The UK’s critical national infrastructure has suffered more than 200 cyber incidents in the past year, with state-linked actors responsible for about three-quarters of the attacks, according to the national cybersecurity agency.

The chief executive of the National Cyber Security Centre, Richard Horne, said hostile states including Russia, China and Iran are increasingly targeting systems that underpin essential services in the UK.

Critical national infrastructure includes sectors such as nuclear defence systems, power generation facilities, hospitals and airports.

Horne warned that the UK is engaged in an “ongoing contest with capable adversaries.”

Horne said, “This contest is not confined to a compact space. It is not like a wrestling match in a closely defined territory, as some have suggested,” he said in a speech at the Royal United Services Institute.

“It is far more akin to a football or basketball game, played across a large field of play, where success depends on how you operate across the entire pitch.”

The NCSC, which operates under the UK’s GCHQ intelligence agency, defines a cyber incident as any “attempt to damage, disrupt or gain unauthorised access to computer systems, networks or devices.”

He said the NCSC responded to more than 200 cyber incidents targeting the UK’s critical national infrastructure and its “supporting ecosystem” in the year to May, with around 75 per cent of the cases “believed to be linked to state actors.”

Horne warned that advances in artificial intelligence are likely to intensify the threat landscape by exposing vulnerabilities in national infrastructure, with 2028 expected to be a pivotal year when these risks fully crystallise.

He added that organisations must focus on the “fundamentals” of cybersecurity, including the ability to recover rapidly from attacks.

“The many vulnerabilities that organisations tolerate today will be exploited in conflict tomorrow. If they are too expensive or hard to fix in peacetime, then they certainly will be in war,” he said.

The emergence of Anthropic’s Claude Mythos AI model has heightened concerns that organisations could face increased risks of AI-enabled cyberattacks.

However, experts note that most breaches continue to stem from long-standing issues such as weak authentication practices and unpatched, known vulnerabilities.

Horne said the cyber threat extends across multiple environments, ranging from “boardrooms to IT help desks, to sofas at home.”