MI5 is spending as much effort countering hostile states as it did at the height of the Cold War, director general Sir Ken McCallum told an annual threat briefing in London this month.
McCallum said state-linked threats had quadrupled over the past decade, with Russia "aggressor number one" and Iran responsible for a sharp rise in activity against Jewish communities and military sites.
Russia's proxy playbook
According to McCallum, Moscow has not risked conventional war with NATO but instead uses cyber attacks, sabotage and disinformation to unsettle allies supporting Ukraine. He said nearly 1,000 Russian intelligence officers had been expelled since the 2022 invasion, forcing the Kremlin to pay criminals for proxy operations.
Former national security adviser Lord Peter Ricketts told the BBC hybrid attacks were becoming "more reckless, more dangerous," warning that people could be killed if energy, transport or banking systems were hit.
AI supercharging the contest
McCallum said artificial intelligence was "supercharging the cyber-security contest between attackers and defenders," while extremists were experimenting with drones integrated with generative tools. He highlighted bioweapon knowledge as a particular misuse risk if terror groups automate research steps that once required specialist labs.
Right-wing terrorism remained on the agenda, with MI5 reporting plots that attempted to exploit AI for propaganda and targeting.
What businesses should assume
Security teams protecting defence contractors, universities and critical suppliers should treat state reconnaissance as ongoing rather than episodic. McCallum's emphasis on equal resourcing for terrorism and state threats is a budget signal for government partners and for regulated sectors asked to report incidents faster.
With budget week approaching, his speech also feeds a political argument for resilience spending beyond uniformed personnel — patching the soft targets Ricketts named in broadcasting interviews at the weekend.
Corporate security teams
McCallum urged companies not to treat espionage as a government-only problem, noting supply-chain compromises often begin with recruitment fraud or compromised personal devices. Firms bidding on defence subcontracts should expect more frequent protective security advice visits as MI5 reallocates analysts from Cold War-era casework to live cyber intrusions.
His Fairford comments referenced seven arrests after suspicious vehicles were reported near the Gloucestershire airbase; he told reporters afterwards that Iranian interest in UK military sites was not limited to that incident, without naming ongoing operations.