Cyber Resilience Starts with People: Why Training is the Critical Defence Layer for Critical National Infrastructure

Five years ago, following a major Facebook outage caused by a network administration error, I wrote a blog that focused on a single word:

Resilient.

Looking back today, despite enormous advances in cloud computing, digital transformation, OT connectivity and the emergence of AI, the same lesson still applies. The recent wave of high-profile vulnerabilities, outages and cyber incidents demonstrates that while technology has evolved dramatically, the fundamental challenge has not changed: organisations must be able to withstand, respond to and recover from disruption. AI may now be influencing both attackers and defenders, and our dependence on digital systems continues to grow, but the core principles of confidentiality, integrity and availability remain unchanged.

Five years is a lifetime in technology, yet every major incident reminds us that resilience is still the foundation of effective cybersecurity. The tools may be different, but the objective remains the same: ensuring that critical services and infrastructure can continue to operate when the unexpected happens. 

You can read the original blog, "R is for Security," here.

The Growing Imperative for Cybersecurity Training in CNI

Cybersecurity within Critical National Infrastructure (CNI) has become a board-level concern across the UK and Europe. Energy grids, water utilities, transport systems, healthcare networks, communications providers, manufacturing plants, and industrial facilities are increasingly dependent on interconnected Operational Technology (OT) and Industrial Control Systems (ICS). While this connectivity delivers efficiency and innovation, it also expands the attack surface available to cybercriminals, nation-state actors, hacktivists, and insider threats.

The UK's National Cyber Security Centre (NCSC) has repeatedly warned that the gap between the threats facing critical infrastructure and the ability of many organisations to defend themselves continues to widen. The NCSC identifies ransomware, sophisticated nation-state activity, supply-chain compromise, and attacks on industrial environments as key risks to national resilience.

Across Europe, the European Union Agency for Cybersecurity (ENISA) reports that 73% of targeted organisations in recent significant cyber incidents fall within sectors classified as "essential" or "important" under NIS2 regulations. ENISA also highlights ransomware, distributed denial-of-service (DDoS) attacks, vulnerability exploitation, and AI-enabled cyber operations as dominant threats facing critical sectors.

Against this backdrop, one fact is increasingly clear: technology alone is not enough. Organisations need skilled professionals, informed executives, capable incident response teams, and operational personnel trained specifically for industrial environments.

Cyber resilience starts with people.

The Current Threat Landscape: OT and ICS Under Pressure

Historically, industrial control systems operated in relatively isolated environments. Today's reality is very different. Business requirements have driven integration between IT and OT networks, remote access technologies, cloud services, Industrial Internet of Things (IIoT) devices, and third-party support providers.
This convergence has created significant opportunities but also substantial risks.

Threat actors increasingly target industrial environments because disruption creates immediate economic and societal consequences. Attacks against power generation, water treatment facilities, transportation systems, and healthcare providers can affect millions of citizens and potentially create physical safety impacts. The NCSC warns that cyber attacks against critical systems can generate real-world consequences beyond traditional IT disruption.

Meanwhile, geopolitical tensions continue to drive cyber activity across Europe. State-sponsored groups linked to countries such as Russia, China, Iran, and North Korea continue to target government, defence, energy, telecommunications, and industrial sectors. The war in Ukraine has further demonstrated how cyber operations increasingly accompany broader geopolitical conflict.

The Rise of AI-Enabled Threats

Artificial Intelligence is rapidly changing both attack and defence.

ENISA's latest threat assessments indicate that AI is increasingly being used to support malicious cyber operations.

AI can help attackers:

• Generate convincing phishing campaigns
• Automate reconnaissance activities
• Identify vulnerabilities more rapidly
• Develop more sophisticated social engineering attacks
• Support malware development and evasion techniques
• Scale attacks at lower cost and higher speed

While AI is lowering the barrier to entry for cybercriminals, it is also being adopted by defenders for anomaly detection, threat intelligence analysis, vulnerability management, security monitoring, and incident response.

The challenge for CNI organisations is ensuring their workforce possesses the skills to understand, manage, and defend against this evolving threat landscape.

Why CNI Outages Matter More Than Traditional Cyber Incidents

The consequences of a successful cyber attack in a CNI environment are fundamentally different from those experienced in traditional corporate IT.

A ransomware attack against an office environment may lead to financial loss and operational disruption. An attack against a power grid, water treatment facility, railway signalling system, or healthcare network can impact public safety, economic stability, and national security.

Governments across the UK and EU increasingly recognise cyber resilience as a critical component of national resilience.

The UK's Cyber Security and Resilience Bill is being introduced specifically to strengthen protections around essential services and critical digital infrastructure. The legislation seeks to improve cyber security requirements, incident reporting obligations, and oversight capabilities to ensure greater resilience against cyber threats.

Similarly, the EU's NIS2 Directive establishes enhanced cybersecurity obligations across eighteen critical sectors, including energy, transport, healthcare, water, public administration, communications, and digital infrastructure. It introduces stronger governance requirements, incident reporting obligations, and greater accountability for senior leadership.

The underlying message from regulators is clear: cyber resilience is now a business responsibility, not merely a technical one.

The Training Challenge: Different Audiences Need Different Skills

One of the most common mistakes in cybersecurity training is assuming a single programme fits everyone.
Effective CNI cyber resilience requires tailored education at multiple levels.

1. Technical Cybersecurity Professionals

Security analysts, engineers, architects, and OT specialists require advanced technical skills including:

• ICS and SCADA architecture
• Network segmentation
• Industrial protocols
• Threat hunting in OT environments
• Vulnerability assessment
• Secure remote access
• Incident response for industrial systems
• Industrial malware analysis
• IEC 62443 implementation

These personnel must understand not only cybersecurity but also industrial processes and safety considerations.

2. Information Security Managers

Managers need broader expertise in:

• Cyber risk governance
• OT security strategy
• Compliance management
• Supply chain security
• Business continuity
• Security operations oversight
• Third-party risk management
• Regulatory reporting requirements

Their focus is translating technical risk into business decisions.

3. Executives and Boards

Board members and senior executives require training that enables them to:

• Understand cyber risk
• Meet governance obligations
• Evaluate investment decisions
• Oversee resilience programmes
• Manage crisis communications
• Understand regulatory accountability

Increasingly, legislation such as NIS2 places accountability directly on senior management. Cybersecurity literacy at executive level is no longer optional.

Operational Training, Incident Response and Reporting

Perhaps the most overlooked area of cybersecurity education is operational readiness.

Many organisations possess security tools but have never exercised their response plans under realistic conditions.

Effective operational training should include Incident Response Exercises.

Teams should regularly rehearse:

• Ransomware scenarios
• OT system compromise
• Insider threats
• Supply-chain attacks
• AI-enabled attacks
• Loss of operational visibility
• National-scale disruption events
• Crisis Management Workshops

Executives should understand:

• Decision-making during incidents
• Regulatory notifications
• Media response
• Stakeholder communications
• Recovery prioritisation
• Reporting Requirements

Both UK and EU legislation increasingly require timely reporting of significant incidents. Understanding what constitutes a reportable event and how reporting obligations differ between jurisdictions is becoming an essential competency.

Regulatory Drivers: What Organisations Must Prepare for UK Requirements

The UK's Cyber Security and Resilience Bill will represent the most significant update to cyber regulation affecting essential services since the original NIS Regulations. The legislation focuses on enhancing resilience across operators of essential services and critical digital infrastructure.

Key areas include:

• Enhanced cyber resilience requirements
• Stronger incident reporting
• Expanded regulatory oversight
• Greater supply chain scrutiny
• Increased accountability for operators of essential services
• EU Requirements

Within Europe, organisations face compliance obligations across multiple frameworks:

• NIS2 Directive
• Cyber Resilience Act (CRA)
• Digital Operational Resilience Act (DORA)
• Sector-specific guidance
• National transposition requirements

These regulations increasingly emphasise the need for risk management and governance, supply chain security, incident response and reporting, executive accountability and training & awareness.

Organisations that invest in workforce capability today will be significantly better positioned to meet future regulatory expectations.

Training Pathways and Available Industry Certifications

There is now a growing ecosystem of training providers addressing OT and ICS cybersecurity skills shortages. Most vendors now include ICS and OT as part of their general learning objectives; however, specialist OT and ICS providers increasingly offer training covering:

• ICS Security Fundamentals
• SCADA Security
• IEC 62443
• Industrial Incident Response
• Secure OT Architecture
• Industrial Threat Hunting
• Critical Infrastructure Protection

Examples include programmes delivered by organisations such as Siker and GIAC ICS certifications with some very exciting new courses being launched soon such as the CompTIA OTSec+ and Cisco OT Security Practitioner.

Many providers now combine technical labs, tabletop exercises, threat intelligence, operational resilience, and regulatory awareness into integrated learning paths designed specifically for critical infrastructure operators.

Specialist courses are also enhanced by foundational learning in infrastructure, cloud and information security from vendors such as ISC2, ISACA, EC Council, CompTIA, PECB, Microsoft and AWS.

Cyber Resilience Depends on Skills

The cyber threat facing Critical National Infrastructure has never been more complex. Nation-state adversaries, ransomware groups, supply-chain attackers, and AI-enabled threat actors are all targeting the systems that underpin modern society. At the same time, regulators across the UK and Europe are introducing stronger requirements for resilience, governance, reporting, and accountability.

Technology remains essential, but technology alone cannot deliver resilience.

The organisations that will be most successful are those that invest in people. They will develop skilled technical practitioners, capable security leaders, informed executives, and well-rehearsed operational teams.

They will treat cybersecurity training not as a compliance requirement but as a strategic investment in national resilience.

For organisations operating within critical sectors, cyber resilience begins with education. In an era where disruption of essential services can affect entire populations, training is no longer simply a professional development activity. It is a critical component of national security.

There has never been a more important time to invest in cyber resilience. Firebrand Training provides bespoke training programmes and certification pathways tailored to your industry, regulatory landscape and security objectives.

Whether your focus is operational technology, critical infrastructure, compliance, incident response or leadership development, we can help build a targeted learning strategy that equips your people with the skills needed to address today's threats and tomorrow's challenges.