decrypted · 3 november 2026 · ransomware and cybercrime · vulnerabilities and patching · uk policy and law

The Lords beat the government on the Cyber Security Bill, and the gap is in design

The House of Lords has beaten the government twice on the Cyber Security and Resilience Bill, and the defeats show where UK cyber law is still thin. Peers wanted the law to keep pace with cloud and AI, while ministers wanted it narrower. For any director whose business leans on an outsourced IT firm, the detail matters more than the headline.

What the Lords voted for

Report Stage ended on 26 October 2026. By 202 votes to 155, peers backed Lord Birt's Amendment 163, which forces a review of the whole regime within 12 months of Royal Assent and annually after that. The review must consider adding cloud services, frontier AI, democratic processes and advanced manufacturing, and whether the AI Security Institute, the government's AI testing body, should get statutory powers. Ministers had offered a narrower review of critical national infrastructure, plus a full look after three years. Peers declined. A second defeat, reported by VinciWorks, backed a register of foreign powers that present cyber threats to the UK. The minister argued that a list of countries could create false certainty.

What the Bill actually does

The Bill widens the NIS rules, the network and information systems regulations for essential services, to cover data centre operators, digital service providers and managed service providers, the outsourced IT firms that run so many UK back offices. Those providers must keep affected customers updated after a reportable incident.

The government did narrow things. A reportable incident now means one that has actually adversely affected network and information systems, rather than one that could have. Mandatory near-miss reporting for data centres became a voluntary framework. Much of the detail waits for secondary legislation after Royal Assent.

The Secure by Design lesson

Picture a fire code that only counts buildings that burned down. Reporting after harm is useful, but it tells regulators about failure once the damage is done, and a law that ignores near misses never sees the smoke. Secure by Design asks the opposite question: what was decided at the drawing board so the fire could not spread?

The Bill mostly regulates the aftermath. Its most design-minded feature is the review, which admits that a fixed list of sectors ages the moment a new dependency, such as a frontier AI service, becomes critical. Ministers also accepted amendments on incidents involving loss of oversight or control of an AI agent, and promised a consultation.

What a director should do now

Nothing here is law yet. Third Reading in the Lords was listed for 2 November, which we could not confirm, and the Bill then returns to the Commons, where the two defeats may be contested. Meanwhile, ask your managed provider three plain questions: would you be told promptly, who holds your logs, and what happens to the near misses they never have to report? Answering them costs a contract clause, not a budget line. That is the whole price of acting early. Opinion, not advice.

Also this week

Ivanti Connect Secure, again. Ivanti's remote access VPN appliance has fresh flaws on the KEV, the list kept by CISA, America's national cyber security agency, of flaws known to be exploited in real attacks. Help Net Security reports that CISA added a local privilege escalation and a remote authenticated file upload. Cyber Daily says a third flaw, an authentication bypass, was also added; the two reports differ on that. Cyber Daily adds that the security firm Volexity found the attacks, by a previously unidentified threat actor, on an appliance that was fully patched at the time, on version 22.8R2.4. It also reports Rapid7 saying the 13 October fixes in 25.1.1.2 and 22.8R2.5 do not remediate the first two flaws, and that Ivanti advises moving from 22.8.X to 25.1.1.3 or later, or applying 22.8R2.6 if that is not possible. Help Net Security describes the attackers stealing credentials and searching for local administrator passwords and BitLocker keys. Any UK organisation running one should check its version rather than assume last month's patch held. The design lesson is blunt: a box on the internet's edge should not be able to reach the keys to everything behind it.

A reprimand worth rereading. From earlier this month rather than this week: the ICO, the Information Commissioner's Office and the UK's data regulator, reprimanded Ogi Networks and Data Cymru after a ransomware attack on 1 November 2024 exposed the data of 3,300 people, mostly children. The way in was a test account created in 2012 with the password "Password1". The ICO said that password "is a wide-open door to nefarious actors". It also found Data Cymru lacked a compliant processing contract with its IT provider. No fines followed. The cheap control was an account audit that nobody ran, and the account nobody remembers is the one an attacker finds first.

Sources

If you want help working out what a supplier would tell you after an incident, get in touch.