant shifts in the Bridewell data is the rise of regulation as the primary driver of cyber investment. At 35% — up from 26% in the previous year — compliance has now overtaken the threat itself as the main reason CNI operators are spending on security.
This reflects the deepening reach of frameworks including NIS2, the UK's Cyber Assessment Framework (CAF), and sector-specific guidance from regulators including Ofgem, the Environment Agency, and the Civil Aviation Authority. NIS2's extended scope — drawing in more supply chain entities and imposing stronger board-level accountability — is creating significant new demand for governance, risk, and compliance professionals across every CNI sector.
The adoption gap is real, however. Bridewell notes that awareness of CAF and NIS2 implementation timelines is inconsistent, and that many organisations are operating with frameworks they know to be incomplete. Organisations that close this gap first will face a more competitive regulatory landscape with better-prepared workforces — and those that don't will face escalating audit exposure.
The Confidence Gap
Perhaps the most striking finding in the report is the disconnect around post-quantum cryptography. As quantum computing capability edges closer to a point where it could crack current encryption standards, CNI organisations face a long-lead transition to quantum-resistant cryptography — a process that, for complex operational technology environments, could take a decade or more.
Yet Bridewell's data suggests that confidence in readiness for this transition varies enormously — and that many organisations have not yet started assessing their cryptographic estate. The gap between the speed of threat development and the pace of organisational response is precisely the kind of structural risk that makes specialist cyber hiring not just a commercial decision but a strategic imperative.
What This Means for Cyber Security Hiring
For cyber security hiring managers and talent acquisition teams working within or supplying CNI sectors, the Bridewell data translates into four clear workforce demands:
- OT/ICS Security Engineers and Architects — The convergence of IT and OT environments across energy, water, and transport means demand for professionals with genuine operational technology depth continues to significantly outpace supply. Compensation for candidates with verifiable OT/ICS credentials continues to move upward.
- SOC Analysts (Tier 2–3) and Threat Hunters — The volume and sophistication of attacks on CNI environments is driving investment in SOC capability upgrades, with particular demand for Tier 3 analysts and threat hunters who can operate in complex, hybrid IT/OT environments.
- AI Security Specialists — The emergence of AI risk as a top-tier concern is creating a new hiring category at the intersection of security operations and machine learning. Organisations need professionals who can both evaluate AI-driven security tooling and defend against AI-enabled threats.
- GRC Professionals with CNI/NIS2 Experience — Regulatory investment is driving demand for governance, risk, and compliance specialists with sector-specific regulatory knowledge, particularly NIS2, CAF, and IEC 62443 frameworks.
Across all of these disciplines, the talent market is tight. The pipeline of candidates with genuine CNI security experience — as opposed to adjacent IT security backgrounds — is narrow, and the lead times for building it are long. Organisations that are not actively building cyber talent pipelines now will find themselves competing for the same small pool of candidates when urgency strikes.
At Envo Talent, our Cyber Security practice works exclusively within these disciplines. We have built specialist networks across OT/ICS, SOC, threat intelligence, and GRC, and we work with CNI operators, managed security service providers, and defence contractors on some of the most technically demanding searches in the market. If you're building a CNI security team or strengthening an existing capability, we'd like to talk.
Explore our Cyber Security practice or book a discovery call to discuss your hiring requirements.
Source: Bridewell Cyber Security in CNI 2026, as reported by IT Security Guru, 19 March 2026.