Interviews 07.07.2026
Gemma Ungoed-Thomas has spent over two decades performing what she considers “the best and most exciting roles in Government” and for the very first time, she’s ready to talk about it in this exclusive interview with Assured’s Eleanor Dallaway
“I came out of a hyper-rational organisation (NCSC), full of largely introverted people, and I landed in a Boris Johnson Number 10,” my interviewee tells me, eyes wide and eyebrows raised, a trace of a smile on her lips.
I’m deliberately starting here, in the middle of our interview and her career, because, frankly, the opportunity to peep behind the curtains of Number 10 Downing Street through the eyes of someone with unfiltered and boundless access to the UK Government may be a once-in-a-lifetime opportunity for this journalist. We meet in a discreet location, known by its address rather than name, and drenched with meaningful and patriotic photography.
Let me introduce you to Gemma Ungoed-Thomas, who previously served as the private secretary for home affairs and national security issues, or in her words, “the top person advising the Prime Minister on everything to do with crime, policing, the justice system, prisons, courts, and national security.” Incredibly, this is only one of the extraordinarily prestigious and distinguished roles she has served.
Most recently, Ungoed-Thomas served as director of state threats, cyber and technology at The Cabinet Office, but her CV also boasts deputy director of incident management at the NCSC, head of cyber defence and international at The Cabinet Office, as well as deputy director for the Office of the Prime Minister.
For a woman who has lived the past decade and a half in the most high-pressure environments, often in utter chaos, with more accountability than most of us can dare imagine, Ungoed-Thomas is surprisingly calm. Her demeanour is quietly understated yet authoritative, her confidence gentle and unassuming.
“The calm comes from years of dealing with difficult, scary things,” she explains. “Switch would call me at out of hours, and I would have to decide whether to wake up the Prime Minister. I was one week into the job when we had a terror attack in Forberry Gardens,” she recalls, explaining that remaining calm is a prerequisite.
She was working at the National Cybersecurity Centre (NCSC) when she saw the Number 10 job ad appear on a careers board. After a lengthy application process, she found herself sat across from Dominic Cummings and Boris Johnson. The year was 2020, lockdown was in full swing, and the PM had only recently been discharged from hospital after his well-documented battle with COVID-19.
“You’re keeping the Prime Minister informed, getting decisions from him, but you’re also keeping the system calm and functioning”
“I hadn’t met them before that day,” she recalls. “Dom asked me about the data process and my take on government data. The PM asked me about the prison system and recidivism. It was like an out-of-body experience, but I was struck by the opportunity to be part of the mission.” At this point, I ask an exhaustive list of questions about this interview, of which Ungoed-Thomas graciously answers.
“Then I got a call saying, ‘Congratulations, can you start tomorrow?’” She asked permission from Ciaran Martin, her manager at NCSC, and recalls how supportive he was. In the blink of an eye, she found herself walking through that famous door on her first day. “You’re met by a ‘Rolls-Royce’ system which clicks into place on your arrival. You’re the new private secretary for home affairs, which is one of the most demanding roles in Number 10.”
What does a ‘Rolls-Royce’ system look like, I ask? “An amazing team meets you, telling you where you’ll be working, where to park, and all your IT is done immediately. They showed me the Downing Street switchboard – it was a world-class team of people, who I’d get to know very well over the years.”
That world-class talent is operating on “really old systems, though. It’s a beautiful old Georgian townhouse, but it’s small and not necessarily equipped with what it needs. The wifi doesn’t work well,” she laughs.
The weight of responsibility that role carries is felt the second you walk through the door, Ungoed-Thomas recalls. “You’re going to brief the Prime Minister, and it has to be accurate, and you have to ensure that the right steps are taken so that the agencies, operational partners and the police can do their jobs. You’re keeping the Prime Minister informed, getting decisions from him, but you’re also keeping the system calm and functioning.”
Did any doubt on your decision to take on the role emerge as you landed at Number 10, I ask? “No, I wanted to do it, and with the support of some amazing people like Ciaran Martin and former deputy national security advisor, Paddy McGuiness, I felt confident that I could.” While she knew she had to get up to speed with policing issues, the court system and some “arcane bits of the judiciary system”, she had operational credibility, policy expertise and a willingness to learn from experts in any space where she lacked experience.
She uses the word intense frequently throughout our time together, and unsurprisingly it’s how she described her first day at Downing Street. “A lot of people were tired, a lot of people had COVID-19, but I was blown away by the world-class people [exhibiting] really great behaviours under difficult pressure, and quite frankly, a really lively political team.
“The PM liked to assemble a political team that represented a really diverse set of views that can be really far left and really hard right; it was reflective of society. My job, as the private secretary, was to steward that, and when you’ve got people in the political team that are in complete disagreement, that is quite turbulent to bring together for the Prime Minister.
“When I felt the political team were pressuring in a certain way, I’d have to double down and go the extra mile to make sure the Prime Minister was protected, and at times that was really uncomfortable.” She references the additional pressure that the pandemic bestowed. “It was an emotionally fraught time, but you’ve got to be the rock. It was a real privilege.”
“When I felt the political team were pressuring in a certain way, I’d have to double down and go the extra mile to make sure the Prime Minister was protected, and at times that was really uncomfortable”
She references the Home Affairs brief, which she recalls as particularly difficult, especially on immigration. “The political team were very divided, so there would be a lot of heat from certain people. I had to be a neutral buffer, remain calm, protect the process, and ensure the Prime Minister gets the right information from law enforcement, agencies and practitioners.”
Her job, she explains, was to compile the views of the political, operational and technical teams. The result of this diversity of opinion, she argues, was better policy-making. “Did they always get it right? No, that would be too binary to say. But I’m really proud of the decisions I helped steward at the time to ensure we had a good national security posture.”
Did she feel empowered during her tenure at Number 10? “Totally,” she answers without hesitation. “You have a lot of authority as the authentic voice of the Prime Minister. You then deliver that to the whole system. It’s a powerful position to be in.”
She admits that, at times, she felt let down by the lack of information from different government departments. “I’d have to advise the Prime Minister on taking a really hard decision without that data, and that was uncomfortable,” she states.
At Number 10, the days were long and hectic, Ungoed-Thomas reflects. How long? “Long,” she repeats. And hard. “In the Home Affairs brief, there was always something going on: a public disorder incident, a potential terror attack, a cyber attack.”
I ask her what her hardest day was. After a short pause, she decisively says: “Sarah Everard. It was a complete shock. Delivering the news to the Prime Minister and the political team…” she trails off, before adding: “It pales in comparison to what Sarah’s family went through.
“I worked really closely with the Met chief; it was such a shocking thing to happen.” Ungoed-Thomas is visibly upset as she recalls how it unravelled. “It was important that lessons were learnt,” she says in reflection. There was a review into the Met Police after Sarah Everard, and it found institutional misogyny, racism and homophobia. Five years later, and Ungoed-Thomas references Baroness Louise Casey being asked if things have got better. “She said, ‘Not enough’ and I wholeheartedly agree. Our public institutions don’t work if you don’t have public trust.”
The Afghanistan evacuation also fell within her tenure: “I worked really closely with the military during that period,” she recalls, “and we had a few terror attacks. My role was to ensure that the Home Office, police, and the agencies could respond appropriately whilst always ensuring the PM had the right information at the right time.
“Put it this way, I had to walk in and interrupt meetings quite a lot. I’d stop the meeting and throw everyone out to brief the Prime Minister. We would take decisions and then communicate that back to the system.” This was a tall order for someone who describes herself as a “classic understated, self-effacing type of shy person.” Her arrival at Number 10 forced the introversion into extroversion.
Deciding whether to terminate meetings or wake the PM up in the middle of the night was all part of the job. “I’d always get the first call,” she tells me. I ask her whether she ever worried she’d overreacted or underreacted. “It’s a fine balance, and if you got it wrong once, it’s really high stakes,” she says, which I consider a clever way of answering without an answer.
To put it simply, Ungoed-Thomas was responsible for the information flow to the Prime Minister, which meant for many years, she never put her phone down. ‘Always on’ in the true sense of the word. She nods at this cliché come reality. “Through the Afghanistan withdrawal period, I would often take my daughter, who was six or seven at the time, into work with me. I am extremely proud of being the first single mum to do that role, and I couldn’t have done it without the support of my daughter’s dad and his excellent partner.” Ungoed-Thomas gets visibly emotional, which she jokingly blames on “too much coffee.” But we return to the topic, and she proudly states, “If you’ve got the right support in place, you can do these really challenging roles. We should talk about it more and have more flexible working [for parents] – I’m a big advocate for that.”
The always-on has lived on beyond Number 10. “In my counter-state threats role, we’ve had a spate of Russian sabotage stuff over the last couple of years and involvement with Ukraine, so I’ve been always on, always monitoring my phone.” Regulating her nervous system has been essential, and for Ungoed-Thomas, that comes in the form of running and weightlifting. Is there a gym at number 10, I ask? She shakes her head, laughing at my suggestion.
She describes her risk alert as “always dialled up”, conscious of balancing it with a life without constriction. She gives the Taylor Swift Eras tour as an example. “I got last-minute tickets to see Taylor Swift for my daughter. Mum-of-the-year for getting them, and so many wow moments, but I remember being there, everything that could happen running through my mind. A close friend of mine from Number 10 doesn’t like going to crowded spaces or public spaces like that…” she trails off, and the gravity of that statement sends a shiver down my spine. But we agree that if any concert was worth the risk, it was that one.
This might be the right time to dip into Ungoed-Thomas’ roots. She has the accent you’d expect from someone who had served in Number 10. I suppose that’s my way of saying she’s extremely well spoken. What I don’t expect is her to tell me her parents are Glaswegian publicans, “hardworking, working-class publicans,” she states, adding that they’re strong role models for her, “working hard all their life to give me, my brothers and sisters opportunities they didn’t have.” Indeed, Ungoed-Thomas was the first of her family to go to university.
She moved around as a child, moving to an isolated place in South Wales, “getting into horsey stuff, training racehorses and doing lots of crazy hunting. I was a calm child, but I was used to high-octane jeopardy.” Which, of course, panned out to be perfect training for her career.
She credits her parents for instilling in her the work ethic that she has carried through her career. “They strongly believe in the country and national mission, so that was inculcated into me. It just felt like I had a higher purpose,” she reflects, as she ponders her path from childhood to civil servant. “Was I political growing up? Not really, maybe I’m still not, but I’m passionate about making decisions that do not adversely affect national security.”
Her first public-sector role was with the Committee on Standards in Public Life. “Being part of holding government to account and thinking about trust in our institutions is really important. I was a very junior researcher, but from there I moved into the Cabinet Office, into a private office working for a bunch of junior Labour ministers. She was in her twenties, in at the deep end, and “working at the nexus of the political system.”
It was from this political launchpad that she took her first leap into the national security space. Lured by the mission, Ungoed-Thomas accepted GCHQ’s proposal to take her Whitehall experience to the intelligence agency and moved to Cheltenham. The year was 2010, and she describes her time with utter warmth. “I loved it because I was fully embedded in their technical teams with amazing, privileged access to the mission.”
She returned to London two years later to give birth to her daughter and, after maternity leave, rejoined the Cabinet Office. Fast forward a few years and WannaCry hit. It was 2017, and suddenly something that previously only technical teams had dealt with was affecting the whole of society. I’m referring, of course, to the global ransomware attack that spread rapidly across hundreds of thousands of computers in 2017 by exploiting a vulnerability in Microsoft Windows, bringing the NHS to its knees. “We managed the response from the Cabinet Office, co-ordinated through COBR. It was such a wake-up call, and I was fascinated by it.”
I ask her to take me back to that Friday afternoon in May 2017. Anyone who has been writing about cyber as long as I have will often default to the ‘where were you when WannaCry happened?’ question, a shared fascination with personal stories relating to the day that cybersecurity went mainstream.
“I was in the office; it was a Friday afternoon – as it often is when these things happen – when it showed up on the news and the whole system erupted. In the first 24 hours, we spoke to GCHQ, cyber experts; we briefed The Cabinet Office and then Number 10. It was the first big cyber thing,” she reflects, adding that the structures and processes to handle it were woefully absent.
“[WannaCry] was a galvanising moment for the system. We dodged a bullet but knew we had to improve system response”
“At the time, we had many senior leaders with no idea about cyber. I was trying to be the bridge thanks to my previous stint at GCHQ. I’m by no means a technical person, but I knew enough to be of use.”
She compares the handling of WannaCry to the more recent CrowdStrike event of 2024. “Knowing when to act really quickly and what to do is key to help senior decision-makers take really difficult decisions when they don’t have all the information.”
She describes WannaCry as “a wake-up call without too much damage”. Thanks to the kill switch, I add, and she nods. “It was a galvanising moment for the system. We dodged a bullet but knew we had to improve system response.”
As WannaCry started to resolve, Paddy McGuinness [deputy national security adviser at the time] said ‘wow, we got through those last few days, thank you and well done, I think you’re good at this.’”
This vote of confidence, combined with her newfound desire for greater involvement in the cyber mission, led her to the NCSC. Here she helped build the incident management function. “We handled a whole bunch of different crises, whilst also setting up a system for managing these thousands of cyber attacks happening all the time, and how to prioritise them.
“We set up the national incident management systems, trusted sharing, and ensured escalation to Number 10 and the Cabinet Office when appropriate.” As she talks about her time at NSCS, the admirable leadership of Ciaran Martin, the extraordinary Ian Levy, and the abundance of world-class talent, she lights up. She describes the culture as akin to that of an innovative start-up, but contends it was also scary. “Crisis management is often not tested until something bad happens, and we were responsible for providing the support and guidance in really serious incidents. NCSC cannot be the cyber ambulance service for the whole economy.”
If the NCSC was often treated as an ambulance, I ask why most businesses were calling 999. “It’s all the basic stuff,” she recalls. “Lack of preparation, many organisations hadn’t looked at how they could function without a computer.” She compared that to organisations that do the disaster response planning. “We saw last year with the Co-op cyber incident the difference when an organisation does a lot of playbook testing and preparatory work. It stands out.”
“NCSC cannot be the cyber ambulance service for the whole economy”
Really good leadership, especially in crisis, she explains, is about creating a good environment for other people to flourish. “In organisations, just like in government, when crisis hits, resilience isn’t just about having a hero that saves the day, or an engineer that works over the weekend and pulls it out the bag, or somebody who finds a kill switch” – Marcus Hutchins, we’re looking at you -“it’s about institutional resilience and preparedness, so you’re not relying on the heroics of one person.”
She cites Jaguar Land Rover as an example of a private-sector cyber incident that affected our entire economy. “We need to understand business more, find a way to get cybersecurity adopted with commercial reality injected. Richard Horne in his annual statement said the cyber threat is getting worse and the time to act is now. That’s all well and good, but it’s just an ask. It needs stronger messaging.”
At this point, I question Ungoed-Thomas on something she said towards the beginning of our time together: that “in government, it’s hard to influence change, you can only do so much.” This, I said, was so disheartening to hear. “You’re right to pick me up on that,” she contends. “What I meant is that we still need to cut through to boards and convince them to reprioritise cyber as a proper strategic risk. M&S and JLR were kitchen-table moments, but largely, this is still viewed as the CISO’s problem. I hear that [CISOs] still have difficulty making a business case to the board.”
I ask whether regulation is the answer. She considers this for a few seconds, before answering: “It’s hard to introduce more regulation at a difficult time economically. Read the room; it’s not the time to impose more costs on businesses.” Double-victimising isn’t the answer, she argues. “It’s a complicated debate: how do we get more organisations to prioritise cyber, because that’s important for UK growth and security, but without more cost.” She returns to the importance of commercial reality, adding that she has been instrumental in developing the new cyber action plan, which will be released later this year.
“The Cybersecurity Resilience Bill was introduced into Parliament last November. It will expand the scope to MSPs and critical suppliers to regulate in an important way for cyber. It’s a really big deal, but we do need to do more. Ransomware is unprecedented; it’s a really tricky problem, but before we rush into something, we need to make sure that it is commercially and operationally impactful.
“I don’t think any country in the world has got it right, and we need to get under the hood of how to break that business model.”
Had she not had her sliding doors moment and taken the path that led her to Number 10, she believes she’d still be at the NCSC today. I later ask her what her favourite (working) chapter has been and, unsurprisingly, she bestows the honour upon the NCSC. “It gives me the warm fuzzies thinking about it,” she admits. “Setting it up from scratch, creating an impact, what a privilege.”
I’m curious, having heard her declaration that she’s not technical, whether tenures at GCHQ and the NCSC left her feeling, at times, somewhat like an imposter. “Totally! Especially the early days in GCHQ. I found that world-class cryptographers, operators, linguists and whatever, don’t appreciate people trying to blag it,” she grins, “so I was always very upfront about [my lack of technical expertise]. I had something that they really needed, though; I could translate what they were doing for a non-technical audience, and that really resonated with people.”
Years of working alongside technical experts (she cites the technical and operational teams at GCHQ and the work they did with CEOP) and the multiple SANS courses she completed throughout the years, “led me to a point where I could get a handle on the technical stuff.” Of course, the taste of imposter syndrome served as good practice for Downing Street? She nods. “Having said that, the whole system at Number 10 is built to empower you as a private secretary so I didn’t feel for one moment that I didn’t have a seat at the table.” She pauses for a moment, smiling in the memory. “I was always listened to and supported by, quite frankly, a lively set of political advisors. I was empowered to own the room, and I never had a problem bowling into and throwing people out of meetings.” There’s no choice, she adds, “because if you don’t, you could delay the police or MI5.” I suppose what she’s really saying is: you have to because it is, quite literally, life or death.
That doesn’t mean it’s easy. “It’s rooms full of men. And talking about national security and military issues in a room full of men can be daunting, especially when you’re coordinating or chairing COBR.”
Throughout our time together, she name-checks several people, many of whom are household names in politics, as being instrumental in her career development, whether as mentors, supporters, or managers. I observe that almost all are men. “I’ve been so lucky to have so much support from men and women,” she corrects. Eliza Manningham-Buller (Head of MI5), Anna Keast-Butler (Head of GCHQ) and Yasmin Brooks (former DG in DCMS) all receive honourable mentions. If you look beyond the “rooms full of men”, you’ll find a “quiet network of amazing women in government.”
With access to the Cabinet Office’s director of state threats, cyber and technology, it would be remiss of me not to ask about how AI is challenging but also shaping the UK’s defence efforts. “AI has helped network defenders in a way that we’ve never seen before. It’s great for detection monitoring. The flipside is that it has lowered the barriers to entry for a whole bunch of malicious state actors.”
She continues: “AI widens our attack surface. But, all considered, overall, I think AI will be a net gain. We need to get the UK front and centre, fostering more AI fledgling companies. It’s great for UK growth, but it’s also great for our national security to have these companies based here.”
And with everything playing out in this geopolitically turbulent time, the need for world-class national defence has never been greater. “Russia is acting with a much higher degree of risk-taking, acting recklessly, using proxies to do things, sabotage…It definitely worries me,” Ungoed-Thomas admits.
Her call to action is for there to be greater commercial expertise in government to help shape policy, and reform in the civil service “We need to go faster, we need better policy-making, we need to get the right talent in. Fundamentally, the Civil Service doesn’t have a great corporate backbone. When you’re trying to deliver for the national security of the country, and the systems and processes don’t work, it’s hard-going. You have to deliver change over time. We have good talent, but people are doing the wrong sort of roles.”
When I ask her what she’s most proud of professionally, she tips her hat to the NCSC and the model that was later copied around the world. But ultimately, the badge of honour belongs to Number 10. “It was a privilege to serve in Number 10. When you put yourself in challenging circumstances, you learn a lot about yourself. I came out of that role a very different person. It changes your personality, and for me, it was probably for the better.”
She describes that period of her life as an ego boost. “Everyone wants to talk to you, your network is amazing, so I’m sure I had a bit of an ego in Number 10 at some points.” But she was cautious. “I always had it at the back of my mind that it was the role, not me. It was just the office I was occupying.” Ultimately, she contends, “you’re only as powerful as your proximity to the Prime Minister, so as soon as you leave, that’s it.”
I’m curious about the comedown from leaving a job loaded with such intensity, power and gravity. “Someone who once worked in Number 10 many years ago described it as a place where you see everything in full colour for the first time, and then when you leave, everything…” she trails off. Was it addictive, I ask, after allowing the silence to sit. “Highly. I knew that if I didn’t get out when I did, I’d probably still be there.”
This interview takes place during Ungoed-Thomas’ last week in the Cabinet Office. After over two decades in public service, the leap into the unknown is freeing but also leaves her feeling lost. “With everything going on in the Middle East at the moment, it’s hard leaving at this crisis point. But I had to step away; I knew it was time to do something different, and I had to do it for my family. Recently that decision has started to feel right.”
So what’s next? While the destination is somewhat unknown, the path is more determined. “Public service sits at the heart of everything for me; I want to give back and move the debate on. That’s why I am going to take a step into academia and continue promoting national resilience. I have accepted a senior fellowship with King’s College London to do some work on hybrid warfare, mainly Russia-focused. I’ve also accepted a senior fellowship with the Atlantic Council, a DC-based, non-partisan think tank, as part of their cyber resilience work.
“I’ve been in crisis mode after my four years in the Cabinet Office, two in Number 10, and many at the National Cybercrime Centre and GCHQ. After a long period, that becomes a lot”
“I didn’t want to go to a big corporate at this stage. I had offers, but I’m not interested. It may sound corny, but I’ll always have a national mission; I want to make the UK a safer place to live.
“I’ve spent 22 years doing the best and most exciting roles in government. The director of state threats, cyber and technology role I’m leaving is one of the most challenging but most rewarding roles in government. So it was a real privilege to have done that for four years.” Privilege, I note, is a recurring theme in this interview. Ungoed-Thomas doesn’t take anything for granted.
Stepping away from government is also an opportunity for her to reset her nervous system. “I’ve been in crisis mode after my four years in the Cabinet Office, two in Number 10, and many at the National Cybercrime Centre and GCHQ. After a long period, that becomes a lot.”
Any unfulfilled ambitions? I ask, my penultimate question. “I could say something about creating something or setting up a business, but I haven’t had the headspace to think about anything other than the bad things that could happen. My mind is overgeared on risk, and now it’s time to readjust.”
There’s so much to admire about Gemma Ungoed-Thomas. Her calm in the face of chaos. Her relentless commitment to the mission to make the UK a safer place to live. The impressive roles she has earned and owned. The service she has performed for our country. And when I ask one last question, I do so knowing exactly what the answer will be, and smile when she delivers it with barely a second’s hesitation.
“Would you ever go back to Number 10?”
“Don’t tell my partner, but yes, 100%.” And I’m sure that Number 10, and our country she serves, would be better off for it.
Weekly Cyber Briefing 03.07.2026
Oracle EBS customers targeted; ransomware surges in Europe; A massive Microsoft 365 password spraying campaign; OpenAI used for eavesdropping; FortiBleed is linked to two major ransomware groups
Weekly Cyber Briefing 26.06.2026
More warnings over frontier AI; another OAuth supply chain breach; maximum severity Ubiquiti flaws are exploited; and a phishing awareness exercise goes badly wrong
Weekly Cyber Briefing 19.06.2026
Ransomware actors hide in Teams; a massive Fortinet credential leak; Litespeed users are targeted; and warnings of nation state OT activity and AI data leakage.