MI5 Reports Quadrupled State Threats from Iran and Russia in New Security Era

The rise in hybrid threats signals a shift in global security, necessitating heightened vigilance and preparedness across sectors.

• On October 13, 2026, MI5 Director General Ken McCallum announced a new era of national security in the UK, likening it to the post-9/11 landscape.
• State-based threats have quadrupled over the past decade, with MI5 allocating more resources to counter them than during the Cold War.
• Iran and Russia are identified as primary aggressors, with Iran targeting military sites and Russia employing hybrid tactics below NATO thresholds.

• Ongoing conflicts in Ukraine and the Middle East have intensified hybrid warfare tactics, including cyberattacks and sabotage.
• European governments are advising citizens to prepare for potential disruptions, reflecting broader geopolitical tensions.
• MI5's focus has shifted towards countering threats from state actors, with over 50 Iran-linked arrests reported in the past year.

The MI5 assessment delivered by Ken McCallum on October 13, 2026, underscores a significant evolution in the nature of threats facing the UK and its allies. The quadrupling of state-based threats over the past decade is not merely a statistic; it reflects a broader geopolitical shift where traditional espionage has given way to hybrid warfare tactics. This includes a mix of cyber operations, disinformation campaigns, and the use of proxies to achieve strategic objectives without direct confrontation.

Iran's focus has notably shifted from targeting dissidents and Jewish sites to military installations, indicating a more aggressive posture. The September 2026 incident at RAF Fairford, where Iranian proxies were suspected of involvement, exemplifies this trend. The subsequent withdrawal of US bombers from the base highlights the tangible impacts of these threats on military operations and international alliances.

Russia, labeled as "aggressor number one," continues to employ hybrid tactics that exploit vulnerabilities in NATO's response framework. With nearly 1,000 expulsions of Russian operatives in recent years, the Kremlin has adapted by relying on criminal proxies to conduct operations that remain below the threshold for direct military engagement. This strategy complicates the response for Western nations, as it blurs the lines between state and non-state actors.

The implications of these developments extend beyond immediate security concerns. Businesses operating internationally must reassess their risk profiles, particularly in regions where these hybrid threats are prevalent. The potential for cyberattacks, sabotage, and geopolitical instability necessitates a proactive approach to security and crisis management.

Moreover, the rise of artificial intelligence in warfare, including the potential misuse for bioweapons, adds another layer of complexity to the security landscape. As adversaries become more sophisticated in their tactics, the need for robust counter-intelligence operations and public preparedness becomes paramount.

• Government agencies: Increased pressure to enhance national security measures and intelligence operations.
• Military personnel: Heightened operational risks and changes in deployment strategies due to evolving threats.
• Businesses: Companies with international operations may face increased cybersecurity risks and disruptions in supply chains.
• Citizens: Public awareness and preparedness initiatives may lead to changes in daily life and travel advisories.

• Increased defense spending: Watch for announcements from European allies regarding budget allocations for defense in response to hybrid threats.
• Public preparedness campaigns: Monitor how governments communicate potential risks to citizens and the measures they recommend.
• Intelligence-sharing agreements: Look for developments in international cooperation on intelligence sharing to counter state threats.