A major cyberattack on the UK is considered to be a matter of ‘when, not if’ – how prepared is the public sector today and what more needs to be done to improve the cyber resilience of the UK’s critical national infrastructure to protect against this ever-imminent threat?