NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems

Dr Richard Horne highlighted the scale of cyber threats against the UK’s critical infrastructure at RUSI’s Annual Security Lecture.
Our advice & guidance covers a broad range of topics
Resources for individuals and organisations in the UK who have experienced an online scam or cyber attack.
Find a range of products & services from NCSC and certified 3rd party suppliers
Working with industry, government and academia to support the next generation of researchers, students and cyber security professionals
All the latest information to help you keep track of what's happening
Dr Richard Horne highlighted the scale of cyber threats against the UK’s critical infrastructure at RUSI’s Annual Security Lecture.
sarayut Thaneerat via Getty Images
Three-quarters of cyber attacks impacting organisations within the UK’s critical infrastructure over the past year can be linked back to hostile state actors, the head of the National Cyber Security Centre (NCSC) has revealed.
In a major speech today, the CEO of the NCSC Dr Richard Horne said more than 200 cyber incidents affecting the UK’s critical national infrastructure and its supporting ecosystem were managed by the NCSC in the year to May 2026, with around 75% of those believed to be linked to state actors.
Speaking at the Royal United Services Institute’s (RUSI) Annual Security Lecture, Dr Horne, warned that hostile states, such as Russia, China and Iran, are increasingly targeting the systems that underpin the UK’s essential services, arguing that cyber security should not be treated simply as a risk to be managed, but as an ongoing contest with capable adversaries.
In his speech, Dr Horne said:
...this contest is not confined to a compact space. It is not like a wrestling match in a closely defined territory as some have suggested.
It is far more akin to a football or basketball game, played across a large field of play, where success depends on how you operate across the entire pitch.
He outlined the need for coordinated action across the “near, mid and far” cyber spaces, “the different parts of the environment where we come into contact with our adversaries, with different approaches in each.”
Dr Horne called on “every board member and every executive, in every organisation” to strengthen cyber resilience by focusing on three core capabilities: understanding their exposure to threats, building stronger defences based on proven security fundamentals, and ensuring they can continue operating and recover quickly after an attack.
In his lecture, he said:
We still see far too many significant incidents today that are possible because the fundamentals are not in place....
“The truth is that in this great contest there are no spectators, we are all on the pitch. From boardrooms to IT help desks, to sofas at home, the contest is everywhere.
“If we collectively embrace the contest, understand the urgency and believe we can be a match for any opponent, then we can and will prevail.
Speaking about the cyber threat in future conflict scenarios, Dr Horne emphasised the urgency of organisations acting now for their own protection, arguing:
…the many vulnerabilities that organisations tolerate today will be exploited in conflict tomorrow. If they are too expensive or hard to fix in peacetime, then they certainly will be in war…
“In cyberspace, we are not preparing for tomorrow’s conflicts, to some degree we are fighting them today.
NCSC CEO also warned that advances in artificial intelligence are likely to accelerate the threat, with the NCSC assessing that by 2028 AI-enabled cyber capabilities will likely be used by attackers to exploit known vulnerabilities in legacy technology at scale across critical national infrastructure.
The NCSC has published a range of resources and guidance to help organisations counter AI-powered attacks by acting now to improve their cyber security foundations. For more information, visit ncsc.gov.uk/frontier-ai.

Facts Only

* Three-quarters of cyber attacks impacting organizations within the UK’s critical infrastructure over the past year were linked to hostile state actors.
* The NCSC managed more than 200 cyber incidents affecting the UK’s critical national infrastructure and its supporting ecosystem in the year to May 2026.
* Around 75% of these incidents were believed to be linked to state actors.
* Dr Richard Horne spoke at the Royal United Services Institute’s (RUSI) Annual Security Lecture regarding cyber threats.
* Hostile states mentioned include Russia, China, and Iran.
* The NCSC assessed that by 2028, AI-enabled cyber capabilities will likely be used by attackers to exploit known vulnerabilities in legacy technology across critical national infrastructure at scale.
* Dr Horne called for organizations to strengthen cyber resilience by focusing on understanding exposure, building stronger defenses, and ensuring quick recovery after an attack.

Executive Summary

The National Cyber Security Centre (NCSC) CEO, Dr Richard Horne, highlighted the severe threat posed by hostile state actors to the UK's critical infrastructure during a lecture at RUSI. He revealed that over the past year, approximately three-quarters of cyber attacks impacting organizations within the UK’s critical infrastructure were linked to state actors. The NCSC managed more than 200 cyber incidents affecting national infrastructure and its ecosystem up to May 2026, with roughly 75% attributed to state actors. Dr Horne warned that hostile states, including Russia, China, and Iran, are increasingly targeting essential services, positioning cybersecurity as an ongoing contest rather than just risk management. He advocated for strengthening cyber resilience through three core capabilities: understanding exposure, building strong defenses, and ensuring rapid recovery. Furthermore, he emphasized the urgency of addressing vulnerabilities in peacetime, arguing that current lax security standards will be exploited in future conflicts. The NCSC also warned that advances in artificial intelligence will accelerate threats by 2028, potentially enabling attackers to exploit known vulnerabilities across critical national infrastructure at scale.

Full Take

The narrative presented relies heavily on leveraging fear and establishing a binary opposition between the UK and "hostile states," framing cybersecurity as an existential, zero-sum conflict rather than a complex systemic challenge. This framing serves to generate urgency by associating large-scale infrastructure failure directly with geopolitical adversaries. The transition from managing risk to viewing security as a "contest" played across a wide "pitch" is a rhetorical shift designed to mobilize collective action by emphasizing shared vulnerability ("we are all on the pitch"). The implicit assumption is that because state actors are involved, coordinated defensive action is the sole path to success. The incorporation of AI and legacy technology vulnerabilities acts as a future-proofing mechanism, positioning current inaction not merely as a failure of policy but as an unacceptable exposure in potential conflict scenarios. The concern about vulnerabilities being exploited "in peacetime" establishes a moral imperative for immediate change, making operational security feel like a matter of fundamental human protection rather than purely technical management. This pattern utilizes authority (the NCSC CEO) to create a sense of shared, immediate danger, pushing the audience toward the proposed solution of collective resilience based on perceived necessity and unavoidable conflict.

Sentinel — Human

Confidence

The analysis displays strong coherence and clear attribution typical of professionally reported news, with minimal stylistic anomalies that suggest machine generation.

Signals Detected

Natural variance in sentence structure and use of abstract metaphors (e.g., 'football or basketball game'), inconsistent with strict metronomic rhythm.

Text successfully balances high-level policy warning with specific, grounded quotes and statistics, demonstrating a focused authoritative voice.

The structure is typical of formal journalistic reporting (introduction, context, direct quote integration), relying on clear attribution rather than vague aggregation.

Human Indicators

The flow between the NCSC context, the quote, and the subsequent implications feels naturally contextualized rather than mechanically generated.

Use of specific temporal references (2026, 2028) integrated smoothly into policy discussion suggests source fidelity is maintained by a human fact-checker or journalist.