Hostile States Behind 75% of
UK Infrastructure Cyber Attacks.
The NCSC Warning
Speaking at the RUSI Annual Security Lecture on 17 June 2026, NCSC Chief Executive Dr Richard Horne revealed that his organisation managed more than 200 cyber incidents affecting UK critical national infrastructure in the past year alone. Around 75% of those incidents are believed to be linked to hostile state actors, with Russia, China, and Iran identified as the primary threats.
Dr Horne warned that cyber security should not be treated as a risk to be managed, but as an ongoing contest against capable adversaries, and that too many organisations are still failing to get the fundamentals right.
What the NCSC
reported
The NCSC managed over 200 cyber incidents affecting the UK’s critical national infrastructure and its supporting ecosystem in the twelve months to May 2026. That is more than one serious incident every two days.
Three quarters of those incidents are believed to be connected to hostile states. Russia, China, and Iran were named as the primary actors targeting the systems that underpin essential UK services.
The NCSC has assessed that by 2028, AI-enabled cyber capabilities will likely be used by attackers to exploit known vulnerabilities in legacy technology at scale across critical national infrastructure.
Despite years of guidance, the NCSC says too many significant incidents are still happening because basic security measures have not been implemented. The foundations are the problem, not the sophistication of the attacks.
Why this matters for
every business
Critical Infrastructure Is the Target
This is not just about government systems. Energy, transport, healthcare, water, and the supply chains around them are all in scope. If your business supports or connects to these sectors, you are part of the target surface.
A Contest, Not a Checklist
The NCSC is clear that treating cyber security as a compliance exercise misses the point entirely. The adversaries adapt, probe, and then wait. Security has to be a continuous effort, not an annual review.
AI Will Accelerate the Threat
The NCSC assessment is that within two years, AI-enabled tools will allow attackers to find and exploit weaknesses in legacy technology faster and at greater scale than anything seen before.
Legacy Technology Is the Weak Point
Old systems running outdated software are the entry points that state actors look for. If it has not been patched, updated, or replaced, it is a standing invitation.
No One Is a Spectator
The NCSC message is that everyone is involved - from boardrooms to IT helpdesks to people working from home. Cyber security is not something a single team handles on its own. The whole business is part of the defence.
Fundamentals Are the Answer
The consistent message from the NCSC is that most incidents succeed because the basics are not in place. Patching, access controls, multi-factor authentication, and tested backups still prevent the majority of successful attacks.
What your business
should do now
Patching schedules, access controls, multi-factor authentication, and backup testing. The NCSC has repeated for years that most successful attacks exploit the absence of these basics. If any of them are missing or inconsistent in your organisation, that is where to start.
The timeline is 2028. That is not far away. Start thinking about how AI might be used against your business. Legacy systems and known vulnerabilities are the first things AI-enabled tools will target at scale. If you are running old software, the window to act is narrowing.
Security is not something you complete. It is an ongoing effort that requires regular review, updated staff training, active monitoring, and a willingness to adapt. The adversaries are persistent, patient, and well-funded. Your approach has to match that.
The scale of the threat
200+ Incidents
The NCSC managed more than 200 cyber incidents affecting UK critical national infrastructure in a single year, averaging more than one serious incident every two days.
75% State-Linked
Three quarters of those incidents are believed to be the work of hostile nation states, not criminal gangs, not opportunists, but state-sponsored operations with strategic objectives.
2028 AI Timeline
The NCSC assesses that by 2028, AI-enabled cyber capabilities will be used to exploit known vulnerabilities in legacy technology at scale. That gives organisations less than two years to prepare.
3 Hostile States Named
Russia, China, and Iran were specifically identified as the primary hostile states targeting the UK’s critical infrastructure, each with different methods and strategic objectives.