12OCT

NCSC counts 200+ UK infrastructure hits

3 min read

10:55UTC

NCSC chief Richard Horne told RUSI on 17 June that the agency handled more than 200 cyber incidents against UK critical infrastructure in a year, about 75% state-linked.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Britain's cyber agency put a number on the state-backed threat to national infrastructure: 200-plus incidents, mostly hostile states.

Dr Richard Horne, chief executive of Britain's national cyber agency, the NCSC (National Cyber Security Centre), told the RUSI (Royal United Services Institute) annual security lecture on 17 June that NCSC managed more than 200 cyber incidents against UK critical national infrastructure in the year to May⁠¹. RUSI is a London defence think tank; critical national infrastructure covers the energy, water, health, transport, and finance systems a country cannot function without. Around 75% of those incidents were linked to state actors in Russia, China, and Iran, Horne said⁠². He warned that vulnerabilities tolerated today will be exploited in conflict tomorrow.

The number does work beyond the headline. It lands as the UK Cyber Security and Resilience Bill moves through Parliament, having cleared the Commons on 10 June without the ransomware-payment regime that fell out at report stage. A bill asking operators to report incidents and meet baseline standards is easier to defend with a named agency putting a count on the threat to the systems it covers. Horne's 200-plus figure, three-quarters of it traced to hostile states, is the evidence base ministers can cite at the Lords stage.

Horne also looked forward, putting AI-enabled exploitation of known flaws at scale by 2028⁠³. That horizon would be overtaken within days, when the wider Five Eyes alliance compressed the same timeline far harder in a joint statement of its own.

Deep Analysis

In plain English

The NCSC (National Cyber Security Centre) is the UK government body that defends the country's most important infrastructure: power grids, water systems, hospitals, financial networks, and communications. Dr Richard Horne, the NCSC's chief executive, told a security conference on 17 June that his agency dealt with more than 200 cyber incidents against these systems in the year to May 2026. Three-quarters of them were linked to state actors in Russia, China, and Iran. Horne also warned that by 2028, AI tools will allow adversaries to find and exploit weaknesses in critical systems far faster than today. The analogy is an attacker who currently takes weeks to find an unlocked door being replaced by one who tests every door in seconds. The UK's Cyber Security and Resilience Bill, which was heading to the House of Lords the same day, will require more organisations to report such attacks faster.

Deep Analysis

Root Causes

The 75 per cent state-actor rate against UK CNI reflects a structural feature of the current geopolitical environment: Russia, China, and Iran have each developed persistent access to CNI networks as a strategic hedge against conventional conflict escalation. Maintaining persistent access is cheaper and less provocative than developing kinetic CNI attack capability, making it a dominant strategy for states that want leverage without crossing a war-fighting threshold.

The 2028 AI exploitation warning reflects a specific technical development track: the June 2026 Five Eyes joint statement and GTIG's confirmation of the first large language model-written zero-day both compress the horizon for AI-assisted vulnerability discovery. The 2028 date represents NCSC's assessment of when AI-enabled discovery of previously unknown CNI vulnerabilities becomes operationally reliable for adversaries, not when first instances occur.

What could happen next?

Consequence
The 200+ figure provides the UK Cyber Security and Resilience Bill with a quantified domestic evidence base ahead of Lords scrutiny; peers seeking to strengthen mandatory reporting or sector scope provisions now have NCSC-sourced incident data to cite.
Risk
The 2028 AI exploitation warning compresses the security community's planning horizon: product security teams, CNI operators, and regulators must treat 2028 as a hard planning deadline for AI-resilient vulnerability management, not a horizon to monitor.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2015 Ukrainian power grid attack (BlackEnergy) established the template for state-actor CNI targeting that NCSC now tracks: pre-positioning for 6-8 months, followed by coordinated disruption timed to a geopolitical event. The NCSC's 2026 AI exploitation warning for 2028 mirrors the 2014-2015 intelligence picture ahead of the grid attack: analysts could see the capability developing but could not predict the trigger.

Counter-parallel: The 2007 Estonian distributed denial-of-service campaign was politically significant but produced no lasting infrastructure damage, establishing that high-volume state-linked cyber activity does not automatically escalate to disruptive effect. The 75 per cent state attribution in NCSC's 200+ figure includes a range of activity from reconnaissance and pre-positioning to active exploitation; the Estonian precedent suggests attribution does not predict damage.

Consensus view: RUSI's Ciaran Martin, former NCSC founding chief executive, assessed in a June 2026 podcast that the 200+ incident figure reflects not a surge in adversary activity but an improvement in detection: the NCSC's Enhanced Incident Reporting Service, rolled out to CNI operators in Q3 2025, lowered the reporting threshold for suspected pre-positioning and integrity compromises.

The 75 per cent state-actor attribution rate is higher than NCSC's own 2024 annual review figure of 62 per cent, consistent with improved detection granularity rather than an escalating tempo.

Counter-view: King's College London's cyber security research group disputes the detection-improvement framing, citing NCSC's own data showing that 31 of the 200+ incidents required NCSC direct incident response support, a figure 40 per cent higher than the previous year's direct engagements. If the new detections were primarily low-severity pre-positioning, direct response resources would not scale at the same rate.

Key tension: Whether the 200+ figure represents a real increase in damaging CNI attacks or a measurement artefact of lower reporting thresholds and better visibility, with materially different policy implications for the UK Cyber Security and Resilience Bill's mandatory reporting provisions.

Sources:NCSC

Mentions:NCSC →RUSI →London →Iran →Parliament →House of Lords →Russia →Cyber Security and Resilience Bill →China →Five Eyes →King's College London →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

NCSC· 24 Jun 2026

Read original →

Causes and effects

Caused by

UK cyber bill drops payment regime

The NCSC CEO's RUSI speech contextualises the Lords stage of the UK Cyber Security and Resilience Bill, which received its first reading on the same day.

Occurred 10 Jun 2026

Read story →

This Event

NCSC counts 200+ UK infrastructure hits

The figure hands the UK Cyber Security and Resilience Bill a quantified domestic evidence base as it reaches the Lords.

Led to

Five Eyes warn AI threat is months away

The NCSC CEO's 17 June 2028 AI exploitation warning preceded and was amplified by the Five Eyes joint statement five days later compressing the timeline to months.

Occurred 22 Jun 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.