LowII Cyber Warfare & Critical Infrastructure27 October 2026, Tuesday
Legacy IT is the top cyber risk for English police and fire
HMICFRS, the inspectorate for police and fire services in England and Wales, published a report on 27 October. It said technology leaders in both services see dependence on legacy systems as their biggest strategic cyber risk. Inspectors visited three police forces and three fire services.
HMICFRS, His Majesty's Inspectorate of Constabulary and Fire & Rescue Services, which oversees policing and fire and rescue in England and Wales, published the report on Tuesday 27 October. According to ITPro, cyber security has improved over the past six years. Even so, technology leaders in both services ranked reliance on legacy systems as the number one strategic risk. Inspectors found weak password management and widespread gaps in multi-factor authentication. They also found gaps in training and access control as staff join, change roles or leave. Third-party IT suppliers holding sensitive police data form a separate risk category.
As reported by Radio News Hub, the report makes three recommendations. The first is a minimum cyber security standard for all police forces and fire services, and the second is tighter management of third-party IT contracts. The third is a national digital management centre for the fire service, modelled on the one in policing. Inspector Michelle Skeer said the threat is significant and expanding rapidly, and stressed that modernising IT must be a priority in both sectors. The report contains no budget or timetable, and the deadline for implementing the recommendations could not be verified.
Talay assessment
Bottom line
The report's weight lies not in a new attack but in the official recording of a structural vulnerability. Dependence on legacy systems, combined with weak passwords and missing multi-factor authentication, creates a low-cost entry surface for ransomware. Because the report sets no timetable or budget, the pace of the recommendations will depend on later spending decisions by the Treasury and the Home Office.
Likely effects
- Emergency service continuityNegative1–6 months
While legacy systems and missing multi-factor authentication persist, a single ransomware incident could turn into an extended outage of call-handling and incident management systems.
- Public sector IT suppliersUncertain1–6 months
The call for tighter third-party contracts adds audit and certification burdens for suppliers that hold police data.
- Public cyber spendingUncertain6 months+
If adopted, the minimum standard and a national centre for the fire service would require extra funding; with no figures in the report, where the money comes from is an open question.
Possibilities, ranked
- 1Phased implementation60%
The government accepts the recommendations in principle and publishes the minimum standard, but the modernisation budget is spread over years.
Watch: The Home Office's formal response to the report and the timetable for the minimum standard
- 2Reform accelerated by an incident25%
A major cyber incident at a police force or fire service brings forward decisions on the national centre and funding.
Watch: Notifications of ransomware breaches at police or fire services
- 3Report left on the shelf15%
Budget constraints keep the recommendations from turning into concrete steps, and the same findings recur at the next inspection.
Watch: The legacy systems finding repeated in HMICFRS's next inspection cycle
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Organisations inspected▼ 3 police + 3 fire
- Recommendations▲ 3