Underfunded cybersecurity in critical infrastructure¶
What keeps a modern city upright, and not descending into a howling medieval mess, is simple enough: a stack of creaking infrastructure systems held together by ancient protocols, budget cuts, and engineers who have been told since birth that taking anything offline is a sin punishable by eternal paperwork.
Imagine the Ankh-Morpork power grid. Imagine the pipes under the Shades. Imagine the rail system during peak hour. Now imagine trying to secure all of that with thirty years of overdue updates and a budget that would not stretch to a tray of Klatchian coffee. Energy grids, water utilities, and transport networks share much the same affliction: old systems, flat networks, and a proud tradition of shouting availability first whenever the word security wanders too close. Upgrade cycles move at the speed of a hungover troll. Vulnerabilities gather dust. Attackers gather interest. The Ankh-Morpork crisis simulation models where that ends up.
Security debt accumulates in the gap between what a system needs and what its operator can safely change. A missed patch becomes a compensating control, the control becomes an exception, and the exception becomes part of how the plant runs.
The clerk’s brief¶
From the clerks, for the Patrician’s eyes
Compiled September 2026. Newest first, as ever; the long patterns settle into the running account at the end. The clerks would like it minuted that every figure below was available to every budget committee that declined to read it.
September 2026: Essential and well represented¶
The ENISA Threat Landscape 2026, published 22 September 2026, finds public administration the most targeted sector at 31.8 per cent, followed by business services, transport, manufacturing and finance, with essential entities accounting for 72.9 per cent of the total. The clerks note that the organisations the law calls essential are also the ones that turn up most often in the incident record.
December 2025: More than a season¶
ENISA’s NIS Investments 2025 survey of 1,080 professionals in the EU’s most critical sectors found security spending held at 9 per cent of IT budgets, a median of 1.5 million euros, and 28 per cent of organisations taking more than three months to patch critical vulnerabilities.
October 2025: Ransomware takes the lion’s share¶
The ENISA Threat Landscape 2025, published October 2025, analysed 4,875 incidents between July 2024 and June 2025: DDoS dominated at 77 per cent of reported incidents, while ransomware accounted for 81.1 per cent of cybercrime incidents against EU organisations and remained the most directly impactful threat, with energy, transport, and manufacturing among the targets of state-aligned activity.
July 2025: It takes money to save money¶
IBM’s Cost of a Data Breach report, published July 2025, put the global average at 4.44 million dollars, the first fall in five years, and found that organisations using security AI and automation extensively saved an average of 1.9 million dollars per breach. IBM sells that automation. Its 2026 edition puts the average at 4.99 million dollars, a record. The saving, the clerks note, went to those who had already spent on the tools.
February 2025: The budget that eats itself¶
Software Improvement Group’s analysis, published February 2025 by a firm that sells tools for managing technical debt, cites McKinsey’s finding that 10 to 20 per cent of budgets earmarked for new development are redirected to servicing technical debt, and puts, without a source, around 40 per cent of an IT budget into its fallout and 20 to 40 per cent of a typical stack down as debt. The money for security improvements is not so much refused as pre-spent.
January 2025: Singing from the same hymn sheet¶
The UK’s State of digital government review, published January 2025, records that every organisation profiled cited insufficient funding to manage legacy technology and technical debt, while critical services depend on decades-old systems whose scale is not even consistently measured. When government departments, NHS trusts, police forces and councils agree unanimously on anything, the clerks consider it worth writing down.
The running account¶
The funding pattern has not moved in years: security sits in operational expenditure, operational expenditure is what gets cut, and emergency money arrives only after an incident, at emergency prices. The measurements now exist: the UK’s review of January 2025 found every organisation it profiled short of money for its legacy estate, and ENISA’s survey of December 2025 found security held at 9 per cent of IT budgets while 28 per cent of organisations take more than three months to patch critical vulnerabilities. The regulatory response, chronicled in the regulatory file, obliges the same underfunded operators to do more with the same money. The clerks’ standing assessment is unchanged: budgets will materialise after something breaks loudly enough, and the only open question in the file is what, and when, and who is standing under it.