The Annual Review 2024–25 provides a public account of SUVAT's work during the reporting period.
Director General's foreword
"The cyber threat to the United Kingdom continues to grow in scale and sophistication. Over the past twelve months, SUVAT has analysed a record number of malware samples, supported multiple investigations into cybercriminal networks, and deepened our partnerships with the NCSC and international allies. The professionalism and dedication of SUVAT's staff is the foundation of everything we deliver."
— Catherine Langford, Director General
Key findings
Threat landscape
- The SUVAT cyber threat assessment was adjusted twice during the reporting period, reflecting a dynamic and evolving threat environment.
- SUVAT produced 187 threat assessments for organisations and partner agencies, a 22% increase on the previous year.
- Ransomware remained the most significant cybercriminal threat to UK organisations, with attacks on healthcare and education sectors increasing notably.
- Spam and phishing volumes increased by an estimated 31%, with growing use of AI-generated content to improve lure quality.
- State-sponsored cyber activity continued to target UK government, defence and critical national infrastructure, with particular focus on espionage and pre-positioning for potential disruption.
Operations
- SUVAT supported 34 external investigations with specialist cyber analysis, up from 22 in the previous year.
- The SUVAT reporting system processed 24,600 reports from the public and organisations.
- SUVAT malware analysts reverse-engineered over 1,200 unique malware samples, contributing to takedown operations and the development of detection signatures shared with industry.
- Three major operations supported by SUVAT analysis led to 12 arrests and the disruption of significant cybercriminal infrastructure.
Organisational development
- Staff numbers grew to 283 (from 241), with particular investment in the malware analysis and threat analysis teams.
- SUVAT achieved 91% staff engagement in its annual staff survey.
- A new malware analysis laboratory was commissioned, expanding SUVAT's technical capabilities.
- SUVAT launched its public-facing Stop. Think. Report. national awareness campaign in partnership with the NCSC and Action Fraud.
Financial summary
| Item | 2024–25 | 2023–24 |
|---|---|---|
| Total resource budget | £38.7m | £32.4m |
| Staff costs | £22.8m | £18.9m |
| Operational expenditure | £11.2m | £9.6m |
| Capital investment | £4.7m | £3.9m |
Full financial details are available upon request from corporate@suvat.uk.
Priorities for 2025–26
- Ransomware disruption — expanding SUVAT's capability to identify, track and support the disruption of ransomware-as-a-service operations targeting UK interests.
- AI-enabled threats — investing in research and analytical tools to address the growing use of artificial intelligence in spam generation, phishing and social engineering.
- International partnerships — deepening information-sharing arrangements with international cyber security agencies.
- Public engagement — expanding the Stop. Think. Report. campaign and improving the accessibility of SUVAT's guidance for small businesses and individuals.
- Workforce development — continuing recruitment and training programmes to build specialist capability in malware analysis, threat modelling and digital forensics.
Availability
The Annual Review 2024–25 is available as a PDF download. Printed copies may be requested from SUVAT Corporate Affairs at corporate@suvat.uk.
Certain operational details have been withheld for sensitivity reasons.