National Resilience (Parliamentary evidence)
Overton Advisory submitted written evidence to the National Resilience Committee’s inquiry into National Resilience. The original is available here
Summary
The UK’s resilience challenge is systemic, rather than sectoral or selective. National and international risks are tightly interwoven, spreading rapidly across supply chains, digital infrastructure, and the defence-industrial base. In practice, this collapses the boundary between civilian and military domains and turns short-term shocks into potential sustained, system-wide pressures.
The most severe risks are those that degrade the UK’s ability to sense, decide, and act, particularly the loss of satellite-enabled services, disruption to the spectrum, and failure across energy, digital, and logistics systems. These risks are amplified by dependence on a small number of critical enabling systems and firms and globally distributed supply chains that often traverse fragile trade passageways.
The 2025 Strategic Defence Review reflected a shift towards sustained readiness, but also underlined a more demanding reality: defence capability is now inseparable from industrial capacity, supply chain resilience, and access to skilled personnel. The private sector is the frontline of national resilience because private firms are the operators of much of the UK’s critical infrastructure. The private sector remains unevenly prepared, however, and can sometimes be frustrated by a perceived lack of Government support or sensitivity — the most consistent demands from senior-level industry contacts in the defence and resilience sector are for faster procurement cycles (55%) and multi-year funding commitments (60%), while overly lengthy procurement timelines are cited as the single largest constraint on growth (53%), according to the Overton Defence Sentiment Index 2026.
The Overton Defence Sentiment Index also shows that implementation remains the core constraint, as 53% of respondents rate Government delivery as weak, compared to just 10% who view it as strong. Fragmented governance, short-term funding models, and procurement frameworks that prioritise efficiency over resilience also continue to limit progress, as evidenced by the Index’s respondents.
The UK seems to have correctly identified the risk environment, but lacks either the institutional machinery or the incentives to respond to it at a system-wide level.
1. How far are national and international risks inter-connected, including across different sectors and across short-term and long-term risks, and what are the implications for the national approach towards preparedness and resilience?
National and international risks are inherently interdependent. The distinction between domestic and external threats has eroded, as has the boundary between civilian and military domains. High-impact risks no longer occur in isolation, but instead can quickly and simultaneously spread across borders, sectors, and time horizons.
Supply chains are now strategic dependencies as much as economic systems. Disruptions in semiconductors, critical minerals, munitions, autonomous products, energy, or logistics platforms can have immediate consequences for defence readiness, energy resilience, and industrial output. These risks are concurrent, mutually reinforcing, and often insufficiently protected.
At the same time, digital infrastructure has created a shared vulnerability layer across the economy. Telecommunications, energy, finance, and defence systems are increasingly interconnected, meaning disruption in one domain, whether cyber or electromagnetic, can cascade rapidly across others.
The temporal dimension of risk has also compressed. Short-term shocks now interact directly with long-term structural pressures, creating a persistent state of exposure rather than episodic crisis.
The UK’s current approach, organised around discrete risks, departmental silos, and linear planning assumptions, is no longer sufficient. Resilience must be treated as a whole-system capability, focused on the ability to absorb, operate through, and adapt to sustained disruption.
Recommendation: The UK Government should establish a National Resilience Centre anchored in the Cabinet Office, with a mandate to integrate civilian and defence planning across critical systems. This body should be responsible for setting cross-sector resilience standards, conducting regular whole-system stress tests, and aligning procurement and industrial policy with resilience objectives. Without a central integrating function, the UK risks continuing to identify risks effectively but responding to them in a fragmented, slow, and ultimately suboptimal manner.
2. What national risks could have the most severe impact in a reasonable worst-case scenario, including nuclear accidents and loss of control of satellite communications?
The most severe national risks to the UK are those that degrade its ability to sense, decide, and act in a coordinated manner. In a reasonable worst-case scenario, this is less likely to stem from a single catastrophic event and more from the simultaneous or coordinated failure of critical enabling systems.
First, the loss or degradation of space-based services, particularly satellite communications (SATCOM), and positioning, navigation and timing (PNT), would have far-reaching consequences. These services underpin both military operations and civilian infrastructure, including financial systems, telecommunications networks, logistics, and emergency response. A sustained disruption to GNSS, whether through jamming, spoofing, or kinetic attack, would impair everything from precision-guided defence systems to aviation, shipping, and synchronised financial transactions. The result would be a rapid loss of operational coherence across both the public and private sectors.
Second, persistent denial or degradation of the electromagnetic spectrum (EMS) represents a critical vulnerability. Modern defence and civilian systems are increasingly reliant on uninterrupted access to the spectrum for communication, sensing, and control. In a contested environment, the inability to operate effectively in degraded or denied electromagnetic conditions would significantly reduce the UK’s ability to deploy and sustain both military and civil response capabilities.
Third, coordinated failure across interconnected infrastructure, particularly energy, digital communication networks, and logistics, poses a high-impact risk. A major cyber attack or systemic disruption affecting one of these sectors would not remain contained. For example, a prolonged outage in the energy grid would immediately affect data centres, telecommunications, and transport systems, with secondary effects on financial services and supply chains. The interdependence of these systems means that failure in one domain can rapidly escalate into a multi-sector crisis.
Fourth, while lower probability, high-impact risks such as nuclear accidents or major industrial incidents remain relevant. However, their impact is likely to be amplified or mitigated by the resilience of the surrounding systems. A nuclear incident occurring alongside degraded communications or constrained emergency response capacity would have significantly more severe consequences than one occurring within a fully functioning system.
The common feature across these risks is that they target or expose the UK’s reliance on a relatively small number of critical enabling systems and firms. Where these systems are brittle, tightly coupled, or insufficiently protected, the risk of systemic failure increases.
Resilience should be defined by the ability to operate through failure, not by the ability to avoid it. This includes maintaining core functionality in degraded environments, ensuring continuity of decision-making, and preserving the capacity to respond and recover at pace.
Recommendation: The UK Government should prioritise investment in resilient and redundant enabling capabilities, including alternative PNT solutions, hardened and diversified communications infrastructure, and the ability to operate effectively in contested environments. This should be supported by a programme of regular, cross-sector stress testing focused specifically on loss-of-function scenarios (e.g. GNSS denial, prolonged power outage, communications disruption). Resilience should be measured not by the avoidance of failure, but by the ability of critical systems to continue functioning under sustained disruption.
3. Since the 2025 Strategic Defence Review, what changes have there been to the national resilience implications of the geopolitical environment for defence spending, development of the country’s industrial base, and military recruitment?
The 2025 Strategic Defence Review (SDR) reflected a material shift in the UK’s threat environment and, consequently, in how resilience must be understood across defence spending, industrial capacity, and workforce generation. The central change is the transition from contingent capability to sustained readiness in a persistently contested geopolitical environment.
On defence spending, the SDR signals a move from incremental uplift to structural investment. The commitment to increase spending to at least 2.5% of GDP by 2027 reflects a recognition that resilience is now a core function of national security. However, the issue is both the level of spending and its composition. Greater emphasis is required on readiness, autonomous systems, munitions stockpiles, integrated air and missile defence, and digital command architectures, rather than legacy force structures that are vulnerable to new forms of warfare. In resilience terms, this marks a shift towards sustaining operational capability under prolonged stress, rather than preparing for discrete conflicts.
There remains, however, a clear gap between policy intent and delivery. The Overton Defence Sentiment Index shows that 53% of respondents rate Government delivery as weak, compared to just 10% who view it as strong. The most consistent demands from industry are for faster procurement cycles (55%) and multi-year funding commitments (60%), while overly lengthy procurement timelines are cited as the single largest constraint on growth (53%). This points to a structural disconnect between strategic ambition and execution.
The SDR also repositions the defence industrial base as a central pillar of national resilience. The shift towards domestic or allied supply chain-oriented production, expanded munitions capacity, missile procurement, and investment in autonomous systems, marks a departure from a cost-efficiency model towards one focused on sovereign capability and supply chain security, which makes sense in a more geopolitically contested world. The Defence Industrial Strategy reinforces this by framing defence as an engine for growth and emphasising a continuous cycle of innovation between industry and the frontline.
This has two key implications. First, industrial capacity is now a deterrence asset in its own right: the ability to produce, replenish, and adapt at pace is as important as the platforms themselves, as we saw in the initial period of the war in Ukraine. Second, resilience is increasingly distributed across a broader ecosystem, including SMEs and dual-use firms now embedded in defence supply chains. While this expands capability, it also introduces new vulnerabilities, particularly where smaller firms lack the scale or resilience to operate under sustained demand or disruption.
Taken together, these changes reflect a fundamental shift in how resilience is defined. It is no longer a function of force size alone, but of the UK’s ability to sustain military, industrial, and human capacity over time in a contested environment.
Recommendation: The UK Government should adopt a resilience-led defence planning model that integrates defence spending, industrial policy, and workforce strategy into a single framework. This should include: (1) multi-year demand signals to industry, particularly domestic and allied country SMEs, to support sustained production capacity; (2) targeted support to ensure dual-use and smaller firms can operate under surge conditions; and (3) a hybrid workforce model linking military recruitment, reserves, and civilian technical talent. Without alignment across these areas, increased defence spending risks generating capability in isolation rather than delivering durable national resilience.
4. What risks does the private sector face, including to cyber activity and supply chains, and how do these vary across key industries?
The private sector is now the frontline of national resilience. In most critical sectors, the systems that underpin national security i.e., financial infrastructure, energy networks, logistics, and communications, are owned, operated, or maintained by private entities. As a result, the risks faced by the private sector are not purely commercial, but are also strategic and systemic.
Three risk categories are consistently observed across sectors: cyber vulnerability, supply chain fragility, and operational dependency on interconnected infrastructure. However, their manifestation varies materially by industry.
First, cyber risk has evolved from data compromise to operational disruption. In sectors such as finance and transport, the risk is no longer limited to theft or espionage but extends to the degradation or denial of core services.
Second, supply chain risk is increasingly shaped by geopolitical exposure rather than purely economic efficiency. In sectors such as food, energy, and medicine, the UK remains reliant on complex, globally distributed supply chains for critical inputs. Disruption, whether through geopolitical instability, export controls, trade wars, or logistics breakdown, can lead to rapid shortages with limited domestic fallback.
Third, operational dependency on interconnected infrastructure creates the conditions for domino-effect failure. A disruption in one sector, such as energy or telecommunications, can propagate rapidly across others.
A further divergence exists between large firms and SMEs. While large corporates may have the resources to invest in resilience measures, SMEs, many of which form critical nodes in supply chains, often lack the financial and operational capacity to withstand prolonged disruption. This creates hidden vulnerabilities within otherwise robust systems that are only exposed in periods of crisis.
The overall implication is that private-sector resilience is uneven, and in many cases, misaligned with national resilience requirements. While individual firms may optimise for cost, efficiency, and shareholder value, these incentives do not always align with the need for redundancy, stockpiling, or domestic capability from a national perspective.
Recommendation: The UK Government should establish a sector-specific resilience framework for critical industries, combining regulatory standards, targeted financial incentives, and procurement alignment to ensure minimum resilience thresholds are met. This should include mandatory stress testing for systemically important firms, support mechanisms for SMEs within critical supply chains, and clear guidance on acceptable levels of redundancy and geopolitical exposure.
5. What barriers have there been to implementing improvements to preparedness and resilience, such as inaction, inappropriate structures, inadequate funding, and short-term thinking?
The principal barriers to improving preparedness and resilience in the UK are structural. There is broad recognition of the risks and the need for action, but implementation is consistently constrained by institutional design, incentive misalignment, and fragmented accountability.
First, responsibility for resilience is distributed across multiple departments, agencies, and levels of government without a single integrating authority. This leads to duplication in some areas and gaps in others, with no clear mechanism for prioritisation or trade-offs. In practice, resilience remains organised around departmental boundaries, while the risks it seeks to address are cross-cutting. This structural fragmentation makes it difficult to develop and sustain a coherent, system-wide approach.
Second, funding models continue to prioritise efficiency and short-term value over long-term resilience. Investment decisions within government are typically assessed on immediate cost-benefit metrics, which undervalue redundancy, surge capacity, and preparedness for low-probability, high-impact events. As a result, resilience-enhancing measures are often deferred or diluted, particularly where their benefits are not immediately visible or attributable to a single budget holder.
Third, procurement and regulatory frameworks are not consistently aligned with resilience objectives. Public procurement processes tend to favour lowest-cost, lowest-risk delivery in the short term, rather than long-term system robustness or supply chain security. This can discourage investment in domestic capability, limit supplier diversity, and reinforce dependence on external sources and long, vulnerable supply chains. In parallel, regulatory regimes across critical sectors vary in their expectations and enforcement of resilience standards, leading to uneven levels of preparedness.
Fourth, there is a persistent gap between planning and execution. The UK has a well-developed set of risk assessments and contingency plans, but these are not always translated into operational capability.
Fifth, short-term political and commercial incentives can displace longer-term resilience priorities. Electoral cycles, budget constraints, and shareholder pressures all favour visible, near-term outcomes over investments whose value is realised only in crisis conditions. This contributes to a pattern of reactive rather than anticipatory policy-making, where significant improvements are often driven by recent shocks rather than sustained strategic planning.
Finally, there is an underdeveloped integration between government, industry, and the wider workforce in delivering resilience. While the private sector operates much of the UK’s critical infrastructure, there is no consistently applied framework for aligning commercial decision-making with national resilience requirements. This is particularly evident in supply chains, where smaller firms may lack the capacity to invest in resilience without external support or clear demand signals.
The combined effect of these barriers is that resilience is treated as a secondary objective, acknowledged in principle but insufficiently embedded in the systems that determine funding, procurement, and operational delivery.
Recommendation: The UK Government should implement a resilience delivery model with clear ownership, aligned incentives, and enforceable standards. This should include: (1) the designation of a central authority with cross-government mandate to set priorities and coordinate implementation; (2) reform of procurement and funding frameworks to explicitly value resilience outcomes, including redundancy and domestic and allied capability; and (3) mandatory accountability mechanisms amongst officials, including regular reporting and independent audit of resilience performance across critical sectors. Without structural reform to how resilience is funded, governed, and measured, further improvements are likely to remain incremental rather than transformative.