UK insurance industry begins to acknowledge role in tackling ransomware

The UK NCSC, in collaboration with the insurance industry, issued new guidance on ransomware response that encourages victims to assess all options—including not paying—while reaffirming that ransom payments are discouraged. Citing RUSI research and regulator data showing record UK ransomware incidents in 2023, the guidance reflects a nuanced policy shift and promotes closer coordination with insurers, including potential notification requirements and minimum ransomware controls, to strengthen national resilience.