Cyber Security Awareness Month 2026: Why NHS Cyber Resilience Needs More Than Tech

For Cyber Security Awareness Month 2026, we spoke with Tom Duffell, Chief Information Security Officer (CISO) at M8 Solutions, about the challenges facing NHS organisations, the importance of effective Cyber Security leadership and how CISO-as-a-Service (CISOaaS) can help strengthen resilience.

An NHS Trust can invest in sophisticated Cyber Security technology, implement monitoring systems and establish comprehensive security policies. But what happens when an alert goes unnoticed, a vulnerability remains unresolved or an incident response plan hasn't been tested?

Technology alone cannot guarantee resilience. Its effectiveness depends on the people managing it, the processes supporting it and the decisions made when challenges arise.

For NHS organisations, where disruption can directly affect patient services, effective Cyber Security leadership is essential.

Experience From the NHS Frontline

At M8 Solutions, our dedicated Cyber Security team works alongside NHS organisations to strengthen their security posture, manage cyber risk and build long-term resilience.

Our team brings together expertise across NHS Cyber Security strategy, governance, risk management and technical delivery, providing NHS organisations with both the strategic guidance and practical support needed to make meaningful improvements.

Leading our Cyber Security team is Tom Duffell, CISO.

With over 20 years' experience in networking and Cyber Security, Tom Duffell spent six years at Portsmouth Hospitals University NHS Trust, including three years as their Chief Cyber Security Officer.

Having led Cyber Security within the NHS, including throughout the challenging times of the COVID-19 pandemic, Tom Duffell understands the realities of managing cyber risk in a healthcare environment. From competing operational priorities and limited resources to the responsibility of protecting critical patient services, his experience has shaped the practical, proportionate approach taken by the wider M8 Solutions Cyber Security team.

Reflecting on how his NHS experience continues to shape his approach to Cyber Security, Tom explains: “My experience at Portsmouth, combined with working alongside NHS Trusts across the country through M8 Solutions, has given me a unique perspective on the challenges our customers face. The most technically secure solution isn't always the most effective. What matters is finding a solution that an organisation can realistically implement, manage and sustain, whilst meaningfully reducing cyber risk.”

Why Cyber Security Leadership Matters in the NHS 

Managing Cyber Security across an NHS organisation requires expertise coordination between IT, information governance, clinical services, senior leadership and external suppliers. Each area plays a part in identifying risks, making informed decisions and responding effectively when something goes wrong. But with NHS Cyber Security teams balancing daily security operations, emerging threats, data security and protection toolkit (DSPT) and Cyber Assessment Framework (CAF) requirements, finding the capacity to focus on long-term improvements can be difficult.

As Tom explained during our conversation: "Expectations have definitely increased more quickly than the capacity of cyber security teams."

It's a challenge many NHS organisations will recognise... Risks are identified, recommendations are made and improvement plans are agreed. But without sufficient leadership capacity, maintaining momentum can become increasingly difficult. Effective Cyber Security leadership brings these activities together, establishes clear priorities and ensures that identified risks translate into meaningful action.

How CISOaaS Supports NHS Cyber Resilience 

This is where M8 Solutions' CISO as a Service (CISOaaS) can make a difference. Our service provides NHS organisations access to experienced Cyber Security leadership, tailored to their challenges, priorities and existing capabilities.

Whether it's strengthening Cyber Security strategy, improving Board-level assurance, managing organisational risks or progressing long-standing improvements, we work alongside NHS teams to provide the direction, expertise and capacity they need. And you don't need to have a vacant CISO position to benefit. CISOaaS can also complement existing Cyber Security leaders who need additional capacity, specialist expertise, mentoring, or an independent perspective.

Experienced Leadership, Backed by a Wider Cyber Security Team

One of the key benefits of working with M8 Solutions is the continuity of expertise throughout an engagement. From the first conversation through to completion, Tom remains involved, bringing his NHS experience and strategic insight directly into the work we deliver.

But customers aren't relying on Tom alone.

He leads the wider M8 Solutions Cyber Security team, bringing together the specialist knowledge and technical delivery capability needed to turn recommendations into practical, sustainable improvements. This means NHS organisations benefit from experienced CISO leadership alongside a team equipped to support the work required to strengthen their Cyber Security posture.

Our aim is to become an extension of your existing team, helping you build resilience and strengthen the internal capabilities needed to sustain improvements long after an engagement ends. Take a look at our NHS Cyber Security testimonials here. 

Cyber Security is patient care

One comment from Tom during our interview captured the purpose behind everything we do: "Cyber Security is not as simple as 'protecting systems and data'. It's about protecting the NHS services that patients rely on and ensuring organisations can continue delivering excellent patient care."

It is a strong message worth reflecting on during Cyber Security Awareness Month. Technology plays an essential role in protecting NHS organisations, but it needs to be supported by effective processes, knowledgeable people and leadership that understands the wider organisation. Because ultimately, every improvement to Cyber Security resilience helps protect the services patients depend on.

Strengthen your NHS organisation's Cyber Resilience with M8 Solutions

Building lasting Cyber Resilience requires experienced leadership, clear priorities and the right expertise to turn strategy into meaningful action. Whether your NHS organisation needs additional Cyber Security leadership, greater assurance or specialist support for an existing team, M8 Solutions' CISO as a Service (CISOaaS) offering can help you strengthen your security posture, manage risk and protect the services patients rely on.

Discover how our NHS-experienced Cyber Security team can support your organisation in building a more secure and resilient future HERE.

Want to talk Cyber Security? Drop us a line and let's see how we can help.