The Public Sector’s Complete Guide to Cybersecurity Awareness Month 2025

October is Cybersecurity Awareness Month, a global initiative highlighting the importance of digital safety. For public sector organisations - local councils, NHS trusts and government departments - cybersecurity is not just an IT concern; it’s vital for protecting sensitive citizen data, maintaining public trust and ensuring uninterrupted service delivery.

Contents:

1. 2025 in Numbers 
2. The Evolving Cyber Threat Landscape
3. The Impact of AI on Cybersecurity
4. Regulatory Landscape and Compliance
5. Best Practices for Cyber Hygiene
6. Phishing Case Studies
7. Spot the Phish: Mini Quiz for Public Sector Staff
8. Cybersecurity Downloadable Checklist for You ✅
9. What to do if a Cyber Attack Happens
10. Tailored Cybersecurity Training For Teams
11. Spot the Phish: Mini Quiz Answers

2025 in Numbers: UK Public Sector Cybersecurity Snapshot

🔒 Public sector cyber incidents increased by over 30% in the past year.

🔒 283,000 businesses and 29,000 charities reported being victims of cybercrime in the past year, with 20% of businesses and 14% of charities affected

🔒 60% of IT leaders in the UK public sector see a successful cyber-attack as inevitable.
🔒 1 in 5 breaches originated from phishing attacks targeting employees.

🔒 Over 70 new cybercriminal groups emerged in 2025, targeting public sector organisations.

🔒 17.3 million data records were exposed in 30 publicly disclosed cyber incidents in August 2025 alone, affecting various sectors including government and healthcare

The Evolving Cyber Threat Landscape

In 2025, public sector organisations are increasingly targeted by cybercriminals. From local councils to NHS trusts, the threats are diverse and persistent. Common vulnerabilities include:

• Phishing Attacks: Deceptive emails designed to steal credentials or install malware.

• Weak Passwords: Easily guessable passwords remain a significant risk.

• Lost or Stolen Devices: Unprotected devices can lead to data breaches.

• Outdated Software: Failure to update systems exposes organisations to known exploits.

• Social Engineering: Manipulative tactics to gain unauthorised access.

These threats not only jeopardise sensitive data but also erode public trust in essential services.

The Impact of AI on Cybersecurity

Artificial Intelligence (AI) is reshaping the cybersecurity landscape. While AI enhances service delivery, it also introduces new risks:

• Deepfakes and AI-Generated Media: Crafting realistic impersonations to deceive staff.

• AI-Enhanced Phishing: Tailored attacks that are harder to detect.

• Automated Fraud: Generation of fake documents or communications to facilitate scams.

While AI introduces new cyber risks, it also offers powerful opportunities to strengthen public sector cybersecurity through smarter detection and faster response.

📖 Read more about how you can stay cyber aware in the age of AI in our recent blog

Opportunities:

• AI-driven threat detection and predictive security.

• Enhanced monitoring and incident response.

Public sector employees must be vigilant and adapt to these emerging threats to safeguard their organisations.

Regulatory Landscape and Compliance

Public sector organisations must comply with:

• UK GDPR: Protect personal data and report breaches promptly.

• NCSC Guidance: Practical advice for cybersecurity best practices.

• ISO/IEC 27001: Standards for information security management.

💡 Tip: Regular audits and compliance checks reduce risk and improve public confidence.

Best Practices for Cyber Hygiene

To mitigate risks, consider the following best practices:

1. Think Before You Click: Always verify the authenticity of links and attachments.

2. Use Strong, Unique Passwords: Implement passphrases and avoid reusing passwords.

3. Enable Multi-Factor Authentication (MFA): Add an extra layer of security to your accounts.

4. Keep Devices Secure: Lock screens and avoid leaving devices unattended.

5. Update Software Regularly: Ensure systems are patched to protect against vulnerabilities.

6. Report Suspicious Activity: Prompt reporting can prevent potential breaches.

7. Stay Informed: Regular training helps recognise and respond to new threats.
   
   

📝 Phishing Case Studies

Cybercriminals increasingly target public sector employees using deception and manipulation. Understanding real-world examples helps staff recognise threats and respond effectively.

Case Study 1: Fake HR Email - Credential Theft

• Scenario: Staff received an email claiming to be from HR, asking them to “verify” their payroll details via a provided link.

• Outcome: Several employees entered credentials, giving attackers access to internal systems.

• 🚩 Red Flags: Urgent request, unusual sender address, grammatical errors, suspicious link.

• Lesson Learned: Always verify requests through official channels and report suspicious emails.

Case Study 2: Ransomware via Malicious Attachment

• Scenario: A council employee received an email with an “invoice” attachment. Opening it deployed ransomware across multiple devices.

• 🚩Red Flags: Unexpected attachment, generic greeting, poor spelling or formatting.

• Lesson Learned: Never open attachments from unknown sources and ensure antivirus software is up to date.

Case Study 3: Social Engineering Phone Call

• Scenario: An attacker called an NHS staff member pretending to be IT support, requesting login credentials to “fix a system error.”

• Outcome: Partial access was granted, but the breach was caught due to internal monitoring.

• 🚩Red Flags: Pressure to act quickly, requests for credentials over phone, unfamiliar caller ID.

• Lesson Learned: Always verify caller identity through official channels before sharing sensitive information.

Spot the Phish: Mini Quiz for Public Sector Staff 

Instructions: Review the examples below and decide whether each email, message or scenario is legitimate or a phishing attempt. (Answers are at the bottom of this page)

Question 1: IT Update Notification

Subject: “System Security Update Required”
Body: “Your system requires an urgent security update. Please install the patch by clicking the link below. Failure to act will result in loss of access.”

• Legitimate or Phishing?

Question 2: IT Support Call

You receive a phone call from someone claiming to be IT Support, asking for your login credentials to “fix a server error.”

• Legitimate or Phishing?

Question 3: Meeting Invite

Outlook Calendar Invite: From a colleague you know, titled “Department Security Briefing” with a link to join a Teams meeting.

• Legitimate or Phishing?

Question 4: Survey

Subject: “Staff Wellbeing Survey - Win a Voucher”
Body: “Please complete this short wellbeing survey. Participants will be entered into a prize draw for an Amazon gift card.”

• Legitimate or Phishing?

Question 5: Newsletter Signup Confirmation

You signed up for a legitimate newsletter and receive a confirmation email with a link to activate your subscription.

• Legitimate or Phishing?

Question 6: Smishing (Text Message)

You receive a text: “Your bank account has been suspended. Click here immediately to resolve.”

• Legitimate or Phishing?

👉Go to Answers

What to Do if a Cyberattack Happens 🛡️

Even with strong cybersecurity practices, incidents can happen. A swift and structured response is crucial to minimise damage, protect sensitive data, and maintain public trust.

Here’s how public sector teams can respond effectively:

Step 1: Detect and Assess

• Recognise potential threats: Suspicious emails, unusual system activity or reports from staff.

• Assess severity: Determine whether it’s a minor issue, a potential breach or a critical incident affecting multiple systems.

• Tip: Use monitoring tools and logs to quickly identify anomalies.

Step 2: Contain the Threat

• Isolate affected devices: Disconnect compromised systems from networks to prevent further spread.

• Limit access: Restrict accounts and systems involved to prevent lateral movement.

• Tip: Avoid turning off devices unless instructed by IT - some evidence may be needed for investigation.

Step 3: Report Immediately

• Internal reporting: Notify your IT security team, line manager or designated incident response officer.

• External reporting: Follow regulatory obligations (e.g., report breaches under GDPR within 72 hours).

• Tip: Prompt reporting allows containment measures to be deployed quickly.

Step 4: Investigate and Remediate

• Gather evidence: Document what happened, when and how it was detected.

• Identify root cause: Determine how the breach occurred and which systems or data were affected.

• Remediate: Remove malware, reset passwords, patch vulnerabilities and restore systems from backups if needed.

Step 5: Communicate Appropriately

• Internal updates: Keep staff informed about precautions and next steps.

• External notifications: Notify affected individuals, stakeholders or regulatory bodies as required.

• Tip: Transparency builds trust - avoid unnecessary panic but don’t delay notifications.

Step 6: Review and Learn

• Post-incident review: Analyse what went wrong and what worked well.

• Update procedures: Revise policies, incident response plans, and training based on lessons learned.

• Continuous improvement: Schedule regular drills and simulations to improve preparedness.

Key Takeaway: A strong incident response plan transforms potential crises into manageable situations, reducing impact on public services and maintaining confidence in your organisation.

🔒 Tailored Cybersecurity Training for Public Sector Teams

At ModernGov, we specialise in providing bespoke cybersecurity training tailored to the unique needs of public sector teams. Our training sessions cover topics such as AI-driven threats, phishing simulations and best practices for handling sensitive data. By equipping your staff with the knowledge and skills to identify and prevent cyber threats, we help ensure your organisation remains secure in the digital age. Enquire now.

🎣Spot the Phish: Mini Quiz Answers

Question 1:
Answer: 🚩Phishing
Explanation: Real updates are pushed automatically by IT, not via links in emails.

Question 2:
Answer: 🚩 Phishing / Social Engineering
Explanation: IT staff should never request passwords over the phone. Always verify through official internal channels.

Question 3:
Answer: 🚩 Phishing (possible account compromise).
Explanation: Unexpected meeting, especially with a generic link rather than the official Teams integration.

Question 4:
Answer: 🚩 Phishing
Explanation: Use of prizes/incentives for surveys is unusual in public sector; link points to unfamiliar domain.

Question 5:
Answer: ✅ Legitimate
Explanation: Expected email from a known source; always check the sender domain to confirm legitimacy.

Question 6:
Answer: 🚩Phishing
Explanation: Creates urgency, uses fear to prompt action, and contains a suspicious link. Never click; contact your bank directly.

👆Go Back to Questions 

Key Takeaways

• Verify the sender - email addresses and phone numbers can be spoofed.

• Check for urgency and secrecy - attackers often pressure you to act fast.

• Don’t open unexpected attachments or click unknown links.

• Report suspicious messages immediately - early reporting prevents breaches.