Richard Horne, who leads the NCSC, part of Britain’s GCHQ, is expected to warn in a speech at the CyberUK conference that the country is navigating “the most seismic geopolitical shift in modern history,” according to remarks released in advance.

Horne will say the agency is handling around four “nationally significant” cyber incidents each week. While criminal activity such as ransomware remains the most frequent threat, he will emphasize that the most severe risks originate from state-linked operations.

He is expected to caution that British businesses must prepare for large-scale cyberattacks in the event of a broader international conflict, noting that such incidents could disrupt operations in ways that cannot be mitigated through payments, unlike some ransomware attacks.

Western officials have increasingly linked cyber operations to wider geopolitical conflict following Russia’s full-scale invasion of Ukraine. According to data tracked by the Associated Press, more than 155 incidents including cyberattacks, sabotage and espionage have been attributed to Russia or its proxies since early 2022.

Authorities across Europe have reported similar threats. Governments in Sweden, Poland, Denmark and Norway have warned of cyberattacks targeting infrastructure such as power plants, dams and water systems, with several incidents attributed to actors linked to Russian intelligence services.

Horne will describe China’s cyber capabilities as highly sophisticated, while warning that Iran is likely using cyber tools to target individuals in the UK perceived as threats to its government.

He will also highlight what he calls “sustained Russian hybrid activity” extending beyond the battlefield into Europe.

The warning echoes remarks made in December by Blaise Metreweli, head of Britain’s Secret Intelligence Service, who said the global security environment is more contested than at any point in recent decades.