LIDA & KPMG UK Join Forces to Transform Cyber Response with Data Science

KPMG UK has engaged the Leeds Institute for Data Analytics (LIDA) to deliver a six-month project under its Data Scientist Development Programme (DSDP), focused on advancing capabilities in detecting, analysing, and responding to malicious cyber threats.

KPMG UK’s cyber division responds to hundreds of incidents annually, ranging from small-scale business email compromise cases to nation-state activities targeting critical national infrastructure. As a result, there is a substantial volume of both historic and current data available for analysis.

Starting this month, the LIDA data scientist and their supervisory team will work closely with KPMG UK’s Cyber Response and Recovery Services (CRS) team, comprising professionals from law enforcement, government, and the private sector, to:

• Develop methodologies
• Create dashboards and visualisations
• Produce thought leadership and academic dissemination
• Identify findings and lessons learned
• Explore the potential for algorithm development in future cyber security incidents

The team also hopes to influence the application of data science methods across other related projects.

It is expected that the models developed as part of the project can be deployed on real-life cases afterwards by KPMG UK. It is also expected that the lessons learnt during the project will lead to updated cybersecurity procedures, to ensure efficient handling of cyber incidents by the CRS team. These may also be recorded in a manual to provide access to the public to the latest security advice.

Cyber security incident data is often extensive, sourced from a wide array of formats and providers, yet typically used only for triage purposes. This project will analyse cyber threat intelligence from commercial providers and incident investigation data to gain deeper insights.

Cybercrime is estimated to cost the UK £27 billion per year¹. As a direct consequence, cyber incident investigations are typically time-consuming, resource-intensive, and heavily manual, relying on expert analysis of large, complex datasets including log files, alerts, metadata, configurations, and event records. This response work is often time-sensitive and requires highly trained and sought-after resource to complete.

Earlier this year, Peter Kyle, Secretary of State for the Department for Science, Innovation and Technology, announced a new Cyber Security and Resilience Bill, stating: “Hostile cyber activity in the UK has grown more intense, frequent, and sophisticated, with real-world impacts for UK citizens. Last year, a ransomware attack on the NHS led to over 11,000 postponed outpatient appointments and procedures. The Cyber Breaches Survey 2024² also reveals the significant scale of the challenge we face, with half of businesses reporting some form of cyber security breach or attack in the past twelve months.

The National Cyber Security Centre’s Annual Review 2024³ describes the threat landscape as ‘diffuse and dangerous’, with persistent attacks from hostile states and organised crime. This poses a threat to our national security.” ⁴

Dave Harvey, Director of Cyber Response and Recovery at KPMG UK, said:“We are confident that this collaboration will be mutually beneficial, fostering knowledge exchange, innovation, and the development of practical solutions that address real-world cyber security challenges.”

Susan Grant-Muller, LIDA Co-director said “Deliberate threats to cyber security have become increasingly sophisticated, entailing a huge cost to individuals, the economy and broader society. There is a pressing need to build capacity to counter this through cohorts of next-generation data scientists with the specialist skills required. LiDA is delighted to partner with KPMG in this space, with the twin goals of capacity building and providing an advisory resource to the public.”

Kylie Norman, DSDP Manager said, “This is an invaluable opportunity for one of our data scientists to build their skills base and exposure to different kinds of real-world data. Whilst developing their methods, they’ll benefit from knowledge-exchange with KPMG’s cyber division and play a role in helping to identify future vulnerabilities and patterns of cyber-attack.”

References

1. The Cost of Cyber Crime
2. Cyber security breaches survey 2024
3. National Cyber Security Centre’s Annual Review 2024
4. Cyber security and resilience policy statement

Footnotes

• The LIDA Data Scientist Development Programme is a 12-month, paid opportunity for graduates and career changers pursuing a career in data science. Participants work on real-world problems across public, private, charitable, and academic sectors, while receiving mentorship from leading scholars and professionals.
• KPMG LLP, a UK limited liability partnership, operates across the UK with approximately 17,000 partners and staff. The UK firm recorded revenue of £2.99 billion in the year ended 30 September 2024.  KPMG is a global organisation of independent professional services firms providing Audit, Legal, Tax and Advisory services. It operates in 143 countries and territories with more than 275,000 partners and employees working in member firms around the world. Each KPMG firm is a legally distinct and separate entity and describes itself as such. KPMG International Limited is a private English company limited by guarantee. KPMG International Limited and its related entities do not provide services to clients.
• KPMG has a strategic partnership with the University of Leeds, enabling collaboration through access to talent and skills. KPMG also maintains a physical presence at Nexus, the University’s innovation hub.

Work with us

We support our partners in many ways, from business insights to data storage and analysis, to staff development and student recruitment.

We run data insight projects with partners across the private, public and charity sectors, often working with confidential and highly sensitive personal information. We work with all types of data including health, transport, commercial, cyber and social media.