Allied Intelligence — 2026-04-25

NCSC Head Warns UK Faces Perfect Storm of State Cyber Threats at CYBERUK Conference

UK National Cyber Security Centre chief executive Richard Horne warned at the CYBERUK conference in Glasgow on April 24 that the United Kingdom faces a perfect storm of threats from China, Russia, and Iran, with the NCSC handling four nationally significant cyber incidents per week. Horne characterized China as a peer competitor, said Russia is taking cyber lessons learned in the Ukraine theater beyond the battlefield, and accused Iran of deploying cyber techniques to support the repression of British individuals on UK streets. Horne said the convergence of AI developments and geopolitical tensions was producing a period of tumultuous uncertainty.

Analysis
The four-nationally-significant-incidents-per-week metric and explicit naming of China, Russia, and Iran mark the sharpest NCSC threat characterization on record, positioning the agency for expanded statutory authority in the Strategic Defence Review follow-on. A concurrent joint advisory on China-linked covert networks, released alongside the Glasgow speech, moved the home-front framing from rhetoric to coordinated Five Eyes action. The Iran framing is the sharpest departure: casting cyber techniques as instruments of repression against British individuals on UK streets introduces a domestic-security dimension that may expand NCSC's mandate into countering transnational repression. A UK public attribution of a specific state-sponsored operation is very likely within the next six months, the ensemble revising upward on the UK's accelerating attribution cadence and the absence of any visible diplomatic brake on public naming. The speech may instead be calibrated to the CYBERUK audience and budget cycle, with the incidents metric serving advocacy rather than signaling a genuine shift in assessed threat level.

2 sources