Signal Hostile States Behind 75% of Cyber Attacks on UK Infrastructure - NCSC CEO

Summary

NCSC chief executive Richard Horne, speaking at RUSI's Annual Security Lecture, reported more than 200 significant cyber incidents against UK critical national infrastructure and its supporting ecosystem in the year to May 2026, with around 75% believed linked to state actors, naming Russia, China and Iran specifically. He warned that adversaries are prepositioning today, establishing footholds within technology underpinning critical infrastructure that could enable rapid exploitation during conflict, citing the Volt Typhoon campaign against US infrastructure attributed in 2024. Horne said the NCSC assesses that by 2028 AI-enabled cyber capabilities will likely be used to exploit known vulnerabilities in legacy technology at scale across critical infrastructure. He argued cyber security should be treated as an ongoing contest with capable adversaries rather than a risk to be managed, stating “there are no spectators, we are all on the pitch.” This builds on his earlier 2026 disclosure that the NCSC handles four nationally significant cyber incidents a week, most traced to hostile governments rather than criminal hackers.