The Cyber Security and Resilience Bill marks the most significant overhaul of the UK’s cybersecurity regulatory framework since 2018.
The need for improved cyber resilience is clear. The UK is the most targeted country in Europe for cyber-attacks, with the estimated annual cost surpassing £14.7 billion. Recent high-profile attacks have sharply underscored the operational and financial disruption caused by modern threat actors. As regulators prepare to enforce two-stage incident reporting – which requires initial notifications within 24 hours – and expand statutory oversight to managed service providers and data infrastructure, the operational pressure on business leaders will rise to an all-time high.
Yet, as organisations seek to strengthen their security, many are running headfirst into a systemic bottleneck, namely a severe and persistent shortage of cybersecurity talent. The Government itself acknowledges that 49% of UK businesses suffer from a basic cybersecurity skills gap, while the National Cyber Security Centre reports a 50% year-on-year increase in nationally significant incidents. In face of this, the instinct of most executive boards has been to treat this as a recruitment crisis, competing aggressively for a finite pool of experienced engineers.
Organisations simply cannot hire fast enough to keep pace with evolving threats. But this is just one small part of the challenge. For too long, business leaders have expected far too little from the underlying digital infrastructure they rely on every day. As cyber skills remain in short supply, the path forward requires a change in how we approach resilience. Businesses cannot solve this crisis simply by recruiting more security talent; they must pair their teams with managed infrastructure that takes routine security maintenance off their plates entirely. If we allow intelligent hosting and infrastructure to take on direct operational responsibility, we can build a far more durable baseline of protection.
Hiring isn’t always the answer
As futuristic as this may sound, we need a new playbook when threats multiply beyond expanding the security team. This is largely because current market dynamics have rendered this strategy unsustainable. Research from the Cyber Security and Business Resilience (CSBR) shows an imbalance where 65% of job postings demand mid-level or senior experience, while entry-level roles make up just 17%. This creates a cycle in which companies bid up the cost of experienced talent without actually expanding the talent pool.
The upcoming regulatory demands under the Cyber Security and Resilience Bill will only add to this strain. Mandating initial incident notifications within 24 hours and detailed reports within 72 hours requires round-the-clock monitoring and rapid response capabilities. However, in most businesses, the technical burden isn’t coming from sophisticated external attacks – it’s coming from the relentless grind of web-layer maintenance, unpatched software, and routine server vulnerabilities. If scarce technical staff are forced to spend their shifts triaging routine alerts, reading log files, and manually patching server infrastructure, their capacity to defend against complex attacks drops significantly. The result is widespread burnout, high staff turnover, and fragile operations.
Adding more human hours to repetitive tasks is a costly and ineffective response to modern demands, while buying more standalone cybersecurity tools often compound the issue. Security software generates alerts, but humans still have to investigate them. True resilience doesn’t come from piling on more monitoring tools, but from adopting infrastructure that fixes routine vulnerabilities automatically.
Making managed infrastructure work harder
To fix this imbalance, we must re-think what core hosting and infrastructure platforms should do. Historically, infrastructure and security platforms have acted as passive tools, generating endless streams of data for human operators to review and act on. In today’s heightened landscape, managed infrastructure must become an active partner that autonomously handles routine maintenance, detection, and remediation at the platform level.
Intelligent automation allows systems to spot, isolate, and fix routine operational issues before a person ever needs to step in. This is where managed hosting demonstrates its true value. In the past, running web infrastructure required engineering teams to manually scan for malware, apply security patches, monitor server health, and tune performance.
Today, modern, intelligent hosting platforms automatically detect and isolate malware, apply critical updates, optimise performance, and manage traffic spikes without human intervention. When managed hosting infrastructure automatically cleans infected files and patches vulnerabilities at the edge, it stops threats before they turn into reportable incidents.
Applying this same principle across the business – from network monitoring to application management – allows managed technology to absorb the operational friction that currently overwhelms technical teams. Offloading routine server upkeep to a managed host isn’t a luxury; it is a foundational requirement for modern business continuity.
This isn’t to say that we’ll replace skilled technical professionals, either. On the contrary, letting managed infrastructure handle backend toil unlocks the full value of human expertise. When engineers no longer spend their days clearing log queues or applying routine web server updates, they can focus on high-impact projects that move the business forward. In turn, technical teams can focus on designing safer system architectures, modelling complex threats, reviewing supply chain risks, and testing business continuity plans. This aligns technical work directly with business goals. A senior engineer spending their working week manually cleaning malware off web servers is a waste of critical talent. That same engineer spending those hours auditing vendor dependencies or hardening network access delivers a real boost to operational resilience.
The Cyber Security and Resilience Bill demands a higher standard of operational readiness, but meeting that standard cannot depend on simply competing for a limited pool of talent. The cybersecurity skills gap isn’t a temporary issue that will vanish. To close it, we must re-evaluate our relationship with the software and infrastructure supporting our operations. We must stop treating infrastructure as a passive container that demands constant manual upkeep, and start choosing managed hosting partners built to shoulder that operational weight directly. Where regulatory pressure and hiring limits meet, automation provides the only viable path to genuine, sustainable digital defence.
Suhaib Zaheer
Suhaib Zaheer is the Senior Vice President, DigitalOcean and General Manager at Cloudways, a cloud hosting provider that offers businesses, agencies, freelancers and more a fully managed, expert hosting management platform. Suhaib joined Cloudways in 2021 as its COO and helped Cloudways dedicate its services to SMBs.
