UK National Risk Assessment Highlights Cyber Threats to Critical Infrastructure, Water Systems
The UK's national security risk register has been updated to include cyberattacks against critical infrastructure, particularly water systems and data infrastructure, citing lessons from the CrowdStrike outage and the growing threat of hybrid warfare.
A classified assessment of the United Kingdom's national security risks has been updated to include a heightened concern for cyberattacks targeting critical infrastructure, with a specific focus on water systems and data infrastructure. The unclassified version of the National Security Risk Assessment, disclosed by Member of Parliament Darren Jones, now lists 95 risks in total, reflecting an evolving threat landscape.
The assessment highlights the increasing sophistication of cyber threats, particularly those amplified by the weaponization of artificial intelligence. "The increasing sophistication and proliferation of artificial intelligence not only brings huge opportunities, but threats too if it is weaponized by criminals against us," Jones stated in Parliament. This includes the potential for novel cyberattack methods targeting businesses and essential services.
New additions to the 2026 risk register include cyberattacks against water infrastructure and police systems, complementing existing concerns for the health and social care system, energy infrastructure, fuel supplies, transport, and telecommunications. The report also flags the "risk of interference in the U.K.'s democratic process," encompassing attacks on election infrastructure, the spread of disinformation, and foreign interference.
A significant new entry is "digital resilience failure," a direct response to lessons learned from the widespread CrowdStrike IT outage in July 2024. This addition underscores the government's recognition of the cascading impacts that failures in digital systems can have on national operations and public services.
For water infrastructure, the assessment warns of the growing exposure to cyberattacks, citing recent incidents in Poland's energy sector and Denmark's waterworks. The "reasonable worst-case scenario" envisions an advanced actor compromising operational technology (OT) systems, leading to a loss of visibility and control that could take months to rectify due to complex digital recovery challenges and the need for rigorous network isolation.
In response to these escalating threats, the UK government is planning "Operation Albiston Shadow" in 2027, which will be the largest home defense exercise in decades. This multi-day operation will involve government ministers and hundreds of officials to test revised crisis-response plans and preparedness for hybrid attacks, complementing NATO's CMX27 exercise.
The inclusion of these cyber risks in the national assessment signals a strategic shift in how the UK government perceives and prepares for modern warfare and national security challenges. The emphasis on OT security and digital resilience indicates a proactive approach to safeguarding essential services against increasingly sophisticated and potentially disruptive cyber threats.