The UK's critical national infrastructure is under constant threat from state-sponsored cyber attacks, with over 200 incidents reported in the past year alone. This is a stark reminder of the ongoing contest between the UK and capable adversaries, particularly Russia, China, and Iran. The National Cyber Security Centre's (NCSC) chief executive, Richard Horne, has emphasized the need for organizations to focus on the fundamentals of cybersecurity, such as ensuring quick recovery from attacks. Horne's comments echo those of MI6's head, Blaise Metreweli, who warned that the UK is caught in a space between peace and war as tensions with Russia escalate. Horne also highlighted the potential for AI-enabled cyber attacks, with 2028 likely to be the year when such threats materialize. The emergence of Anthropic's Claude Mythos AI model has raised concerns about the heightened risk of AI-enabled cyber attacks. However, experts caution that most breaches still come from well-established risks such as weak authentication and already known vulnerabilities that have not been patched. Horne described the cyber threat as affecting a range of places, from boardrooms to IT help desks, to sofas at home. He emphasized the need for collective action and understanding of the urgency to prevail in this contest. The NCSC has recommended that consumers drop passwords and adopt passkeys, which should be the first choice of login across all digital services. This is because passwords are not secure enough to stand up to modern cyber threats. In my opinion, the UK's critical national infrastructure is at a critical juncture, and the need for robust cybersecurity measures has never been more urgent. The threat from state-sponsored cyber attacks is real and present, and the UK must take proactive steps to protect its key services. The emergence of AI-enabled cyber attacks is a particularly worrying development, and the UK must be prepared for the potential impact of these threats. The NCSC's recommendation to adopt passkeys is a step in the right direction, but more needs to be done to ensure the security of the UK's critical national infrastructure. The UK must continue to invest in cybersecurity measures and work closely with its allies to counter the threat from state-sponsored cyber attacks. In my view, the UK's critical national infrastructure is a key battleground in the ongoing contest with capable adversaries, and the need for robust cybersecurity measures has never been more urgent.
