The agency’s total caseload has been flat across two reporting years while the tier it rates nationally significant more than tripled. Officials describe the capability that matters as patience — years of quiet access through known, unpatched flaws — rather than novel exploits.
The most consistent public count of serious cyber activity against the United Kingdom is the caseload of the National Cyber Security Centre’s incident management team, published each autumn for the year to 31 August. Over three reporting years the total barely moved — 371, then 430, then 429 cases.41 Over the same period the number rated nationally significant went from 62 to 89 to 204, and the number rated highly significant from 4 to 12 to 18.41
Then the climb appears to have stopped. Speaking at CYBERUK in Glasgow in April 2026, NCSC chief executive Richard Horne said the running rate of four nationally significant incidents a week “remain fairly steady”.2 So on the narrow question — is the frequency of serious incidents still rising? — the honest answer from the only official UK series is: not over the last several months, after a sharp step up the year before.
That flattening is the less interesting half of the picture. In the same April speech Horne said that while ransomware remains the most prevalent threat to most organisations, “the majority of the nationally significant incidents that my teams are handling now originate directly or indirectly from nation states”.2 In June he put a number on the critical-infrastructure subset: more than 200 incidents affecting UK critical national infrastructure and its supply chain in the year to May 2026, of which around 75% were believed to be the work of state actors, naming Russia, China and Iran.3
Two cautions about that figure. It is a share of a defined subset, not of all UK incidents, and the NCSC has not published a comparable earlier figure, so the shift is asserted rather than shown as a series. It is also stated as belief, not established fact — the language is “believed to be linked”, which is the standard register for attribution and should be read as such.3
The US intelligence community’s 2026 assessment describes the same four states and puts three purposes on their activity: to collect intelligence, to create options for future disruption, and for financial gain. It calls China and Russia the most persistent and active, and North Korea’s programme “sophisticated and agile”.8
The capability described in official advisories is not primarily exotic. The August 2025 multinational advisory on Chinese state-sponsored activity — the campaign tracked in industry as Salt Typhoon — found that the actors’ main route in was publicly disclosed vulnerabilities in network edge devices, with no exploitation of zero-day flaws observed. What made it consequential was where they sat and how long they stayed: backbone, provider-edge and customer-edge routers, with firmware and configurations modified to evade detection.6 The FBI put the reach at more than 600 organisations across 80 countries, with activity dating to at least 2019.7
The 2024 advisory on a separate Chinese group, Volt Typhoon, is starker on intent. US agencies assessed with high confidence that the actors were pre-positioning on IT networks to enable lateral movement into operational technology and disrupt functions — not collecting intelligence — and reported footholds in some victim environments for at least five years, sustained largely by using tools already present on the systems.5
One reading of that exhibit: the Russian supply-chain operation against SolarWinds, technically the most inventive of the three, was exposed in about fifteen months, while the two Chinese campaigns built around quiet persistence in unmonitored infrastructure ran for five and roughly six-and-a-half years.11 That is interpretation, not measurement — three cases cannot establish a pattern — but it is consistent with what the advisories describe and with Horne’s characterisation of Chinese operations as showing “an eye-watering level of sophistication” backed by a whole-of-state apparatus, making China “a peer competitor in cyberspace” rather than merely a capable threat.2
Two further capabilities are documented rather than inferred. Concentration: three known vulnerabilities accounted for 29 of the NCSC’s cases in 2024–25, meaning a small number of actors exploiting a small number of flaws at scale.1 And automation: the US assessment records that in August 2025 cyber actors used an AI tool to run a data-extortion operation against government, health, emergency services and religious targets.8
Most state cyber activity has no measurable output. North Korea’s is the exception, because the proceeds sit on public blockchains. Blockchain analytics firm Chainalysis puts theft attributed to North Korea-linked actors at roughly $0.66bn in 2023 across 20 incidents, $1.34bn in 2024 across 47, and at least $2.02bn in 2025 — about $680m more than the previous year, from fewer confirmed incidents.910 The US intelligence community independently put 2025 thefts at “probably” $2 billion and tied the money to the regime’s strategic weapons programmes.8
The shape matters more than the total. Chainalysis reports that in 2025 North Korea-linked actors accounted for 76% of all service-level compromises in the sector and about 59% of the $3.4bn stolen globally, while the number of attacks fell.10 Fewer, larger, better-prepared operations is the same pattern the UK severity data shows: not more activity, more consequence per unit of activity.
Whether the plateau is real. The four-a-week rate rests on two statements by one official seven months apart, not on a published series. The next NCSC Annual Review, due around October 2026, is the first chance to test it, and a plateau observed over months after a 130% jump is not a trend.
What the earlier state share was. The 75% critical-infrastructure figure has no published predecessor, so we cannot say by how much the state share has risen — only that the NCSC now describes it as a majority where it previously led on ransomware.
How much is never counted. Every figure here is a count of what was detected, reported and, in the DPRK case, traced on-chain. Operations still resident in networks are absent from all of them by definition, and the exposure gaps in Exhibit 02 are measurable only for campaigns that ended.
Whether definitions held constant. The NCSC’s severity categories are documented but the triage that assigns cases to them is not published, so part of the rise from 89 to 204 could reflect changed assessment practice rather than changed events. Nothing in the public record settles this either way.
The measurements above are not seriously contested. The attribution of them is, and it is an empirical dispute — evidence could in principle settle it, but most of the evidence is not public.
The August 2025 advisory was co-signed by agencies from thirteen countries, drew on real-world incident response across multiple jurisdictions through July 2025, and named three specific Chinese companies as providers of resources and intelligence — a level of specificity and multinational corroboration that is hard to reconcile with error.67
China’s foreign ministry rejects the findings, saying it opposes hacking in law and firmly opposes “spreading disinformation out of political agenda”.13 Independently of Beijing’s position, academic trackers note that formal attribution remains rare and uncoordinated: EuRepoC recorded 179 operations against EU entities in 2025 and not one joint EU attribution.14