What Held When the Ransomware Hit: Three UK Zero-Trust Drills, Three Hard Lessons

Tabletop exercises are useful, but they rarely test the awkward parts of resilience: the legacy print server, the shared scanner account, the medical device that nobody inventoried, the break-glass process that only one engineer understands. In 2026, a small number of UK organisations moved to live-fire ransomware simulations inside controlled enclaves. The point was not to prove that zero trust works. It was to find where it fails under operational load.

The three accounts below are drawn from drill debriefs. Organisations are described by sector and region rather than name. Each had a zero-trust programme underway, each accepted a degree of controlled risk, and each found that architecture mattered less than the operating discipline around it.

The metropolitan borough council: segmentation without an operational map

A council in the north of England ran a simulation in which an encrypting payload was introduced through a phishing email on an administrative workstation. The red team attempted lateral movement towards revenues and benefits, social care and a legacy environmental sensor network.

What held was identity-based access and multi-factor authentication on the corporate estate. Microsegmentation around the case-management platform prevented the simulated payload from reaching the main resident records system. The council's incident command structure also activated quickly, partly because it had rehearsed service-level priorities during a prior cyber exercise.

What broke was less glamorous. A legacy print estate sat outside the segmentation model and became an unmanaged bridge between floors. A facilities VLAN containing environmental sensors had no owner in the configuration management database. A helpdesk account retained standing local administrator rights because a third-party support contract had never been updated. None of these failures required a sophisticated adversary; they required ordinary entropy.

The lesson is that segmentation must be built from a service map, not a building plan. The council now segments by service dependency and records exceptions in a register with named owners and expiry dates. It also tests legacy and facilities networks in every drill. Other UK councils should copy the exception register before they copy the architecture.

The Midlands logistics operator: identity at the edge

A logistics operator with warehouse estates across the Midlands simulated a compromise that began with a third-party maintenance account. The attacker moved from an internet-facing support portal towards the warehouse management system and the operational technology that controls conveyor sortation.

What held was conditional access tied to device posture, just-in-time administration and microsegmentation between corporate IT, the warehouse management system and the OT estate. The operator had also removed persistent VPN access for contractors and replaced it with short-lived, approved sessions. When the simulated attacker tried to reuse a departed contractor's credentials, the account had already been disabled.

What broke was the human layer around shared identities. Handheld scanners in two warehouses still used shared accounts because individual logins slowed shift changes. Alert fatigue meant a suspicious authentication event was queued rather than investigated for over an hour. The drill also exposed that the fallback process for a warehouse management outage was documented but not rehearsed by night shift.

The lesson is that zero trust for logistics must include machine and shared identities, not just named employees. The operator now maintains an identity inventory for scanners, service accounts and third-party maintenance tools, and has introduced just-in-time elevation with supervisor approval. It also runs a short manual fallback drill each quarter. UK logistics leaders should test the warehouse floor, not just the data centre.

The NHS acute trust: clinical availability under attack

An acute NHS trust simulated ransomware in its corporate IT estate with a controlled attempt to move towards clinical VLANs and medical devices. The trust had segmented clinical and corporate networks and had isolated backups, but the drill still produced uncomfortable findings.

What held was the separation between corporate and clinical estates, endpoint detection and response coverage on managed clinical workstations, and an incident command structure that included clinical leadership. Backup restoration was tested from an isolated environment and met its recovery time objective for a priority clinical system.

What broke was asset inventory for medical devices. Several devices were known to estates but not to the cyber team, and one imaging modality sat on a segment with broader access than expected. Out-of-hours approval for break-glass accounts was slow because the rota had changed. Communications to ward managers were inconsistent, with some teams receiving updates through informal channels before the official cascade.

The lesson is that zero trust in healthcare must be designed around clinical availability, not just data confidentiality. The trust has since accelerated device discovery, simplified break-glass approval for on-call clinicians, and added ward-level communication checks to its exercise programme. NHS leaders should treat medical device inventory as a zero-trust prerequisite, not a supporting task.

What the three drills had in common

All three organisations found that identity hygiene outranked tooling. Stale accounts, shared credentials and standing privileges were the most common paths that the red teams could exploit. All three also found that segmentation was only as good as the asset map behind it. An unmanaged printer, sensor or scanner can undo a carefully designed policy boundary.

The drills also highlighted the importance of exceptions. Zero trust does not eliminate exceptions; it makes them visible, owned and time-bound. Break-glass access, legacy systems and clinical or operational technology will always require careful deviation. The difference is whether those deviations are documented and tested.

Finally, each organisation benefited from rehearsing response, not just prevention. Detection, escalation, communications and manual fallback procedures determined how long services remained degraded. Zero trust bounded the simulated incidents, but resilience came from people knowing what to do when a boundary was crossed.

For UK IT leaders planning 2026 and 2027 exercises, the practical recommendation is to run live-fire simulations with clear safety controls, independent red teams and clinical or operational observers in the room. The objective is not a clean report. It is a short list of entropy that can be removed before a real attacker finds it.