Are Smart Cities in the UK about to Become a Reality?

Dave Salmon
Subscribe Contact us
Clive Quantrill

Pioneering Technologies for the Future of Urban Transformation


Smart cities might sound like a utopian vision from the 1950s; something that sounds already out-of-date and perhaps even naive in our current geopolitical climate. But as urban spaces gradually implement a a series of technological leaps, the smart city emerges as a potential reality, offering a new way to unite communications with infrastructure via real-time feedback. 


Smart cities could dramatically enhance our quality of life, efficiency, and environmental stewardship. Given that cities are significant contributors to global emissions — responsible for approximately 70% of greenhouse gases — they will play a critical role in reaching net zero.


Reflecting insights from the last Smart City Expo in Barcelona (November 2024) and a range of ambitious projects across the UK, this article delves into the strategic alignment of technology, infrastructure, and sustainability shaping today's urban landscapes.


What Defines a Smart City?


A smart city is fundamentally ‘a municipality that uses information and communication technology to increase operational efficiency, share information with the public, and improve the quality of government services and citizen welfare.’ While definitions vary, the overarching mission is to optimise city functions, drive economic growth, and enhance the quality of life through technology and data analysis.


Smart city initiatives typically require three critical components:


  1. Networks of sensors and citizen participation to collect data
  2. Connectivity linking these networks to government systems
  3. Open data sharing to make results, changes, and improvements accessible to the public


Developing this underlying infrastructure is complex and expensive. Crucially, it depends on strong relationships between government, the private sector, and citizens, as most of the work to create and maintain these data-driven environments happens through collaboration and public-private partnerships.

A surreal, futuristic city with tall rectangular towers in green and pink tones, mirrored perfectly on a reflective surface below. A sleek monorail runs horizontally along the midsection, adding movement to the scene. The soft blue sky above transitions seamlessly into the reflected terrain, creating an infinite and dreamlike visual effect.

Smart Cities tap into a rich vein of scientific utopianism, characterised most recently by the Solarpunk genre in science-fiction art and fiction

The Digital Backbone of Smart Cities


Below we outline the primary technological transformations that underpin the smart city revolution.


Digital Networks and IoT Integration


The foundation of every smart city is a comprehensive digital ecosystem, seamlessly combining Internet of Things (IoT), high-speed connectivity, and intuitive platforms. Across the UK, expansive IoT deployments integrate sensors in buildings, transport systems, and urban environments, providing data in real-time that drives informed decision-making.


Connectivity and Speed


The deployment of ubiquitous high-speed 5G networks, alongside advanced fibre-optic infrastructures supported by significant governmental investments (£5 billion towards gigabit-capable broadband), enables the real-time data flow essential for a truly responsive urban environment. 


For example, projects in Cambridgeshire have pioneered smart poles, multifunctional infrastructure housing lighting, sensors, and telecommunications, enhancing urban connectivity in a novel synthesis of form and function.


Transportation Reimagined


Intelligent transportation systems (ITS) lie at the heart of UK urban transformation, dramatically reducing congestion and vehicular emissions. AI-driven smart traffic management dynamically optimises signal timings based on live traffic conditions. 


Initiatives like Sunderland’s autonomous vehicle trials illustrate the UK's forward-thinking approach to infrastructure, ushering in a future of integrated, sustainable mobility.


Data Analytics and Artificial Intelligence


AI is instrumental in shaping smart city functionality, enabling cities to preemptively manage resources, plan infrastructure developments, and swiftly respond to emergent situations. 


Predictive analytics allow municipal operations to anticipate urban issues before they materialise — from congestion surges to water resource inefficiencies — reinventing cities from reactive to proactively resilient systems.


Digital Twins


Digital twin technologies, 3D digital replicas of urban environments, elevate urban planning to new levels of precision and foresight. These virtual platforms allow planners to rigorously model scenarios ranging from traffic dynamics and energy use to disaster response strategies, reducing uncertainties and enhancing outcomes. Coupled with virtual reality, digital twins offer unprecedented visualisation and simulation capabilities, exemplified by urban development projects and testbeds in Milton Keynes and Manchester.

A vibrant, futuristic cityscape with tall, vertical structures covered in greenery, glowing in pink and orange light against a bright blue sky. The scene includes reflections in a calm, mirror-like surface below, with lush vegetation adding bursts of color throughout. The perspective conveys a sense of depth and infinity.

How will living walls, urban farms, renewable energy grids, and automated transport systems transform how we work, live and move around in urban spaces?

Current Smart City Projects in the UK


Several groundbreaking projects are currently transforming UK cities:


Manchester's Triangulum Project


Part of the European Smart Cities and Communities Lighthouse Projects, Manchester City Council led a consortium with Siemens and local universities to transform the Oxford Road corridor into one of Europe's largest knowledge-driven, low-carbon districts.


The project's cloud-based energy management platform has reduced the area's dependence on the grid. If scaled citywide, this central controller could potentially save Manchester approximately 57,000t CO2 emissions annually — equivalent to removing 12,000 cars from the road each year.


Hull's Smart City OS: A Programmable City


Hull's full-fibre network, supported by an investment of £85 million from KCOM, provides the fastest broadband in the UK. 


This robust connectivity has facilitated the development of a Smart City OS, built on Cisco's Kinetic for Cities platform by Connexin. The OS integrates 12 separate council IT systems, allowing for real-time management of public assets and services across the city. This centralised platform enhances data sharing and decision-making, improving service delivery in areas such as traffic management, health, and social care.


Glasgow to Create Europe’s Largest IoT Hub


In January 2024, Glasgow launched a £2.5 million collaboration with the UK Government, Glasgow City Council, and the Smart Things Accelerator Centre (STAC) to establish Europe’s largest IoT hub at ‘thebeyond’ in SkyPark, projected to host 100 companies by year-end. 


Additionally, Glasgow is striving to become the UK’s first carbon-neutral city through a partnership with ScottishPower, focusing on decarbonised heating, expanded EV infrastructure, and grid investment. Deputy Leader Councillor Ricky Bell described the vision as transforming Glasgow into a tech-driven, globally leading smart city powered by innovative, sustainable solutions.


Bristol is Open (BiO)


Bristol Is Open (BiO) is a joint venture between Bristol City Council and the University of Bristol, established to create a programmable digital infrastructure for smart city experiments. 


BiO has developed a secure research and development testbed, enabling companies to test and scale their technology solutions in a live network environment. Projects include smart mobility initiatives, such as a web-based solution utilising sensor data to guide people through cleaner air routes, and a simulated 5G water safety trial to enhance public safety along the city's harbourside.


Peterborough and the Circular Economy


Peterborough is one of the UK's first fully gigabit cities, thanks to CityFibre's full-fibre-to-the-premises network. This digital infrastructure supports IoT trials, such as those conducted with social housing provider Cross Keys Homes, which have improved resident wellbeing and reduced maintenance costs. The Circular Peterborough initiative aims to develop a fully circular economy by 2050, aligning with the city's commitment to sustainable growth.


The city has also created the Peterborough Accelerated Net Zero (PANZ) initiative, where edenseven, a UK-based sustainability consultancy with strong ties to Cambridge MC, has pioneered a groundbreaking digital platform. This system enables councils to accurately record, report, and monitor carbon emissions as well as facilitating the management of climate strategies and tracking intervention projects aligned with these efforts. 


Read more about the initiative here: https://www.cambridgemc.com/peterborough-city-council-leverages-new-technology-to-reach-net-zero-targets


Smart Cities will Act as Laboratories for Sustainable Urbanism


Smart cities in the UK — including London, Bristol, Manchester, and Aberdeen — are testing grounds for technologies that harmonise urban efficiency with environmental stewardship. These cities exemplify how data-driven systems can reduce emissions and enhance resource efficiency. Below we look at some of the pioneering initiatives that are laying the foundations for sustainable urbanism.


Energy-Efficient Infrastructure


Bristol’s Smart City Programme, launched in 2011, employs open data platforms and IoT-enabled smart meters to reduce energy consumption in buildings. The city’s district heating networks, powered by waste heat from industrial processes, have cut COâ‚‚ emissions by 40% since 2005. Similarly, Glasgow’s Future Cities Demonstrator project uses intelligent street lighting and real-time traffic management to lower energy use by 30% while improving public safety.


Sustainable Mobility Solutions


Transportation accounts for 27% of UK emissions, making electrification and smart mobility critical to net zero goals. London’s congestion-charging zones and electric vehicle (EV) infrastructure — including 13,382 public charging points — have reduced transport-related emissions by 13% since 2020. Meanwhile, Hull’s Smart Bus Scheme integrates real-time data and contactless payments to increase public transit ridership while cutting fuel use by 20%.


The Circular Economy and Waste Reduction


Manchester’s collaboration with Copenhagen and Bilbao under the FCDO Smart Sustainable Cities Project highlights the role of circular economy strategies in minimising waste. Initiatives like dynamic pricing for recycled materials and AI-driven waste sorting systems have diverted 65% of Manchester’s municipal waste from landfills since 2021.


Moving from Technological Fragmentation to a Smart Nation


Current progress is mostly at a city-level, but this raises certain questions about our vision for a smart ecosystem across the UK. Will we create an even greater technological divide between cities and rural areas? What plan is there to make remote areas smart? 


Furthermore, without a unified technology ecosystem, efforts to modernise cities risk occurring in silos. This fragmented approach, where different cities adopt disparate technologies and systems, is not only slower and more expensive but also carries more risk. More importantly, it may lead to disconnected systems that cannot effectively communicate with one another, undermining the broader vision of integrated, smarter cities.


To accelerate the rollout of smart city systems and avoid the pitfalls of fragmentation, we should seek a collaborative ecosystem of technologies and partners.


A national framework would provide the following:


  • Establish common technical standards for interoperability
  • Provide procurement guidance to avoid vendor lock-in
  • Create evaluation metrics for technology solutions
  • Enable knowledge sharing between cities and partners


The Smart Cities All Party Parliamentary Group (APPG) has advocated for central government to create a framework of principles, rules, and standards for procurement to help local authorities implement smart city projects more effectively. Such a framework would enable cities to maintain control over their projects and associated data while ensuring compatibility with other urban centres.


Smart City Expo World Congress 2024: A Glimpse of the Future


At the Smart City Expo World Congress 2024 in Barcelona, we saw some exciting glimpses into the future. Here are our favourite technologies that were the most fantastic, earning a place in our imagined Solarpunk utopia.


Bioo: Urban Spaces Lit by Plants


Bioo’s bioluminescent Bioo Lux lamps—activated by human touch—transform ordinary greenery into interactive art installations. But the real magic lies underground: their Bioo Panel system uses microbial fuel cells in soil to harvest electrons from plant roots, generating clean energy while slashing irrigation needs by 50% and cooling urban heat islands by 4°C. Barcelona’s Diagonal Avenue is already constructing the world’s first biotech building using this tech, where gardens pay for themselves through energy savings.


NVIDIA: Agentic AI Meets City Planning


NVIDIA unveiled an AI blueprint that’s basically Jarvis for city planners. Their system digests live video feeds from thousands of cameras, letting officials ask questions like, “Show me all bike lane near-misses last week” or “Summarise pedestrian flow in central downtown.” Powered by generative AI and digital twins, it’s a bit like having an omniscient urban analyst working 24/7. During a panel, Deloitte showcased how this tech could simulate disaster responses in virtual replicas of cities.


Barcelona: A Smart Odour City


Barcelona itself demoed a scent-sensing network hidden in streetlights. Using AI-trained ‘electronic noses,’ it detects pollution spikes, garbage buildup, or even unauthorised bonfires. The system then dispatches cleaners or adjusts traffic flow, possibly even getting there before the rats sniff it out.


Make My Day: Electric Fleet Wizards


If the public are concerned about electric buses dying mid-route, Make My Day pitched an AI platform that optimises EV fleets down to the minute. Their algorithms predict traffic, weather, and even driver breaks to keep municipal vehicles charged and efficient. One case study showed a 30% reduction in downtime for garbage trucks.  


Conclusion


The UK continues to be at the forefront of smart city development, with significant government investment supporting innovative projects across the country. From Bristol's leadership in city-wide innovation to Manchester's groundbreaking energy management system, UK cities are embracing technology to improve urban living, enhance sustainability, and drive economic growth.


For professionals interested in smart city technologies, the upcoming Connected North conference in Manchester presents an excellent opportunity to engage with industry leaders and learn about the latest innovations in this rapidly evolving field. 


As cities continue to grow and face new challenges, the integration of smart technologies will be increasingly vital for creating sustainable, efficient, and liveable urban environments. 


Get in Touch


We have a dedicated public sector team led by Craig Cheney, who is closely involved in Bristol's smart city and sustainability initiatives. This team of experienced public sector champions work alongside our digital infrastructure teams and our sustainability-focused sister-consultancy, edenseven, to provide a complete solution to support smart city digital transformation for local governments. We are particularly well-positioned to help with strategy, procurement, innovation and project implementation, as well as creating public-private partnerships to fund these complex programmes. Please use the form below to get in touch and find out more about our services.


Citations and Sources


[1] https://www.apm.org.uk/blog/five-of-the-uk-s-most-exciting-smart-city-projects/

[2] https://www.smartcityexpo.co.uk

[3] https://www.techtarget.com/iotagenda/definition/smart-city

[4] https://www.thenbs.com/knowledge/uk-smart-cities-study-updated-for-2017

[5] https://cities-today.com/uk-startups-demo-solutions-for-post-pandemic-smart-cities/

[6] https://newo.ai/insights/the-role-of-ai-assistants-in-smart-cities-and-iot/

[7] https://www.gov.uk/government/news/smart-tech-to-be-trialled-in-towns-and-cities-with-4-million-funding-to-boost-local-connectivity

[8] https://redknightconsultancy.co.uk/2025/01/07/uk-innovation-funding-trends-for-2025/

[9] https://researchbriefings.files.parliament.uk/documents/POST-PN-0656/POST-PN-0656.pdf

[10] https://www.thesmartcityjournal.com/en/cities/london-is-the-world-s-smartest-metropolis-according-to-iese-cities-in-motion-index

[11] https://www.startus-insights.com/innovators-guide/smart-city-startups/

[12] https://eu.eventscloud.com/file_uploads/2ed36ce5867a41381abc8a5861b7fcd7_UKSmartCitiesDirectory.pdf

[13] https://soracom.io/blog/iot-smart-city-trends-2025/

[14] https://www.gov.uk/government/publications/the-smart-data-roadmap-action-the-government-is-taking-in-2024-to-2025

[15] https://www.openaccessgovernment.org/smart-tech-in-towns-and-cities-a-1-3-million-pilot/166799/

[16] https://www.irwinmitchell.com/news-and-insights/expert-comment/post/102k10j/uk-cities-shine-in-european-cities-and-regions-of-the-future-2025

[17] https://bebeez.eu/2025/03/18/innovation-nation-10-of-the-most-promising-british-startups-to-watch-in-2025/

[18] https://www.ipsos.com/en/london-takes-first-place-2025-worlds-best-cities-report

[19] https://www.seedtable.com/best-smart-city-startups

[20] https://thoughtlabgroup.com/smarter-cities-2025/

[21] https://www.london.gov.uk/sites/default/files/smarter_london_together_v1.66_-_published.pdf

[22] https://www.innovationnewsnetwork.com/uk-smart-city-adoption/610/

[23] https://en.wikipedia.org/wiki/List_of_smart_cities

[24] https://www.citiesabc.com/resources/top-10-smart-cities-leading-the-way-in-2025/

[25] https://www.nucamp.co/blog/coding-bootcamp-united-kingdom-gbr-united-kingdoms-top-10-startups-that-tech-professionals-should-watch-out-for-in-2025

[26] https://techsouls.co.uk/top-10-uk-startups-to-watch-in-2025/

[27] https://www.tg0.co.uk/blog/technationals-top-25-startups-to-watch-in-2025

[28] https://en.wikipedia.org/wiki/List_of_unicorn_startup_companies


Appendix


Notable Start-ups and Tech Companies in Smart City Development


The UK's innovation ecosystem is rich with companies developing cutting-edge smart city technologies. This list is for reference purposes and further research.


Smart City Platforms and Infrastructure


  • Athena Smart Cities: Developing comprehensive smart city platforms.
  • N-Smart: Focusing on grid reliability solutions.
  • Urban Smart: Specialising in EV usage optimisation
  • Veniam: Offering high-speed internet and smart city services through connected urban vehicle fleets.


AI and Data Analytics


  • Convergence Labs: Created "Proxy," an AI-powered digital assistant designed to automate and simplify daily tasks for professionals. Founded in 2024, they have secured €11 million to accelerate research and bring their vision to market.
  • CuspAI: An AI-driven company revolutionising the discovery of breakthrough materials for sustainability and clean energy applications. Based in Cambridge, they have secured €27.6 million to advance their AI-powered materials research.


Urban Mobility and Transportation


  • NTD Energy: Developing smart city mobility solutions.
  • Ride Report: Providing cities with software platforms for running bike and scooter share programs.
  • Carmera: Creating real-time 3D HD maps and navigation data for autonomous vehicles.


Waste Management and Environmental Monitoring


  • Nordsense: Offering a SaaS-based smart waste management platform that helps optimise waste collection processes.
  • Sensate: Specialising in air and water quality monitoring systems.


Future Events and Opportunities


The Smart City Expo UK, scheduled for June 24–25, 2025, in London, will bring together leaders from smart cities, innovative companies, and governments to discuss future trends in urban technology. The event will feature sessions on cybersecurity for smart cities, AI integration in city operations, metaverse applications in real estate, and sustainable urban development.

Contact - Smart City article

Subscribe to our Newsletter

Blog Subscribe

SHARE CONTENT

Abstract kaleidoscope of AI generated shapes

What Is the Third Way to Successful AI Adoption?

by Tom Burton • 10 September 2025
This article explores the ‘Third Way’ to AI adoption – a balanced approach that enables innovation, defines success clearly, and scales AI responsibly for lasting impact | READ FULL ARTICLE
A Data centre in a field

Case Study: Expanding Deep Green's Market Presence Through Cambridge MC's Global Network

by Stuart Curzon • 22 August 2025
Discover how Deep Green, a pioneer in decarbonised data centres, partnered with Cambridge Management Consulting to expand its market presence through an innovative, sustainability‑driven go‑to‑market strategy | READ CASE STUDY
Crystal ball on a neon floor

Fixing the Future: How Digital Twins Will Transform Project Management

by Jason Jennings • 21 August 2025
Discover how digital twins are revolutionising project management. This article explores how virtual replicas of physical systems are helping businesses to simulate outcomes, de-risk investments and enhance decision-making.
A vivid photo of the skyline of Stanley on the Falkland Islands

Cambridge Management Consulting, Falklands IT, and Hermes/Viraat Heritage Trust Provide Educational Resources to the Falklands

by Cambridge Management Consulting • 20 August 2025
Cambridge Management Consulting (Cambridge MC) and Falklands IT (FIT) have donatede £3,000 to the Hermes/Viraat Heritage Trust to support the learning and development of young children in the Falkland Islands.
A modern office building on a wireframe floor with lava raining from the sky in the background

What Drives Your Organisation’s Cyber Security?

by Tom Burton • 29 July 2025
What’s your organisation’s type when it comes to cyber security? Is everything justified by the business risks, or are you hoping for the best? Over the decades, I have found that no two businesses or organisations have taken the same approach to cybersecurity. This is neither a criticism nor a surprise. No two businesses are the same, so why would their approach to digital risk be? However, I have found that there are some trends or clusters. In this article, I’ve distilled those observations, my understanding of the forces that drive each approach, and some indicators that may help you recognise it. I have also suggested potential advantages and disadvantages. Ad Hoc Let’s start with the ad hoc approach, where the organisation does what it thinks needs to be done, but without any clear rationale to determine “How much is enough?” The Bucket of Sand Approach At the extreme end of the spectrum is the 'Bucket of Sand' option which is characterised by the belief that 'It will never happen to us'. Your organisation may feel that it is too small to be worth attacking or has nothing of any real value. However, if an organisation has nothing of value, one wonders what purpose it serves. At the very least, it is likely to have money. But it is rare now that an organisation will not hold data and information worth stealing. Whether this data is its own or belongs to a third party, it will be a target. I’ve also come across businesses that hold a rather more fatalistic perspective. Most of us are aware of the regular reports of nation-state attacks that are attempting to steal intellectual property, causing economic damage, or just simply stealing money. Recognising that you might face the full force of a cyber-capable foreign state is undoubtedly daunting and may encourage the view that 'We’re all doomed regardless'. If a cyber-capable nation-state is determined to have a go at you, the odds are not great, and countering it will require eye-watering investments in protection, detection and response. But the fact is that they are rare events, even if they receive disproportionate amounts of media coverage. The majority of threats that most organisations face are not national state actors. They are petty criminals, organised criminal bodies, opportunistic amateur hackers or other lower-level actors. And they will follow the path of least resistance. So, while you can’t eliminate the risk, you can reduce it by applying good security and making yourself a more challenging target than the competition. Following Best Practice Thankfully, these 'Bucket of Sand' adopters are less common than ten or fifteen years ago. Most in the Ad Hoc zone will do some things but without clear logic or rationale to justify why they are doing X rather than Y. They may follow the latest industry trends and implement a new shiny technology (because doing the business change bit is hard and unpopular). This type of organisation will frequently operate security on a feast or famine basis, deferring investments to next year when there is something more interesting to prioritise, because without business strategy guiding security it will be hard to justify. And 'next year' frequently remains next year on an ongoing basis. At the more advanced end of the Ad Hoc zone, you will find those organisations that choose a framework and aim to achieve a specific benchmark of Security Maturity. This approach ensures that capabilities are balanced and encourages progressive improvement. However, 'How much is enough?' remains unanswered; hence, the security budget will frequently struggle for airtime when budgets are challenged. It may also encourage a one-size-fits-all approach rather than prioritising the assets at greatest risk, which would cause the most significant damage if compromised. Regulatory-Led The Regulatory-Led organisation is the one I’ve come across most frequently. A market regulator, such as the FCA in the UK, may set regulations. Or the regulator may be market agnostic but have responsibility for a particular type of data, such as the Information Commissioner’s Office’s interest in personal data privacy. If regulatory compliance questions dominate most senior conversations about cyber security, the organisation is probably in this zone. Frequently, this issue of compliance is not a trivial challenge. Most regulations don’t tend to be detailed recipes to follow. Instead, they outline the broad expectations or the principles to be applied. There will frequently be a tapestry of regulations that need to be met rather than a single target to aim for. Businesses operating in multiple countries will likely have different regulations across those regions. Even within one country, there may be market-specific and data-specific regulations that both need to be applied. This tapestry is growing year after year as jurisdictions apply additional regulations to better protect their citizens and economies in the face of proliferating and intensifying threats. In the last year alone, EU countries have had to implement both the Digital Operational Resilience Act (DORA) and Network and Infrastructure Security Directive (NIS2) , which regulate financial services businesses and critical infrastructure providers respectively. Superficially, it appears sensible and straightforward, but in execution the complexities and limitations become clear. Some of the nuances include: Not Everything Is Regulated The absence of regulation doesn’t mean there is no risk. It just means that the powers that be are not overly concerned. Your business will still be exposed to risk, but the regulators or government may be untroubled by it. Regulations Move Slowly Cyber threats are constantly changing and evolving. As organisations improve their defences, the opposition changes their tactics and tools to ensure their attacks can continue to be effective. In response, organisations need to adjust and enhance their defences to stay ahead. Regulations do not respond at this pace. So, relying on regulatory compliance risks preparing to 'Fight the last war'. The Tapestry Becomes Increasingly Unwieldy It may initially appear simple. You review the limited regulations for a single region, take your direction, and apply controls that will make you compliant. Then, you expand into a new region. And later, one of your existing jurisdictions introduces an additional set of regulations that apply to you. Before you know it, you must first normalise and consolidate the requirements from a litany of different sets of rules, each with its own structure, before you can update your security/compliance strategy. Most Regulations Talk about Appropriateness As mentioned before, regulations rarely provide a recipe to follow. They talk about applying appropriate controls in a particular context. The business still needs to decide what is appropriate. And if there is a breach or a pre-emptive audit, the business will need to justify that decision. The most rational justification will be based on an asset’s sensitivity and the threats it is exposed to — ergo, a risk-based rather than a compliance-based argument. Opportunity-Led Many businesses don’t exist in heavily regulated industries but may wish to trade in markets or with customers with certain expectations about their suppliers’ security and resilience. These present barriers to entry, but if overcome, they also offer obstacles to competition. The expectations may be well defined for a specific customer, such as DEF STAN 05-138 , which details the standards that the UK Ministry of Defence expects its suppliers to meet according to a project’s risk profile. Sometimes, an entire market will set the entry rules. The UK Government has set Cyber Essentials as the minimum standard to be eligible to compete for government contracts. The US has published NIST 800-171 to detail what government suppliers must meet to process Controlled Unclassified Information (CUI). Businesses should conduct due diligence on their suppliers, particularly when they provide technology, interface with their systems or process their data. Regulations, such as NIS2, are increasingly demanding this level of Third Party Risk Management because of the number of breaches and compromises originating from the supply chain. Businesses may detail a certain level of certification that they consider adequate, such as ISO 27001 or a System & Organization Controls (SOC) report. By achieving one or more of these standards, new markets may open up to a business. Good security becomes a growth enabler. But just like with regulations, if the security strategy starts with one of these standards, it can rapidly become unwieldy as a patchwork quilt of different entry requirements builds up for other markets. Risk-Led The final zone is where actions are defined by the risk the business is exposed to. Being led by risk in this way should be natural and intuitive. Most of us might secure our garden shed with a simple padlock but would have several more secure locks on the doors to our house. We would probably also have locks on the windows and may add CCTV cameras and a burglar alarm if we were sufficiently concerned about the threats in our area. We may even install a secure safe inside the house if we have some particularly valuable possessions. These decisions and the application of defences are all informed by our understanding of the risks to which different groups of assets are exposed. The security decisions you make at home are relatively trivial compared to the complexity most businesses face with digital risk. Over the decades, technology infrastructures have grown, often becoming a sprawling landscape where the boundaries between one system and another are hard to determine. In the face of this complexity, many organisations talk about being risk-led but, in reality, operate in one of the other zones. There is no reason why an organisation can’t progressively transform from an Ad Hoc, Regulatory-Led or Opportunity-Led posture into a Risk-Led one. This transformation may need to include a strategy to enhance segmentation and reduce the sprawling landscape described above. Risk-Led also doesn’t mean applying decentralised, bespoke controls on a system-by-system basis. The risk may be assessed against the asset or a category of assets, but most organisations usually have a framework of standard controls and policies to apply or choose from. The test to tell whether an organisation genuinely operates in the Risk-Led zone is whether they have a well-defined Risk Appetite. This policy is more than just the one-liner stating that they have a very low appetite for risk. It should typically be broken down into different categories of risk or asset types; for instance, it might detail the different appetites for personal data risk compared to corporate intellectual property marked as 'In Strict Confidence'. Each category should clarify the tolerance, the circumstances under which risk will be accepted, and who is authorised to sign off. I’ve seen some exceptionally well-drafted risk appetite policies that provide clear direction. Once in place, any risk review can easily understand the boundaries within which they can operate and determine whether the controls for a particular context are adequate. I’ve also seen many that are so loose as to be unactionable or, on as many occasions, have not been able to find a risk appetite defined at all. In these situations, there is no clear way of determining 'How much security is enough'. Organisations operating in this zone will frequently still have to meet regulatory requirements and individual customer or market expectations. However, this regulatory or commercial risk assessment can take the existing strategy as the starting point and review the relevant controls for compliance. That may prompt an adjustment to security in certain places. But when challenged, you can defend your strategy because you can trace decisions back to the negative outcomes you are attempting to prevent — and this intent is in everyone’s common interest. Conclusions Which zone does your business occupy? It may exist in more than one — for instance, mainly aiming for a specific security maturity in the Ad Hoc zone but reinforced for a particular customer. But which is the dominant zone that drives plans and behaviour? And why is that? It may be the right place for today, but is it the best approach for the future? Apart from the 'Bucket of Sand' approach, each has pros and cons. I’ve sought to stay balanced in how I’ve described them. However, the most sustainable approach is one driven by business risk, with controls that mitigate those risks to a defined appetite. Regulatory compliance will probably constitute some of those risks, and when controls are reviewed against the regulatory requirements, there may be a need to reinforce them. Also, some customers may have specific standards to meet in a particular context. However, the starting point will be the security you believe the business needs and can justify before reviewing it through a regulatory or market lens. If you want to discuss how you can improve your security, reduce your digital risk, and face the future with confidence, get in touch with Tom Burton, Senior Partner - Cyber Security, using the below form.
AI co-pilot

AI as Your Project Management Co-Pilot: Beyond Basic Automation

by Jason Jennings • 28 July 2025
Jason Jennings | Elevate your project management with AI. This guide for senior leaders explains how AI tools can enhance project performance through predictive foresight, cognitive collaboration, and portfolio intelligence. Unlock the potential of AI in your organisation and avoid the common pitfalls.
St Pauls Cathedral

English Devolution Bill: What It Means for Local Authorities and Communities

by Craig Cheney • 24 July 2025
Craig Cheney | The UK Government has taken a major step forward in reshaping local governance in England with the publication of the English Devolution and Community Empowerment Bill. This is more than a policy shift — it’s a structural rethink that sets out to make devolution the norm, not the exception.

Partner Spotlight: Faye Holland

by Faye Holland • 11 July 2025
Today, we are proud to be spotlighting Faye Holland, who became Managing Partner at Cambridge Management Consulting for Client PR & Marketing as well as for our presence in the city of Cambridge and the East of England at the start of this year, following our acquisition of her award-winning PR firm, cofinitive. Faye is a prominent entrepreneur and a dynamic force within the city of Cambridge’s renowned technology sector. Known for her ability to influence, inspire, and connect on multiple fronts, Faye plays a vital role in bolstering Cambridge’s global reputation as the UK’s hub for technology, innovation, and science. With over three decades of experience spanning diverse business ventures, including the UK’s first ISP, working in emerging business practices within IBM, leading European and Asia-Pacific operations for a global tech media company, and founding her own business, Faye brings unparalleled expertise to every endeavour. Faye’s value in the industry is further underscored by her extensive network of influential contacts. As the founder of cofinitive, an award-winning PR and communications agency focused on supporting cutting-edge start-ups and scale-ups in tech and innovation, Faye has earned a reputation as one of the UK’s foremost marketing strategists. Over the course of a decade, she built cofinitive into a recognised leader in the communications industry. The firm has since been featured in PR Weekly’s 150 Top Agencies outside London, and has been named year-on-year as the No. 1 PR & Communications agency in East Anglia. cofinitive is also acknowledged as one of the 130 most influential businesses in Cambridge, celebrated for its distinctive, edge, yet polished approach to storytelling for groundbreaking companies, and for its support of the broader ecosystem. Additionally, Faye is widely recognised across the East of England for her leadership in initiatives such as the #21toWatch Technology Innovation Awards, which celebrates innovation and entrepreneurship, and as the co-host of the Cambridge Tech Podcast. Individually, Faye has earned numerous accolades. She is listed among the 25 most influential people in Cambridge, and serves as Chair of the Cambridgeshire Chambers of Commerce. Her advocacy for women in technology has seen her regularly featured in Computer Weekly’s Women in Tech lists, and recognised as one of the most influential women in UK tech during London Tech Week 2024 via the #InspiringFifty listing. Faye is also a dedicated mentor for aspiring technology entrepreneurs, having contributed to leading entrepreneurial programs in Cambridge and internationally, further solidifying her role as a driving force for innovation and growth in the tech ecosystem. If you would like to discuss future opportunities with Faye, you can reach out to her here .
Cambridge MC Falklands team standing with Polly Marsh, CEO of the Ulysses Trust, holding a cheque

The Ulysses Trust Receives £10,000 Donation from Cambridge Management Consulting

by Lucas Lefley • 10 July 2025
From left to right: Tim Passingham, Tom Burton, Erling Aronsveen, Polly Marsh, and Clive Quantrill.
More posts