The most serious cyberattacks against the UK are now carried out by hostile nations including Russia, Iran and China, according to Richard Horne, head of the National Cyber Security Centre (NCSC). In a speech at the CyberUK conference in Glasgow, Horne warned that the UK is living through 'the most seismic geopolitical shift in modern history' and urged businesses to bolster their defences against potential attacks at scale during international conflict.
The NCSC currently handles around four 'nationally significant' cyber incidents per week, with criminal activity such as ransomware remaining the most common problem. However, Horne emphasised that the most severe threats stem from state-sponsored operations. Security minister Dan Jarvis revealed that the NCSC dealt with more than 200 such incidents last year, more than double the previous year.
Horne detailed the distinct threats from each nation, describing China's intelligence and military cyber operations as displaying an 'eye-watering level of sophistication'. Iran, he said, 'is almost certainly using cyber activity to support the repression of British individuals on our streets who are seen as a threat to the regime'. Meanwhile, Russia is applying tactics honed in Ukraine 'beyond the battlefield', targeting the UK and Europe with sustained hybrid activity.
Jarvis compared a cyberattack on Jaguar Land Rover, which dented UK economic growth last year, to masked criminals physically vandalising a dealership. He also highlighted that artificial intelligence is enabling adversaries to find system vulnerabilities 'faster than any human team can patch them', calling for collaboration between AI companies and the government to enhance cyber defences.
In a conflict scenario, Horne warned that the UK would likely face large-scale cyberattacks where, unlike ransomware incidents, organisations would not be able to pay to recover data. He stressed that every organisation must understand the full extent of the risks and improve their defences before it is too late. The warnings follow a series of attacks on critical infrastructure in Sweden, Poland, Denmark, and Norway linked to Russian groups.
