Hostile states could strike Britain during major crisis as grey-zone threat ramps up, resilience chief warns

Lord Toby Harris, chairman of the National Preparedness Commission, told LBC that hostile actors could seek to exploit a moment when Britain’s emergency services and infrastructure were already under maximum strain, warning the country must prepare for several major events happening at the same time rather than assuming crises will arrive neatly one after another.

“If you're a malign external actor, you can see the country struggling with a climate emergency,” Lord Harris told LBC. “This is a really good moment to activate your cyberattack plan and disrupt the electricity supply or disrupt the communications system or the water supply.”

But cyber security specialists have told LBC that in some cases an adversary may not even need to launch a fresh attack when that moment arrives.

Sophisticated state-backed groups can spend months or even years mapping networks, stealing credentials and quietly establishing persistent access inside strategically important systems, potentially creating footholds which could later be used for espionage, disruption or sabotage if geopolitical tensions escalate.

Experts said the practice, often described as “pre-positioning”, means the most significant intrusion may not be the one which immediately turns off the lights. Instead, hostile states may seek to get inside a network, understand how it works and make sure they have a route back in if they ever decide they need it.

Sai Molige, Senior Manager of Threat Hunting at Forescout, told LBC: “Access can itself be the objective because it creates an option that could potentially be activated later for intelligence gathering, disruption or sabotage if geopolitical circumstances change.”

Attackers can initially carry out reconnaissance against internet-facing systems before exploiting an unpatched device or compromised credentials. Once inside, rather than immediately causing disruption, they can quietly identify privileged accounts, trusted suppliers, remote-access systems and connections between ordinary corporate IT and the operational technology responsible for running physical infrastructure.

Mr Molige stressed that gaining access to a corporate network does not automatically give an attacker the ability to manipulate physical systems, but said identifying engineering workstations, jump servers, remote access gateways and SCADA environments could move an adversary closer to that capability.

“An adversary does not have to switch off a power station today for a compromise to matter,” he said. “Knowing it has a potential route into strategically important infrastructure gives it intelligence and potentially leverage if geopolitical circumstances deteriorate.”

The warning comes amid growing concern over Britain’s ability to withstand a combination of hostile state activity, cyberattacks, extreme weather and disruption to critical national infrastructure.

The Government’s latest Resilience Action Plan implementation report acknowledges an increasingly “complex, novel and interconnected” risk environment, including sub-threshold hostile activity, cyberattacks and severe weather, and says Britain is pursuing an “all hazards” approach to national resilience.

But Lord Harris warned that while Britain’s preparedness had improved in recent years, the threats facing the country were developing so quickly that he was not convinced the UK’s resilience was keeping pace.

“I think the question of scale and pace would be what worries me,” he said. “Undoubtedly we have improved our preparedness and resilience posture as a nation, but the threats and hazards and everything else that's going on has increased.

“So you have a really very volatile and dangerous international situation, you have massive advances in what can be done in terms of cyberattacks, cyber threats, cybercrime, then you've got a worsening climate position.

“All of that is accelerating, and I'm not sure that whilst there has been very substantial improvement in the arrangements which exist at national and local level, whether that is keeping pace with the extent of what you're trying to deal with.”

Lord Harris said one of the weaknesses of traditional emergency planning was the tendency to consider individual risks in isolation, when a real national crisis could involve several systems failing at once or one emergency consuming so much national capacity that there was little left to respond to another.

He pointed to the pressure placed on fire and ambulance services during periods of extreme heat, saying emergency services had at times been operating close to the limits of their capacity.

“The fire service was seriously concerned at the height of the heatwave this summer that one more major incident would tip them over the edge in terms of their capacity to cope, because they were really at full throttle,” he said.

That vulnerability could itself create an opportunity for a hostile state.

A country already dealing with wildfires, flooding or another major emergency could simultaneously face a cyberattack against electricity, communications or water, forcing the same emergency services, government departments and infrastructure operators to respond to several cascading crises at once.

Lord Harris said emergency plans also often assume other organisations will be available to provide support, something which may not be true during a sufficiently serious national emergency.

“Many of the elements in the National Risk Register, when you look at what's listed as mitigation, they'll say, for example, the health service will do this,” he said. “Well, if the health service is under strain for other reasons, will it be able to do all of that?”

He added: “If you had international conflict, we had injured servicemen, we had drone attacks and so on, again, is our system able to cope with that plus any other emergencies that might occur?”

Cyber experts said the suggestion that hostile states may already have footholds inside Western critical infrastructure was entirely credible.

Taimur Ijlal, an information security leader, told LBC: “The NCSC warning about pre positioning reflects how sophisticated state actors operate. They map networks, understand dependencies and establish access long before they intend to cause disruption.

“What worries me most is long dwell access that gives an adversary options during a crisis.”

Dray Agha, senior manager of security operations at Huntress, said persistent access was itself a strategic objective for some hostile groups.

“Adversaries view establishing deep network access as a strategic requirement for future leverage,” he said. “Once inside a critical network, these groups install hidden backdoors that allow them to bypass standard security controls. This persistence means they can choose exactly when to activate disruptive capabilities during a period of geopolitical tension.”

Among the sectors regarded as particularly exposed are energy, water, telecommunications, transport, healthcare and defence supply chains, but experts warned that attackers do not necessarily need to target Britain’s biggest operators directly.

Smaller suppliers, contractors and technology providers can potentially provide an easier route into heavily protected organisations, particularly when they hold trusted access to several major infrastructure operators.

Legacy tech also presents a significant challenge. Much of the machinery running essential services was designed to operate reliably for years or decades, rather than to exist in a world of constant cyber threats, remote access and internet connectivity.

Mr Ijlal said: “Legacy operational technology is a major weakness. Energy, water, transport, telecoms and healthcare often rely on systems built for reliability and long service life, not continuous internet exposure. Smaller suppliers can also become the easier route into a larger operator.”

The consequences of a successful attack could spread far beyond the system initially targeted.

Lord Harris warned that while Britain’s electricity network was relatively resilient and had established procedures for restoring power after a widespread failure, a prolonged and extensive outage could quickly begin affecting communications, water supplies, sewage systems and payments.

“Communications would go down probably completely,” he said. “People like to think, well, as long as I can keep my mobile phone charged, I'm okay. The reality is no, that's not the case, because the cell masts themselves need power, and although they've got backup batteries, those would only last a very short time.”

Water could also become a problem because pumps are required both to move fresh water around buildings and to keep wastewater systems functioning.

“The financial system would not be able to operate, and it just goes on,” Lord Harris said. “All of the things that we just take for granted would fail.”

Cyber attacks have already shown how digital disruption can spill into the real world. The experts pointed to the Synnovis ransomware attack as an example of how compromising a supplier can cause major disruption to NHS services, including diagnostic work and appointments.

Operational technology potentially raises the stakes further because digital systems can ultimately control physical processes.

Mr Agha said attacks against utilities and transport had often affected corporate networks rather than the systems directly controlling machinery, but warned that the distinction between the two was becoming less clear.

“The boundary between these systems is shrinking, making the risk of physical service failure much higher than it was five years ago,” he said.

The methods and objectives of hostile states can vary. China has been strongly associated with long-term intelligence gathering and pre-positioning, including activity attributed to the state-sponsored Volt Typhoon group against American critical infrastructure. Russia has demonstrated how cyber operations can form part of broader hybrid campaigns involving espionage, disruption and political pressure, while Iran has combined intelligence collection with disruptive activity, including attacks involving industrial control systems. North Korea has also used cyber operations for espionage and intelligence gathering alongside revenue generation and sanctions evasion.

But the common danger is that an intrusion may remain deliberately quiet, and wait in the background.

Attackers can use stolen credentials, legitimate administration tools and existing network infrastructure rather than deploying easily detectable malware, allowing malicious activity to resemble normal network traffic.

That means the first obvious sign of an attack may come long after the initial compromise.

Lord Harris warned hostile activity against Britain should not be regarded as a purely future threat, arguing the UK was already facing action below the threshold of conventional warfare.

“First of all, we are already subject to them,” he said, pointing to incidents including the Salisbury poisonings, arson attacks and major cyber incidents as examples of the wider threat environment.

“This is already happening. You can only imagine it being ramped up.”

Mr Ijlal said Britain therefore had to understand cyber activity as part of a much wider struggle taking place below the threshold of conventional conflict.

“The UK therefore has to treat this as national resilience and grey zone conflict, not simply an IT security problem,” he said.

Mr Agha added: “The national perspective is shifting from viewing cyber as an isolated IT risk to recognising it as an ongoing strategic contest.

“Hostile states use digital tools to degrade our infrastructure without triggering a conventional military response. We must treat these intrusions as deliberate acts of statecraft rather than standard technical failures.”

Lord Harris said Britain therefore needed not only resilient infrastructure and effective government planning, but a population that understood normal services might not always return immediately.

“There tends to be a situation that ‘they’, unspecified who they are, will sort it out, and if it's taking more than about 15 minutes, people get really irate and worked up about it,” he said.

“We all need to be prepared for those circumstances when the things we just take for granted are no longer available. I think the government's been rather slow to get that message across.”

The Government said in July that it plans to launch new household preparedness advice backed by a multi-year public campaign, part of an effort to make emergency preparedness something shared by households, businesses, communities and public services rather than treating it solely as a responsibility of central government.

Lord Harris said Britain needed to move towards a “whole of society” approach in which preparedness became an ordinary part of life.

“It is a whole of society premise,” he said. “So it's every level of government, it's every organisation big and small, it's every community, it's every household, it's every individual just sees it as part of that, something they do.”

The objective, he stressed, was not to turn the British public into survivalists, but to ensure people could continue functioning for a period when the systems they normally relied upon were unavailable.

“We're not talking about necessarily six-month supplies in your basements and enough guns to deal with an invading army,” he said, “but being more prepared for a disruption so you're not completely thrown if you can't boil water or you can't do whatever else it might be.”

The most worrying possibility is therefore not simply that a hostile state could decide to attack Britain during a future national emergency.

It is that, when that moment comes, the groundwork may already have been done.