Do you really know how secure your organisation is?

Cyber security is often discussed in terms of threats, attacks and emerging risks. But for leaders, one of the biggest challenges is far more fundamental: understanding their organisation's current position.

This is where cyber security posture data becomes invaluable. It moves conversations beyond assumptions and anecdotes, providing a clear picture of where controls are working well, where improvement is needed and how institutions compare against recognised good practice. That insight helps organisations prioritise limited time and resources where they will have the greatest impact.

The value of this data extends beyond individual organisations. When combined across the sector, it creates a powerful source of intelligence that helps identify common challenges, emerging trends and areas where collective action could strengthen resilience for everyone.

We are in a unique position to gather and share this collective intelligence, helping the sector defend as one. Operating the Janet network, which serves higher and further education and research organisations throughout the UK, gives us visibility across the sector – enabling us to build an overall picture of cyber security resilience in a way no other body can.

This wider view directly protects members by feeding into the work of our highly active, 3,000-strong cyber security community and the capabilities of our computer security incident response team (CSIRT) and security operations centre (SOC).

Essential data unlocks improvement and investment

You cannot improve what you cannot measure, and without reliable evidence about strengths, gaps and priorities, it is difficult to make informed decisions about investment, risk and resilience.

Having an accurate assessment of your cyber security maturity enables leaders to develop improvement plans and make persuasive internal cases for investment where needed.

Our annual cyber security benchmarking survey, now in its third year, is the only sector-wide exercise of its kind. It has been developed with the help of the National Cyber Security Centre (NCSC) and uses questions based on their established Cyber Assessment Framework (CAF), which defines what good cyber security looks like in practice.

For organisations connected to the Janet network, the survey offers a practical way to fulfil the annual self-assessment requirement set out in the Janet security policy, while also providing the evidence and insights needed to drive meaningful cyber security improvements.

Intelligence providing a basis for sector-wide action

The exercise delivers two key outcomes – individualised reports containing actionable insights for organisations, and wider intelligence that informs the work of our cyber security teams and the sector’s collective resilience.

Our annual sector cyber security reports, informed by the survey, are tailored for HE, FE and research, providing a clear picture of the most pressing priorities for each. These are shared with our member organisations and our cyber security community.

Last year’s data highlighted growing professionalism of cyber crime, exacerbated by criminals’ adoption of artificial intelligence, with ransomware and phishing identified as the top areas of concern.

This time around, I would expect AI-related concerns or threats to remain prominent, as the community remains alert to the rapidly evolving technology being deployed by cyber criminals.

Next steps

I encourage members to participate in this year’s survey, which is open from October 8 and closes in December, with reports expected around February 2027.

You can further explore how institutions can proactively prevent, detect and be ready for any incident at our Security Conference 2026, to be held on 24-25 November in Manchester and online.