Signal Hostile States Behind 75% of Cyber Attacks on UK Infrastructure - NCSC CEO

Summary

Richard Horne, chief executive of the UK's National Cyber Security Centre, said at RUSI's Annual Security Lecture that more than 200 significant cyber incidents targeted UK critical national infrastructure and its supporting ecosystem over the year to May 2026. He said around 75 percent of these are believed to be linked to state actors, naming Russia, China and Iran specifically. He warned that hostile actors are prepositioning today, planting footholds within technology underpinning critical infrastructure that could be rapidly exploited during a conflict, pointing to the Volt Typhoon campaign attributed against US infrastructure in 2024 as an example. Horne said the NCSC assesses that by 2028 AI-enabled cyber capabilities will likely be used to exploit known vulnerabilities in legacy technology at scale across critical infrastructure. He argued that cyber security should be treated as an ongoing contest with capable adversaries rather than a risk to be managed, saying there are no spectators and everyone is on the pitch. This builds on his earlier disclosure that the NCSC handles four nationally significant cyber incidents a week, most of them traced to hostile governments rather than criminal hackers.