Allied Intelligence — 2026-06-18

NCSC Chief Discloses Hostile States Behind Three-Quarters of 200 Plus Cyberattacks on UK Critical Infrastructure in Past Year

BLUFNCSC's reframing of pre-positioned footholds as kinetic targeting preparation, combined with a 2028 AI-exploitation timeline, compresses the remediation window for UK legacy infrastructure to near zero.

NCSC CEO Dr. Richard Horne disclosed at RUSI's Annual Security Lecture on June 17 that the agency managed more than 200 cyber incidents affecting UK critical national infrastructure in the year to May 2026 123. Approximately 75% of those incidents were linked to hostile state actors including Russia, China, and Iran, Horne said 123. Horne cited the Chinese state-linked Volt Typhoon campaign as the leading known example of adversary pre-positioning within infrastructure systems, warning that intelligence gathered today will underpin kinetic targeting in future conflict 4. The NCSC assessed that AI-enabled cyber capabilities will likely be used to exploit known vulnerabilities in legacy infrastructure at scale by 2028 124.

Analysis
Horne's disclosure that pre-positioned footholds are calibrated for kinetic targeting reframes the 200-plus incidents as pre-conflict preparation, not espionage. Naming Volt Typhoon as the leading example signals NCSC assesses Chinese activity as the sharpest near-term threat within the Russia-China-Iran cluster. The 2028 AI-enabled exploitation window is an institutional assessment. Legacy infrastructure has no structural closure pathway before that date, and UK CNI operators have received a formal government signal that unpatched systems are active targeting surfaces in a pre-conflict battlespace, not future risk items. The 75% state-attribution figure may instead reflect improved NCSC detection methodology rather than a genuine escalation in hostile-state operational tempo.

4 sources

NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems - National Cyber Security Centre
Hostile States Behind 75% of Cyber Attacks on UK Infrastructure - NCSC CEO - Royal United Services Institute
Hostile states behind three-quarters of attacks on Britains critical infrastructure, cyber chief warns - The Record
Hostile States Behind 75% of Cyber-Attacks on UK CNI, NCSC Warns - Infosecurity Magazine