A spotlight on…PwC

PwC combines cutting‑edge technical expertise with business-focused strategy to protect today’s digital organisations. They help clients anticipate threats, build robust defences and recover rapidly, all while enabling growth. Insights from Westlands Navigator 2025 confirm their leadership, particularly in Operational Technology (OT) environments.

Why it matters

• In 2025, “human‑operated” ransomware attacks persist as the most damaging cyber threat – crippling organisations, disrupting operations, costing millions and taking weeks to recover. Preparing for attack through robust cyber testing, simulation and transformation programs is essential for modern business reliant on IT systems.
• OT systems underpin critical infrastructure across energy, transport, manufacturing and public services. As global connectivity grows, so do threats, and yet OT cybersecurity maturity remains low.
• PwC’s recognition by Westlands Advisory as a Leader in the Industrial Cybersecurity Consulting & Managed Services Navigator 2025 highlights their exceptional OT depth, with approximately 400 specialised experts, proprietary OT labs, and end-to-end frameworks.

How PwC delivers

1. Ethical Hacking & Testing

PwC has a large UK penetration testing team working with colleagues from across the global firm to provide the full range of world leading ethical hacking services including advanced red team simulations. This is underpinned by our global threat intelligence team and advanced hardware hacking capability to support the regulatory frameworks required for modern connected systems.

2. Strategy & advisory

PwC defines cyber strategies aligned with business goals, regulatory changes and risk appetite. Their advisory services provide frameworks, risk quantification tools, regulatory compliance artefacts (NIST, ISO 27001), and cyber-risk board reporting to support confident decision-making.

3. Design & transformation

PwC helps clients improve their operational capability and resilience by turning their cyber security strategy into a roadmap to enhance their systems and processes, testing and fine tuning their defences. PwC’s cyber security solutions and expertise enable their clients to detect evolving cyber security threats, remediate weaknesses, provide real-time decision-making, and protect assets and sensitive data.

4. Managed cyber services

PwC helps clients to stay ahead of complex and ever-evolving cyber security threats. PwC’s 24/7 managed services, including Managed Cyber Defence (with MDR and MCS), Digital Identity, and Privileged Access Management, enable clients to manage threats proactively with real-time visibility and automated response capabilities.

5. Incident response & ransomware recovery

PwC blends proactive readiness with reactive precision. Their frameworks include incident playbooks, tested offline backups, containment procedures, business-focused recovery strategies and forensic expertise. Recent guidance from PwC’s Will Oram outlines six core capabilities required to recover from ransomware within 48 hours, although average recoveries still stretch weeks without proper preparation.

Awards & recognition

• Hold extensive industry certifications and strong partnerships with leading technology vendors.
• Recognised as a Leader in Industrial Cybersecurity Consulting & Managed Services Navigator 2025 by Westlands Advisory.
• Fintech Wales award for best academic program in partnership with Cardiff University for a joint project to design and deliver a new NCSC approved Cyber MSc degree
• Acknowledged by IDC MarketScape as a Leader for Systems Integrators/Consultancies in Cybersecurity, and for Cyber Risk Management Services.
• Named a Pacesetter in Cyber Security Consulting by ALM Intelligence.

Cybersecurity Services

PwC’s proactive approach to cybersecurity addresses the evolving challenges in the digital landscape. Their services include:

1. Proactive Cyber Defence: Organisations face many challenges when building a proactive cyber defence and detection capability. As cyber threats become more sophisticated, businesses need cyber security that not only protects the business today but provides proactive defence against new and emerging threats. Using machine learning and automation, PwC delivers data-driven defence and detection services. The focus is on providing enhanced protection and visibility into potential attacks, coupled with technical and business expertise for informed decision-making. https://www.pwc.co.uk/issues/cyber-security-services/defence-and-detection.html

2. Cyber Incident Response and Recovery: Any business can fall victim to a cyber incident or crisis. The organisations who respond and recover most quickly and successfully are those that have prepared in advance and have the expertise and structure to guide them through such exceptional circumstances. PwC provides practical advice and hands-on expertise to prepare for and respond to cyber incidents. This ensures business continuity and effective recovery efforts.

3. Operational Technology Cyber Security: Cyber-attacks on operational technology are becoming more complex and more prevalent. PwC helps organisations stay ahead of threats, maintain operational continuity, and strengthen cybersecurity for greater resilience. 

What clients say

“PwC brings together a deep bench of approximately 400 specialised experts in OT and IoT security… deeply embedded in its customers’ ecosystems… navigating cross-domain challenges.”

Securing future transport: PwC’s Cardiff-based cyber capabilities

As modern transport systems evolve into complex, software-defined platforms, the cyber threat landscape surrounding them has intensified. Modern vehicles are no longer standalone machines—they are connected devices on wheels, often integrating over-the-air updates, multiple ECUs, cloud backends, and mobile interfaces. To address these risks, PwC has established a comprehensive cyber security testing capability, centred around its Connected Systems Research Facility (CSRF) in Cardiff.

This 6,000 sq ft dedicated test facility serves as the operational hub for end-to-end cyber testing and validation of connected products—particularly charging infrastructure and EV vehicles. Equipped with an advanced Faraday chamber and industrial-grade high-power electrical supply, it enables testing of electric vehicle platforms, V2X communications, embedded systems, cellular and RF interfaces, and charging equipment—all in a controlled, secure environment.

A purpose-built capability for vehicle OEMs and tier suppliers

PwC’s Cardiff facility integrates physical testing infrastructure with a highly skilled cyber team specialising in:

• Embedded systems and ECU testing
• RF/cellular/Bluetooth protocol analysis
• Firmware extraction, reverse engineering and fuzzing
• Static and dynamic code analysis
• Secure OTA validation and resilience assurance
• OBD port and diagnostic interface hardening

This capability has been structured to support manufacturers and suppliers across all stages of the vehicle lifecycle—from secure-by-design engineering to post-production assurance and incident response readiness.

Integrated cyber activities across the product lifecycle

PwC helps automotive clients embed cyber security into their vehicle development journey in alignment with standards such as ISO/SAE 21434, UNECE R155/R156, and emerging global regulations. Activities span:

• Secure architecture definition, including identity and access control design
• Cyber risk and threat modelling at the component and system level
• CI/CD security tooling integration (SAST, SBOM, secure signing)
• Penetration testing at ECU and vehicle level
• Cybersecurity assurance governance and PSIRT development
• Secure supply chain engagement and validation frameworks
• Vehicle Security Operations Centre (vSOC) design and pilot deployments

Their approach enables manufacturers to build confidence in vehicle security posture, reduce regulatory risk, and implement measurable assurance at scale.

Outlook: resilient by design

• Investing in recovery capability: Recovery within 48 hours is possible, but demands proactive defence measures, rehearsed playbooks and scalable rebuild operations.
• Simulate attacks against critical systems: As threats persist in the real world, it’s essential to understand how your key systems could be attacked and to ensure appropriate mitigations are implemented and tested.
• OT environments require a maturity lift: As threats escalate, OT cybersecurity must be embedded into enterprise risk postures, not treated as an afterthought.
• Security across the lifecycle: Embedding cyber security into procurement, engineering, operations and change management ensures sustainable resilience.
  
  

Contact PwC Cyber Security

To connect with PwC’s cyber security leaders, visit:
www.pwc.co.uk/cybersecuritycontacts

Summary

PwC continues to lead in cyber security and resilience in 2025, particularly across industrial and OT domains. With award-winning advisory services, full-spectrum delivery, continuous managed protection and robust incident response capabilities, they empower organisations to outthink, outpace, and outperform cyber adversaries, delivering clarity, confidence, and growth.

Find out more about PwC