UK Underestimates Threat Of Cyber-Attacks, Says NCSC Head

The new head of GCHQ’s National Cyber Security Centre (NCSC) has used his first speech to warn that the cyber risk to the UK is “widely underestimated.”

In his speech at the NCSC London headquarters for the launch of its Annual Review, NCSC’s Richard Horne, emphasised the need for sustained vigilance in an increasingly aggressive online world.

It comes after the NCSC and nine international allies in September gave details of cyber-attack campaigns by a unit of Russia’s military intelligence service (GRU) that targeted organisations to collect information for espionage purposes.

The NCSC’s headquarters in Victoria. Image credit: NCSC

Cyber threats

Richard Horne has been CEO of the NCSC since October 2024 and he used his first major speech to issue a rallying call for collective action against an increasingly complex array of threats.

“What has struck me more forcefully than anything else since taking the helm at the NCSC is the clearly widening gap between the exposure and threat we face, and the defences that are in place to protect us,” Horne said.

“And what is equally clear to me is that we all need to increase the pace we are working at to keep ahead of our adversaries,” said Horne.

“The NCSC, as the National Technical Authority, has been publishing advice, guidance and frameworks since our inception, in a bid to drive up the cyber security of the UK,” he said. “The reality is that advice, that guidance, those frameworks need to be put into practice much more across the board.”

“We need all organisations, public and private, to see cyber security as both an essential foundation for their operations and a driver for growth,” Horne urged. “To view cyber security not just as a ‘necessary evil’ or compliance function, but as a business investment, a catalyst for innovation and an integral part of achieving their purpose.”

Russia, China

Richard Horne then highlighted a combination of the UK’s growing dependency on technology and adversaries who are conspiring to use it against us.

“Hostile activity in UK cyberspace has increased in frequency, sophistication and intensity,” he said. “We see this in the intelligence we can access through being part of GCHQ.”

“Actors are increasingly using our technology dependence against us, seeking to cause maximum disruption and destruction,” Horne warned. “Last week, the Chancellor of the Duchy of Lancaster warned about the aggression and recklessness of cyber activity we see coming from Russia. And with our partners, including at the NPSA, we can see how cyber attacks are increasingly important to Russian actors, along with sabotage threats to physical security, which the director general of MI5 spoke about recently.”

“All the while, China remains a highly sophisticated cyber actor, with increasing ambition to project its influence beyond its borders,” he added. “And yet, despite all this, we believe the severity of the risk facing the UK is being widely underestimated.”

Horne also highlighted the real-world impact of cyber attacks, pointing out that there is no room for complacency about the severity of state-led threats or the volume of the threat posed by cyber criminals.

He noted that the defence and resilience of critical infrastructure, supply chains, the public sector and our wider economy must improve.

“In the past year, we have seen crippling attacks against institutions that have brought home the true price tag of cyber incidents,” said Horne. “The attack against Synnovis showed us how dependent we are on technology for accessing our health services. And the attack against the British Library reminded us that we’re reliant on technology for our access to knowledge.

“What these and other incidents show is how entwined technology is with our lives and that cyber attacks have human costs,” said Horne.

Annual review

It comes as the NCSC published its Annual Review, which noted a rising frequency of cyber incidents and a growing severity in their impact.

Over the past 12 months, the NCSC has observed how conflicts are fuelling a volatile threat landscape, including Russia’s deployment of destructive malware against Ukrainian targets, and routine attempts to interfere with the systems of NATO countries in support of its war effort.

China is described as a highly sophisticated and capable actor targeting a wide range of sectors. And Iran-based threat actors remain aggressive in cyberspace, and the Democratic People’s Republic of Korea (DPRK) continues to prioritise raising revenue to circumvent sanctions and collect intelligence in its cyber activity.

Meanwhile ransomware from criminal gangs is highlighted as the most pervasive cyber threat to UK organisations, highlighting the financially motivated ransomware attack on Synnovis, a supplier to the NHS, which had a significant impact on UK citizens.

AI threat

Elsewhere, cyber criminals’ use artificial intelligence (AI) to increase the volume and heighten the impact of cyber attacks.

In January 2024, the NCSC had published an assessment of the near-term impact of AI on the cyber threat, highlighting how it can be used for reconnaissance, social engineering and analysis of exfiltrated data.

The Annual Review also notes an observation from the NCSC that the application of AI to cyber defence will exceed the uplift in any adversary capability or application.

This year, the NCSC’s Incident Management team handled 430 incidents, compared to 371 the previous year. Of these, 347 involved some level of data exfiltration and 20 incidents involved ransomware.

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Microsoft Faces £1 Billion Lawsuit For Alleged Overcharging

Lawsuit filed in London against Microsoft alleges customers using rival cloud services, have to pay…

16 hours ago

Elon Musk $56 Billion Pay Deal Rejected, Again

Judge in Delaware for the second time rules against the record-breaking $56 billion pay package…

17 hours ago

China Bans Exports Of Gallium, Germanium, Antimony

Beijing bans exports to US of key materials after Biden administration imposes more restrictions on…

20 hours ago

US Announces New Export Controls On China’s Chip Sector

New round of US semiconductor export restrictions designed to hamper Beijing's capacity to produce high-end…

21 hours ago

Germany Shoulders €600 Million Of Northvolt Debt

Lender KfW is to be reimbursed by the German government more than €600 million ($629…

22 hours ago

Elon Musk Seeks To Block OpenAI’s For-Profit Bid

OpenAI's bid to convert to a 'for-profit' organisation is opposed by Elon Musk and co…

1 day ago