Cyber security for heritage sites and visitor attractions

Heritage sites and visitor attractions carry a particular kind of trust. Visitors expect the buildings, archives and systems behind a national treasure to be as well looked after as the treasure itself, and that now extends to the technology running quietly behind the scenes. A cyber incident at a well-known institution can disrupt day-to-day running and also affect a reputation the place has spent decades, sometimes centuries, building. 

Cyber security for heritage sites and visitor attractions is as much about protecting reputation and public trust as it is about protecting data. St. Paul's Cathedral, which welcomes thousands of visitors a year, moved from basic external testing to a continuous, accredited penetration testing programme.

This insight piece looks at why heritage sites face a distinct set of pressures, how St. Paul's approached it, and what good ongoing cyber security looks like for this sector.

Why heritage sites and attractions face a distinct set of pressures

Our leisure and tourism sector page highlights the balance the sector has to strike between delivering the interactive, digital experiences visitors now expect and keeping guest information and payment data properly protected. For heritage sites specifically, there's an added dimension.

Heritage sites often run a mix of public-facing systems and internal platforms, including cloud services, supporting everything from ticketing and archives to day-to-day operations. They tend to do this with a small internal team and a public profile that makes any incident more visible than most.

If your site is run as a charity or trust, the government's Cyber Security Breaches Survey 2025/2026 is a useful benchmark. It found that 28% of charities identified a cyber security breach or attack in the previous 12 months, and a quarter experienced phishing. Just 7% of charities had carried out penetration testing in the same period, compared with 13% of businesses, so regular testing is a clear way to get ahead.

Ticketing, memberships, donations and event bookings all involve personal data. Under UK GDPR, a reportable personal data breach needs to be reported to the ICO within 72 hours of you discovering it. Knowing your systems have been tested, and knowing who to call, makes that process far easier to manage.

How St. Paul's Cathedral strengthened its security posture

St. Paul's Cathedral is a London icon and national treasure. It's served as the cathedral church of the Diocese of London for over 1,400 years, welcomes thousands of visitors annually and supports around 200 staff who manage services, events, archives and daily operations. Having previously relied on basic external penetration testing, the cathedral's leadership wanted a more comprehensive, continuous approach as cyber threats evolved, along with actionable intelligence about current gaps and assurance of ongoing protection.

We delivered a continuous, accredited security testing programme covering quarterly external penetration testing of public-facing systems, annual internal testing to uncover internal attack paths, and Azure configuration reviews of the cathedral's middleware. Every finding came with prioritised, actionable remediation guidance and clear risk ratings, and follow-up validation testing confirmed each fix had worked.

We're so happy with our partnership with Wavenet, with them providing our pen testing. They really know their stuff and it makes us at St. Paul's feel more secure and future ready... Wavenet's expertise, clarity of reporting and ongoing support mean we can make informed decisions and continually strengthen our defences with confidence.

Garry Hunter, Head of Information Technology at St. Paul's Cathedral 

St. Paul's closed previously unknown gaps, gained continuous visibility of emerging threats, and now has documented CREST-accredited assurance that the cathedral's leadership can point to for governance and regulatory purposes. Find out more about our NCSC CHECK and CREST-approved penetration testing services.

Read the full St. Paul's Cathedral case study for more detail on the programme or watch the St. Paul's Cathedral customer testimonial.

What good ongoing cyber security looks like for heritage sites

A handful of things consistently separate a strong, sustainable security posture from a one-off tick-box exercise:

• Testing on a regular cycle, so new vulnerabilities are picked up between reviews.
• Coverage across public-facing systems, internal networks and cloud configuration, as well as the website.
• Clear, prioritised guidance that helps a small team focus on the fixes that matter most.
• Follow-up testing to confirm each issue is resolved.
• Independent, recognised accreditation that gives trustees, boards and regulators confidence.

If you'd like to see the kinds of issues testers find most often, our guide to common vulnerabilities found in penetration testing explains each one and how to fix it. For the basics, the NCSC's free cyber security advice for small organisations, which includes charities, is a good place to start. Cyber Essentials certification then shows you've got the core controls in place, and we're an IASME-accredited Certifying Body for the scheme.

One-off penetration testing vs a continuous testing programme

Understanding accredited testing

CHECK and CREST accreditation give heritage and visitor attraction leadership independent, recognised assurance that testing has been carried out to a consistent standard, rather than relying on a single provider's word for it. CHECK is the NCSC's scheme for approved companies carrying out authorised penetration tests on public sector and critical national infrastructure systems. CREST is an independent accreditation body for the cyber security industry.

Our guide on how CHECK penetration testing addresses your key challenges covers this in more detail if you'd like to understand what accreditation involves.

Getting started

If you're reviewing your own approach, these steps are a good place to begin:

• Take stock of every public-facing system, including ticketing, archives and any visitor-facing digital services.
• Check whether your current testing is a one-off exercise or a recurring programme.
• Make sure cloud platforms and middleware are in your testing scope, as well as your website.
• Look for evidence that findings are followed up and validated after they're reported.
• Agree who you'd call for incident response support if you ever need it.

Ready to talk about your cyber security?

Our cyber security services, including penetration testing, help heritage sites and visitor attractions protect both their systems and their reputation. Talk to us about where your current security testing stands, or see how we support the leisure and tourism sector.

Frequently asked questions