gchq

AI-powered data fabric company Prevalent AI today announced raising $22 million in growth funding from Integrity Growth Partners (IGP). Founded in 2017 by former GCHQ and Darktrace leaders and headquartered in London, Prevalent AI has operated on a bootstrapped basis until now. The UK-based company has built a data fabric platform that turns fragmented enterprise data into a knowledge graph that security teams and AI agents can use to gain context, clarity, and control. Prevalent AI addresses the cybersecurity risks posed by fragmented data in enterprise environments amid accelerated AI adoption. The platform cleans, connects, and contextualizes enterprise security data, continuously identifies and remediates risks, and enables organizations to securely deploy and operate AI agents. It provides organizations with a comprehensive view of the data that exists across their environments, how it relates, and where operational gaps exist. Prevalent AI will use the fresh investment to accelerate US expansion, scale go-to-market efforts, extend the platform beyond cybersecurity, and deepen its leadership team. “Large enterprises do not have a shortage of tools or data. They have a shortage of context. Security teams are being asked to make decisions across thousands of systems, controls, identities, and data sources that were never designed to work together,” said Prevalent AI co-founder and CEO Paul Stokes. “For almost a decade, we have been using AI to continuously clean, connect, and contextualize enterprise data so organizations can see what exists, what is working, where the gaps are, and what needs attention. We started with security because that is where fragmented data does the most damage,” Stokes added. Related: Xpander Raises $7.5 Million for AI Management and Governance Related: Fortinet Acquires AI Security Company Virtue AI

Russia conducting daily attacks on UK 'from seabed to cyberspace,' spy chief warns BLETCHLEY PARK, England — The head of Britain's cyber and signals intelligence agency delivered a stark warning Wednesday that Russia is conducting daily hybrid attacks against the United Kingdom and Europe, stretching “from the seabed to cyberspace.” Anne Keast-Butler, director of GCHQ, called on businesses, government and allies to treat cybersecurity with ten times greater urgency, warning “we are at a moment of consequence where the actions we take and the partnerships we build are ever more critical.” She spoke at Bletchley Park, birthplace of both GCHQ and modern computing, where a wartime team — three quarters of them women — “changed the arc of technological innovation and altered the course of history” by cracking Nazi Germany's ciphers. Britain and its allies face a comparable moment today, she said, playing out in undersea cables, corporate networks and the algorithms shaping public opinion — all below the traditional thresholds of war. Russia is targeting “critical infrastructure, democratic processes, supply chains and public trust,” she said — prompting a range of countermeasures from the agency, including defending subsea cables and energy pipelines in British waters, disrupting Russian networks smuggling sanctioned technology and countering “reckless sabotage and assassination attempts.” Last month, Britain disclosed it had tracked and forced the retreat of a Russian submarine operation near critical seabed infrastructure, with the vessels “having failed to complete their operation in secrecy.” On shore, numerous amateur saboteurs and spies remotely operated by the Kremlin have been identified and arrested. Keast-Butler said the National Cyber Force — GCHQ's offensive cyber unit established in partnership with the military and other parts of the British intelligence community — is tackling state threats, terrorist networks and criminal actors including child sex offenders. “We deliver high-impact cyber operations every single day,” said Keast-Butler. Moment of consequence Her speech repeatedly stressed the urgency that society needed to adopt in response to the challenges it faced: “The risk of miscalculation is as high as I have ever seen it.” The lecture — planned to be the first of an annual address — was delivered at Bletchley Park to emphasize the urgency and innovation with which the country responded to the Nazi threat. Keast-Butler noted that Alastair Denniston, who founded what was then the Government Code and Cypher School, began recruiting for Bletchley Park before the war started. The machines built for the country house — the Bombe and the Colossus, widely regarded as the world's first programmable electronic digital computer — impacted not just on the war itself but laid the foundations for the entire computing age. That legacy of innovation, she argued, needed to be applied to threats of the present. Among the plans to meet that need is a new national cyber defense capability embedding agentic AI into systems able to detect and respond to attacks faster than human operators. Although only at a blueprint stage at the moment, the agency hopes that the capability — to be delivered by the National Cyber Security Centre — would provide a critical advantage to defenders as AI capabilities accelerate the pace of activity in the cybersecurity sector. Earlier this year, documents reviewed by Recorded Future News detailed a Chinese system to develop AI capabilities for offensive cyber attacks targeting the critical infrastructure of the country’s closest neighbors. “China is now a science and tech superpower with sophisticated intelligence, cyber and military capabilities,” said Keast-Butler, echoing the tone of the Dutch military intelligence services who last month publicly warned China had drawn level with the United States in its offensive cyber capabilities. “The AI revolution is now fully upon us, with ever-faster face of model releases, increasingly sophisticated agents, and greater system autonomy transforming the world with both promise and peril,” she added. “The ground beneath our feet is shifting, and shifting fast, which means cybersecurity has never been more important. That message may sound familiar… but I’m now saying it with utmost urgency. Cybersecurity is a critical priority for all businesses,” she warned. Keast-Butler invoked Denniston's 1941 decision to share British codebreaking secrets with American officials at Bletchley ten months before the attack on Pearl Harbor and the U.S. entry into the war. This was a “leap of trust” she credited with paving the way for the creation of the Five Eyes intelligence-sharing alliance, “our most critical partnership and the one most feared by our adversaries.” Quantum computing presents a longer-term but urgent reckoning, she added. Once operational, quantum machines will break the traditional encryption protecting government secrets, financial systems and military communications, including those relating to Britain's nuclear deterrent. Businesses were urged to begin transitioning to quantum-resistant systems now. “In this volatile world, there are steps we can all take to protect our communities and our loved ones,” she said, including switching passwords for passkey, but also “standing together to reinforce alliances and forge new partnerships.” “Whether that’s shoring up international resilience against China’s widespread cyber operations or working together to counter Russian aggression, it’s quite clear that the strength and depth of our own partnerships are our greatest asset.” Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

UK businesses have been urged to treat cyber security with far greater urgency as artificial intelligence (AI) rapidly reshapes the threats facing the country and its allies. Anne Keast-Butler, director of GCHQ, the UK’s top intelligence agency, issued the warning during the agency's first annual lecture at Bletchley Park on May 27. In a rare public speech, she said the UK and its allies face a narrowing window to stay ahead on technology, and that the risk of miscalculation is as high as she has seen in three decades in national security. The intervention follows a similar message last month from Richard Horne, head of the UK's National Cyber Security Centre (NCSC) who said that fast-moving AI developments and geopolitical tensions are causing "tumultuous uncertainty.” A Front-Line Role for Business Keast-Butler framed cybersecurity as a matter of national defense rather than an IT concern, telling businesses to act immediately rather than wait for guidance to mature. She argued that protecting systems now serves the "front-line defense of our nation, our economy and our way of life." The point was aimed squarely at boardrooms, with the Keast-Butler stressing that everyone from company directors to households has a part to play. Much of the danger, she said, stems from the speed of AI development. Vendors are releasing AI tools at a remarkable pace, and the resulting capabilities are being turned into weapons that operate just beneath the threshold of open warfare. Industry voices welcomed the framing. Patricia Titus, field CISO at Abnormal AI, said the move was the right one because the era of meeting automated attacks with human-paced defenses is over. "You cannot fight machine-speed attacks with human-speed defenses," Titus said. She added that resilience is now as much a leadership problem as a technical one, since AI-powered threats do not wait for the next budget cycle. Preparing for AI and Quantum To keep pace, GCHQ said it has drawn up plans for what officials describe as a world-first national cyber defense capability that builds agentic AI into machine-speed defense. According to briefing details, the system would use AI agents to detect and flag threats to critical national infrastructure, airlines and telecoms firms. It is expected to be operational within five years. The agency is also embedding frontier AI deeper into its own work to translate languages and surface intelligence faster. Not everyone was reassured by the timeline. Jon Abbott, CEO and co-founder of ThreatAware, said the five-year horizon was startling in an era when frontier models will find and exploit gaps at machine speed long before any shield is in place. The practical lesson for infrastructure operators and businesses, he argued, is to fix the basics rather than wait. "Your critical controls, EDR, web proxy and MFA, need zero gaps now, not in five years," Abbott said. Keast-Butler also pointed to quantum computing as the next disruption, warning that operational machines will eventually break the encryption that protects today's secrets. She repeated the NCSC's call for organizations to begin migrating to quantum-resistant cryptography within the timelines the it has set. She singled out Russia for scaling up daily hybrid activity against the UK and Europe, from undersea cables to cyberspace, alongside attempts to smuggle Western technology. China, she added, has become a technology superpower with advanced cyber and intelligence capabilities. For individuals, the director's advice was more immediate: switch from passwords to passkeys. For wider society, she said, the task is to hardwire security into new technology, protect supply chains and treat cyber resilience as a shared responsibility before any escalation arrives.

Inti De Ceukelaire is chief hacking officer at the Intigriti bug bounty platform, where he has been for the last seven years. But he has been a hacker for much longer. Hacking Inti De Ceukelaire, a Belgian national, did not set out to be a hacker. Like many hackers he was born with the potential to become one and only gradually realized he is one. There is a slight twist to his motivation. Many hackers say they are driven by an insatiable curiosity to understand how something works, and a deep desire to see if they can make it work better. De Ceukelaire’s starting point was slightly different: he couldn’t accept that this something wouldn’t do what he wanted it to do. Hacking was less to improve the ‘thing’ and more to bend it to his will. “I got a rush from feeling challenged. The computer would say ‘No’, and I would think, ‘Well, we’ll see’.” In his own words it was more a case of Rage Against the Machine than simply Stayin’ Alive. He only realized he was a hacker after finding a few bugs in Google when he was 15. He reported them to Google and got a polite response. Without knowing they were talking to a 15-years old kid, Google emailed him and fixed the bugs in around a week. “I was fifteen years old and talking to a Google engineer. It was the first time in my life I felt like an adult. And a hacker.” A year or so later he found a vulnerability in one of Metallica’s websites (“I was a big fan when I was younger and still had hair – lots of it.”) He reported the flaw and was again treated with courtesy – perhaps a bit more than courtesy. He was invited on stage with the band in front of thousands of fans, and they signed his keyboard. “I got myself on stage with Metallica. I was living my dreams.” In 2018, he found a weakness in the Vatican news website. He reported it – twice. The site did nothing, so he exploited it. Not in a harmful way, but one that would certainly be noticeable. He planted a news announcement stating, “Pope Francis is excited to announce the discovery of Heaven on Earth: Aaist [a town in Belgium] … Therefore, we shall now refer to The Lord as An Onion, named after the nickname of the inhabitants of this blessed city.” A key factor in all of this is that he caused no harm with his hacking skill. He never did anything for personal gain – except, he admits, for one time. It was while still at school. He had a project with an online deadline. He missed the deadline by three seconds; so, he hacked in and changed his submission time by three seconds. He reported himself to his teachers who were, to say the least, understanding. They allowed the hacked time to stand as the real time. And despite his ‘do no harm’ honor, he has a criminal record. “Ten years ago, I reported a very serious vulnerability to a large organization and asked them to thank me and fix it. They blamed the messenger, and it ended up in court.” Technically, he was guilty of hacking – how else could he find the flaw? Luckily, the judge accepted that the motive was pure; so, guilty but unpunished. This conflict of potential punishment for acts of benefit are part and parcel of the rise of ‘bug bounties’ as a distinct profession, and may well be instrumental in the path toward his current position as chief hacking officer at the Intigriti bug bounty platform. The hacker Most hackers today learned their trade by hacking the telephone system and talking to other hackers on online bulletin boards. That era is over. Today, there are books and manuals available. De Ceukelaire did neither. Learning from other people and studying books just makes clones of other people and the writers of books. “It doesn’t make you a hacker – it just teaches you how to parrot other people,” he says. He taught himself by first accepting the challenge and then trying to solve it. He had basic technical knowledge and a bit of programming from his school days. “I didn’t study computer science, and although it sounds contradictory, that helped me.” Trial and error was his method; failure was his teacher. “In doing so, I was attempting a lot of things that wouldn’t make much sense to a technical person, but I was still trying it. I was trying to learn from it. I tested assumptions that a normal-thinking engineer would never have made because they would have skipped all those steps I went through while failing. So, I know some technical stuff at a much deeper level than other people, simply because I failed more often.” He doesn’t criticize the more traditional path (“I know a lot of talented people that have just gone the regular routes”) but he thinks they may miss out on one thing. “Learning from books and just talking to other hackers can make you a little lazy. Forcing yourself to learn it on your own by failing more than the average person… I can recommend this to everybody, because that’s where you get the sparks of creativity.” One thing he does have in common with many other hackers is a reluctance to criticize the morality of any other hacker. There are reasons for this. For De Ceukelaire, one is a dislike of labels. “I would rather call myself a hacker than an ethical hacker. Being an ethical hacker is the default so I shouldn’t have to call myself ethical. It’s not like I go to a pharmacist and ask, ‘Are you an ethical pharmacist?’ I think hacking itself is not a crime. You can conduct crimes with hacking, just like you can conduct crimes with driving. But you don’t imply all drivers are criminals just because some cause accidents. That’s why I’ve always tried to avoid labels – in different parts of the world, hackers will be in different moral environments.” It’s an interesting concept, implying that ‘ethics’ is a construct controlled by local politicians and local lawmakers. What is ethical in one country may be malicious in another country – an elite hacker in the GRU is seen as malicious outside of Russia, but patriotic within Russia; and a military hacker in China is behaving ethically to his or her own country. Government hackers from the NSA or GCHQ or Israel or Iran would be considered unethical outside of their own geopolitical sphere. “In their minds, they are doing what they feel is the ethical thing, and there’s no point arguing that. Such people may never be welcome in our community, but that doesn’t mean that they aren’t great hackers. I can respect these people for their technical skills whenever a majestic attack happens. And I’m gonna give it to them, sometimes it is impressive. So, I can learn from them.” Ethical and malicious are variables – the only common denominator is ‘hacker’. But this only really applies to the geopolitical stage – every country still has local hackers targeting local organizations for personal gain. Has De Ceukelaire ever been tempted to use his skills ‘maliciously’ for personal gain? “No, never. It’s never crossed my mind because there’s a sense of honor that goes with these things.” Ethical would seem to be part of his DNA, but genes have a complex relationship with behavior. Nature (genetics from birth) can provide fundamental tendencies for behavior, but this can be affected by environment during life (nurture, provides a fine tuning of genetics). So, the question whether hackers are born or bred will never be satisfactorily answered – it’s probably a unique interaction between the two for every different hacker – making every hacker unique. For De Ceukelaire, it resulted in ‘face the challenge, solve the problem and never do harm’, but not necessarily never manipulate. He recalls a time when he would go to music festivals (remember the Metallica event) where the price of a beer could be extortionate, but you could get one free pint with an entry token. “So, I would go to the beer tent with my token, break it in half and ask for half a pint for half a token. They would take the half token but give me a full pint – leaving me able to get a second pint later with the other half.” Technically, this was social engineering – people hacking, rather than computer hacking. But it’s a good example of his definition of hacking: solving a problem to get what you want, creatively without causing harm. There is another way in which genetics may come into play for a hacker. It’s a bit iffy, but possible. Genes can affect how the brain works. Neurodiversity is a major effect of how the brain works, and statistically it is quite common among hackers. Is De Ceukelaire neurodiverse? “It’s never been diagnosed,” he said. Remember he doesn’t like labels, and he suspects that everyone is both a hacker and neurodiverse to one degree or another. But he does recognize one ‘symptom’. It doesn’t happen all the time, but when he is interested in the subject… “When I get in the zone, I really get in the zone; and time passes very quickly while I’m concentrating.” It’s the hyperfocus secret weapon of neurodivergent hackers. The bounty-hunting hacker Bounty-hunting became mainstream in 2012 with Bugcrowd and HackerOne. These were followed by, for example, YesWeHack (2015) and Intigriti (2016) in Europe. Used correctly, bounty platforms take away the uncertainty of non-malicious hacking. De Ceukelaire technically has a criminal record because the firm he hacked didn’t understand his motives. He doesn’t believe they were specifically trying to silence his message, he thinks they just followed the labels: to know this he must have hacked their system which means he’s a hacker and a criminal with bad intentions; so, they reported him to the authorities. In other cases, well-intentioned hackers who email companies to report bugs are simply ignored. That too, is understandable. If you believe your system is secure and you get an email from an unknown person saying it isn’t, it is easy to dismiss it as a scam email. And, of course, on occasion, ‘ethical’ hackers have had their life turned upside down by aggressive companies (see Rob Dyke and legal bullying). This is the attraction of bug bounty platforms: they can make computer hacking a legal and profitable occupation. Companies can pay less for better results than by employing their own full-time red team pentesters, and hackers can ply their trade in safety. Since rules exist on both sides, companies know that flaws can be discovered and fixed without fearing the hacker is malicious, while hackers have a place and purpose to hack without fear of prosecution, and get paid for their work. Before bug bounties it was easy for a hacker to choose a path of crime. “Why? Because there was no ethical path,” says De Ceukelaire. “I love hacking, I love every single minute of it. I love the chase. I love to see how the technical things come together. But 10 years ago, doing this you were almost always technically committing a crime, however moral your motivations. I would never wish to hurt an individual or a company – I was never an activist, I just wanted to hack. But there was no legal way to do this.” Bug bounties have changed things. “If you live in a western society, there’s now no reason for a hacker to take the criminal path. By doing the right thing, there’s no risk, there’s equal if not better pay, and there’s satisfaction in making things better and not worse. Personally, I work and hack with Intigriti because I want to change the world. I want to get the progressive laws that we have here in Belgium into every single part of the world, and I want that to be the default.” Related: Hacker Conversations: Rachel Tobac and the Art of Social Engineering Related: Hacker Conversations: John Kindervag, a Making not Breaking Hacker Related: Hacker Conversations: Frank Trezza – From Phreaker to Pentester Related: Hacker Conversations: David Kennedy – an Atypical Typical Hacker

The idea of a “Great British Firewall” makes for a catchy headline, but it would be riddled with holes and cause huge problems. The Guardian reports that the GCHQ (Government Communications Headquarters), a UK intelligence, security, and cyber agency, is exploring the idea of a British firewall offering protection against malicious hackers. It falls within its remit, but one of the measures reportedly discussed—banning VPN software—raises practical and technical questions. Here’s what you actually need to know, and why you shouldn’t panic about your VPN just yet. There are no current plans on the statute books to ban VPNs for everyone. Ministers and regulators explicitly acknowledge VPNs as lawful services with legitimate uses. The current political focus is on “online safety”, especially kids accessing porn and harmful content, and how VPNs can undermine the Online Safety Act’s age‑assurance and filtering regime. The latest move is an online‑safety consultation that explicitly mentions “options to age-restrict or limit children’s VPN use where it undermines safety protections”, not an outright nationwide ban. So what may happen is tighter controls around minors, and perhaps pressure on app stores and platforms, rather than a blanket prohibition for adults. Options Technically speaking, these are some of the measures available to address VPNs bypassing geo-blocking and local legislation. App‑store and download pressure: Require Apple/Google to hide or age‑gate VPN apps for UK accounts, or block listing of some consumer VPNs. This raises friction for non‑technical users but is trivial to route around (sideloading where possible, non‑UK stores, manual configs). Commercial provider lists: Buy accounts at popular VPNs, enumerate exit IP ranges, and require ISPs or certain sites (e.g. porn sites) to block those IPs. This can catch a large chunk of mainstream VPN traffic but is high‑maintenance and easy to evade with IP rotation, residential proxies, self‑hosted VPNs, and lesser‑known services. Targeted site‑level blocking of VPNs: Require certain categories of sites (e.g. adult sites) to reject traffic that appears to come from VPN IPs, an idea already floated by some experts as more likely than an outright technology ban. That still leaves VPNs usable for everything else, including general browsing and work. Age‑based device/network controls: Mandate school networks, child‑oriented devices, or parental control routers to block known VPN endpoints and app traffic, as media regulator Ofcom and others have suggested may be possible at the home‑router level. Again, this targets minors rather than adults and is only as strong as the weakest network they connect to (a friend’s Wi‑Fi, mobile hotspot, etc.). All of these are “making it harder” tactics rather than a hard technical kill switch. Why a watertight VPN ban is essentially impossible To comprehensively block VPNs, the government would need to require internet providers to inspect traffic, restrict apps from app stores, and attempt to cut off access to thousands of VPN servers worldwide. That would be a massive, expensive, and deeply complicated undertaking—and it still wouldn’t work. Problem 1: VPNs are basically invisible Modern VPNs are designed to look very similar to normal web browsing. When you load a website over HTTPS (the padlock in your browser) and when you connect to a VPN, the traffic flowing through your internet connection looks almost identical. Reliably telling them apart is a bit like trying to spot which cars on a motorway are taxis versus private vehicles based solely on their tire tread patterns at motorway speed, for every car, in real time. You’d end up accidentally blocking huge amounts of perfectly ordinary internet traffic in the attempt. Problem 2: Too many legitimate users depend on VPNs VPNs aren’t just for privacy-conscious consumers. They’re how millions of people securely connect to their workplace from home. The NHS (the UK’s National Health Service) uses them for remote access. Journalists use them to protect sources. Researchers use them to access academic resources. Any serious enforcement effort would have to grapple with the risk of collateral damage to businesses and public services. Problem 3: The ban would be trivially easy to bypass Even if the government successfully blocked every major commercial VPN app and service, technically skilled users could simply rent a cheap server anywhere in the world and set up their own private tunnel in under ten minutes. There are also tools designed to evade exactly this kind of blocking, disguising encrypted traffic as ordinary web activity. We know this because Russia has been trying to block VPNs for years, using the full weight of state enforcement behind it. But VPN usage in Russia has surged, not declined. Blocked services pop up under new names and addresses and new tools emerge overnight. This track record suggests that long-term, comprehensive suppression is difficult, even with aggressive powers of enforcement. What does this actually mean for UK citizens? The government can probably make consumer VPN use slightly more inconvenient, removing apps from UK app stores, for instance, or creating legal grey areas for certain uses. But a genuine, technical ban on VPN software and encrypted connections is not realistically achievable without causing serious collateral damage to the UK’s digital economy and the millions of people who depend on this technology for entirely legitimate reasons. Don’t ditch your VPN. The Great Firewall of Great Britain isn’t coming. And if it tried, it would have more holes than a fishing net. Hat tip to Stefan Dasic and the Malwarebytes VPN team for their invaluable input. Browse like no one’s watching. Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free →

After years of government cyber trouble, UK turns to automated scanning to speed fixes The British government said Thursday it has slashed the time required to fix some of the most serious cyber vulnerabilities across the public sector, pointing to a new automated monitoring service as evidence that Whitehall is finally getting a grip on long-troubled digital defenses. Called the Vulnerability Monitoring Service, the system operates as a central scanning platform that continuously checks internet-facing systems used by public bodies, from central government departments to health and local authorities, for signs of known security weaknesses. Officials from the Department for Science, Innovation and Technology (DSIT) said the service covers around 6,000 organizations and is leading to about 400 confirmed vulnerabilities being processed and resolved each month. They did not disclose how often these vulnerabilities were successfully exploited, nor whether there has been any change in the absolute number of vulnerabilities or compromises across the covered organizations. The announcement follows an unusually candid admission earlier this year that Whitehall’s long-running approach to securing its own systems had fallen short, and that a previous pledge to protect all government organizations against known cyber threats by 2030 was no longer realistic. DSIT said Thursday that critical domain-related weaknesses in the public sector are now being fixed in a median of eight days, down from around 50 days previously, while the median time to fix other cyber vulnerabilities has been reduced from 53 days to 32 days. It added that the backlog of unresolved critical flaws has also been cut by about three-quarters. Digital government minister Ian Murray said the faster fix times reduces the risk of attacks on essential services, including the NHS and other systems used daily by millions of people. “The Vulnerability Monitoring Service has transformed how quickly we can spot and fix weaknesses before they’re exploited,” he said. It comes as cyber threats have escalated far more quickly than the government’s own defenses. State-backed actors and organized criminal groups are increasingly sophisticated, while government capability has struggled to keep pace. Last year, the head of Britain's cyber and signals intelligence agency GCHQ, Anne Keast-Butler, warned the country was grappling with the most “contested and complex” threat environment in decades, noting there were four times as many critical attacks in 2025 than the year prior. The underlying problem for British government departments and agencies in trying to defend themselves is their reliance on legacy technology, acknowledged the government in January, citing a report by the National Audit Office that warned the dire state of government IT infrastructure was increasing the risk of disruptive cyberattacks. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

UK facing ‘most contested and complex’ threat in decades, warns GCHQ director LONDON — Britain’s security agencies are grappling with the most “contested and complex” threat environment in decades, one of the country’s most senior spies warned on Wednesday. Speaking at the cybersecurity conference Predict Europe, Anne Keast-Butler — the first woman to lead the cyber and signals intelligence agency GCHQ — said there had been a quadrupling of the most significant cyberattacks over the past year. (Predict Europe is organized by Recorded Future, The Record’s parent company.) “How that is manifesting itself in cyberspace is with a significant uptick in the level of attacks that we are looking at,” Keast-Butler told the audience. “So we saw over four times as many attacks to September as we saw in the year to the previous September — four significant incidents a week that our teams at the National Cyber Security Center are dealing with,” she said. “The threat landscape [is] one of the most contested and complex that I’ve seen in my national security career of 30 years.” Those attacks are coming “from all sorts of dimensions,” she added, describing “states cooperating with each other” as well as technological disruption being powered by advances in artificial intelligence, and the barrier to entry lowering for criminals engaging in financially-motivated cyberattacks. Ransomware remains the most acute threat, she said. A spate of incidents in Britain this year have affected the retail chains Marks & Spencer, the Co-op and the luxury store Harrods in London. The threat posed by Chinese espionage has also dominated recent news coverage in Britain, particularly following the collapse of a trial against two parliamentary workers suspected of selling information to Beijing’s spies. Keast-Butler stressed that the challenge posed by China is not new, although the context it takes place in has changed. “When I first stood up at Cyber UK a couple of years ago, I absolutely pointed to the cybersecurity threat that we see in the UK from the Chinese Communist Party, and in August — with us and other international partners again — we called out three Chinese companies for the role they were playing in getting into critical systems,” she said. “So I don't think it is new, and it's certainly a thing that we have in GCHQ made sure we're pivoting our resource to be able to combat that very capable cyber actor. I think the thing that has changed is our collective exposure to the internet, the importance that data and technology plays in all of our lives,” she said. Echoing the call to action by her colleagues at the National Cyber Security Center (NCSC), which is a part of GCHQ, Keast-Butler stressed that she aimed to use a series of high-profile cyber incidents in Britain to drive forward awareness about the threat and how the country could respond to it. “It also has changed the nature of the conversation in public, and for me, that feels like a really good opportunity to land a message about this being the time to act. Because I think previously, a lot of this conversation has happened among experts who already know it’s time to act,” she said. “We all know that there are far, far, far more attacks that get stopped than the ones we’re focusing on. The question is whether that good work is good enough for the pace of change.”. She confirmed that GCHQ, alongside the British government, had written to hundreds of chief executives at leading British companies to urge them to make sure cybersecurity was a board-level focus. “How much time and attention does [cybersecurity] get at board level? Who's on the board asking the right questions, how much influence do people have when it comes to difficult investment decisions?” she asked. Speaking just as an independent monitoring centre released estimates that a recent cyberattack against Jaguar Land Rover, which effectively shut down the company and its suppliers for more than a month, cost the British economy £1.9 billion ($2.5 billion), Keast-Butler stressed it was critical for companies to have adequate contingency plans in place. “However good all of us are, there will be attacks,” she said. “So what happens when that happens to your company? Have you really tested that, are your plans printed on paper somewhere in case all of your systems really go down? How will you communicate with each other if you’re completely reliant on the system that you shut down?” Turning to artificial intelligence, Keast-Butler said it was in the agency’s DNA — “going back to Alan Turing” — and GCHQ, as well as staff at MI6 and MI5, each had access to large language models to help them with their work. She described three priorities for using AI inside the agency — to boost productivity and free analysts up for higher-value work; to embed “secure by design” principles in new AI systems; and to understand how adversaries are exploiting the technology to enhance their attacks. “Automation is really key. Where do you absolutely have to have a human in the loop, and where can you take humans out of the loop?” she asked. GCHQ’s assessment is that those kinds of technological changes will overall provide a net benefit because “there are things that computers can spot, anomalies, that the human eye will miss.” But the changes AI will drive in cybersecurity won’t be smooth and linear, she said: “It'll be bumpy, and there'll be some uneven bits where the bad guys get the upper hand, because of what they can do with new tooling that our ethical approach will have prevented us. “But we will get there.” Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

The UK’s National Cyber Security Centre (NCSC) reported 204 “national significant” cyber incidents between September 2024 and August 2025, according to the agency’s latest Annual Review 2025, published on October 14. This is the highest-ever number and represents an 130% increase compared to the previous year, when UK organizations faced 89 incidents of such high impact. In total, the NCSC received 1727 incident tips in the latest reported period, with 429 of those elevated to cyber incidents which required the agency’s support. The 204 incidents characterized as “nationally significant” fell into one of the top three cyber-attack categories used by the NCSC and UK law enforcement. While no incidents of cyber “national emergency” (Category 1) were reported, the NCSC helped UK organizations with 18 “highly significant incidents” (Category 2) over the reported period – a rise from the 12 recorded in the previous period. These incidents were categorized as such because they had a serious impact on central government, UK essential services, a large proportion of the UK population or the UK economy. The NCSC Annual Review 2025 did not specify which cyber incidents fell into this category. However, an introduction to the report penned by Anne Keast-Butler, director of the NCSC’s parent agency, the Government Communications Headquarters (GCHQ), mentioned recent cyber-attacks on Marks & Spencer, the Co-op Group and Jaguar Land Rover as “high-profile attacks” that “serve as a stark reminder that the cyber threat is not just an abstract concept but a real one with real-world costs.” Cybersecurity: A Matter of Business Survival Richard Horne, the NCSC’s chief executive, delivered a speech at the Annual Review 2025 launch event on October 14 at NCSC headquarters in London. In the address to UK businesses, he warned: “The time to act is now. […] Cybersecurity is now a matter of business survival and national resilience. With over half the incidents handled by the NCSC deemed to be nationally significant, and a 50% rise in highly significant attacks on last year, our collective exposure to serious impacts is growing at an alarming pace.” Horne also emphasized that attackers are improving their ability to cause real impact and remain indiscriminate as to who they target. However, he explained that beyond the headline-grabbing cyber-attacks and rising number of high-impact cyber incidents, there are many more success stories. “Now it would be easy to look at these numbers, and think we’re under siege, that we should hold up our hands and admit defeat... but that is not the case. We know that far more cyber-attacks fail than succeed. That is not by chance. It’s because organisations have built good defences. We are also seeing more organizations able to continue in the face of an attack that does break through because they were prepared,” he will add. “The best way to defend against these attacks is for organizations to make themselves as hard a target as possible. That demands urgency from every business leader: hesitation is a vulnerability, and the future of their business depends on the action they take today,” he will conclude.

The NSA and GCHQ have jointly published a history of World War II SIGINT: “ Secret Messengers: Disseminating SIGINT in the Second World War .” This is the story of the British SLUs (Special Liaison Units) and the American SSOs (Special Security Officers).