Richard Horne, the chief executive of the National Cyber Security Centre (NCSC), will formally identify Russia, Iran, and China as the primary sources of the most severe cyberattacks targeting the United Kingdom. In a scheduled address on Wednesday in Glasgow, Horne is set to characterize the current global environment as the most seismic geopolitical shift in modern history, emphasizing that state-sponsored activity has surpassed criminal enterprise in terms of strategic threat level.
The NCSC, which operates as the cyber defense arm of the Government Communications Headquarters (GCHQ), currently manages approximately four nationally significant cyber incidents every week. While ransomware and other forms of cybercrime remain the most frequent types of digital disruption, Horne will clarify that the most sophisticated and damaging operations are increasingly linked to hostile nation-states. These actors target critical national infrastructure, including energy grids, water systems, and government communications. The head of the NCSC will warn that British businesses must prepare to defend against attacks that could be launched at scale if the United Kingdom becomes involved in an international conflict.
The warning follows a series of similar alerts from European allies. Authorities in Sweden, Poland, Denmark, and Norway have recently documented cyber intrusions into power plants and dams, attributing the activity to groups associated with the Russian Federation. This collective regional vulnerability underscores a broader trend where digital warfare is used to exert political pressure or prepare for potential kinetic conflict. The NCSC assessment highlights that the threat is no longer confined to data theft but extends to the potential for physical disruption of essential services.
This assessment aligns with recent statements from other senior intelligence officials. In December, Blaise Metreweli, the head of the Secret Intelligence Service (MI6), described the current era as a period where the United Kingdom is operating in a space between peace and war. This environment, often referred to as the gray zone, is defined by persistent, low-level aggression that avoids direct military confrontation but seeks to degrade national resilience and economic stability.
Horne’s speech will emphasize that the scale and sophistication of tools deployed by Russia, Iran, and China require a coordinated response between the public and private sectors. The NCSC will call for a heightened state of readiness across the British economy to protect the integrity of the nation's digital and physical infrastructure. By naming these specific state actors, the UK government is signaling a more assertive posture in its attribution of cyber hostilities and its commitment to international security alliances.