UK government chases AI while aging IT leaves it exposed, PAC chair warns

A UK parliamentary watchdog says government departments are not addressing legacy IT and digital-skills gaps quickly enough to manage cyber risks, including those amplified by AI; only 6% of civil servants work in digital and data roles versus a 10% target. Fraud and error are estimated to cost taxpayers £55 billion–£81 billion a year, while the Department for Work and Pensions reported £9.9 billion of benefit overpayments in 2025-26. The NS&I IT overhaul reached £3 billion by December 2024, £1.3 billion above its original estimate, while the Bank of England completed its RTGS upgrade for £431 million in April 2025.

Analysis

The investable signal is a widening gap between cyber risk and government delivery capacity—not evidence of an imminent spending windfall. Legacy-system exposure and AI-enabled fraud should support demand for identity, threat detection and data-modernization tools, but UK procurement, staffing shortages and weak project governance may delay revenue conversion. The NS&I experience is a warning for vendors as well as taxpayers: fixed-price delivery and ambitious whole-system replacements carry material execution risk, while independent assurance and phased upgrades may gain favor. The Bank of England’s contrasting delivery record strengthens the case for modular programs with clear milestones, not a blanket rejection of modernization.

Near term (days to weeks), the report is more likely to raise scrutiny of contract awards and implementation plans than change budgets. Over 1–3 months, watch for departmental spending decisions, procurement pauses or revised business cases; these determine whether cybersecurity demand translates into orders. Over 6–18 months, successful phased modernization could benefit cyber and systems-integration providers, but persistent skills constraints could cap adoption and leave incumbents maintaining legacy estates.

Contrarian view: the headline risk is not necessarily a near-term earnings catalyst for cybersecurity vendors. The report identifies urgency, not funded commitments, and greater concern about AI asylum tools may constrain deployment even as fraud defenses become more necessary. Prefer exposure to diversified cybersecurity demand over a concentrated bet on UK government transformation contracts. Reassess if procurement budgets and awarded work fail to follow, or if project overruns trigger broader spending restraint.

Key Decisions for Investors

• Prefer a diversified cybersecurity/identity-security basket over a UK public-sector IT transformation pure play; treat this as a medium-term theme, not a headline-day trade. Add only as contract awards or budget disclosures confirm conversion of risk into funded demand.
• Underweight or avoid concentrated exposure to systems integrators whose economics depend on large, fixed-price UK government modernization programs until contract mix, milestone protections and delivery capacity are verified.
• Set a 1–3 month alert for UK departmental procurement plans, cyber/identity contract awards and revised business cases. No confirmed funding or repeated delays would falsify the near-term revenue thesis.
• Monitor project-cost revisions and delivery milestones: further major overruns or a government-wide spending response would weaken the sector view; evidence of phased delivery with independent assurance would improve it.