NCSC: state actors behind 75% of UK CNI attacks
NCSC CEO says hostile states like Russia, China and Iran are linked to roughly three-quarters of over 200 cyber incidents hitting UK critical infrastructure in the past year.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
NCSC CEO Dr Richard Horne used the RUSI Annual Security Lecture to disclose that the agency managed over 200 cyber incidents affecting UK critical national infrastructure (CNI) and its supporting ecosystem in the year to May 2026, with around 75% assessed as linked to state actors, naming Russia, China and Iran as key hostile states. The speech was strategic and policy-focused rather than technical, framing cyber security as an ongoing contest rather than a static risk, and calling on organisational leadership to strengthen resilience through three pillars: understanding threat exposure, building defences on security fundamentals, and ensuring operational continuity and rapid recovery after incidents.
Horne warned that unpatched vulnerabilities tolerated in peacetime will be exploited during future conflict, and stated that adversarial cyber activity against the UK is already ongoing rather than purely hypothetical. He also flagged that the NCSC assesses AI-enabled attack capabilities will likely be used by 2028 to exploit known vulnerabilities in legacy technology at scale across CNI, indicating an expected rise in automated, scaled exploitation of already-known flaws rather than novel attack techniques.
No specific incidents, malware, IOCs, or CVEs were disclosed in this speech; it serves as a strategic call to action for CNI operators to prioritise basic security hygiene, patch management, and incident recovery planning ahead of anticipated AI-accelerated threats. Defenders in CNI sectors should treat this as reinforcement to prioritise fundamentals (patching, asset visibility, resilience testing) given the stated intent of state actors and the anticipated scaling of automated exploitation.
Mentioned in this report
Source reporting: https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs