Sir Ken McCallum, head of the UK's domestic intelligence service, has warned that MI5 is allocating more resources to counter state-sponsored threats than it did during the Cold War, reflecting a dramatic shift in the security landscape.
Speaking at MI5's headquarters in central London, McCallum identified Russia as the primary adversary and disclosed that the service now faces terrorism and state threats of roughly equal operational scale. He attributed this shift to a quadrupling of threats from hostile foreign powers, marking a significant escalation in the threat environment facing the UK.
Russia's hybrid warfare strategy
Russia remains the dominant concern for British intelligence, with McCallum describing Moscow's approach as "hybrid warfare" conducted with careful calculation to avoid triggering a collective NATO response. He characterised this as a line the Kremlin would be "foolish to cross", suggesting Moscow is acutely aware of the consequences of direct confrontation with the alliance.
The Russian state has refrained from conventional military conflict against NATO members, instead focusing on destabilising European countries while its full-scale invasion of Ukraine proceeds at minimal pace with horrific costs. McCallum noted that MI5's success in identifying and expelling Russian intelligence operatives has severely degraded Moscow's traditional espionage capabilities.
Nearly 1,000 Russian spies have been expelled from the UK since the invasion began, leaving the Kremlin dependent on criminal proxies to conduct attacks on British soil. McCallum observed that this dependency reveals Moscow's weakened position: "With its traditional covert footprint eviscerated by almost 1,000 expulsions since the invasion, the Kremlin's global toolkit is weak. So we see them scrambling to pay criminals to do their bidding." He concluded: "These are not the actions of a great power with the strategic upper hand."
What threats does Iran pose?
Iran has emerged as a secondary but growing threat, expanding hybrid operations within the UK. MI5 has made over 50 arrests in the past year linked to Iranian activities, with much of this aggression targeting Jewish communities and military installations. The National Security Act, legislation enacted in 2023 to prosecute those working against UK interests on behalf of foreign powers, has been deployed extensively against Iranian threats alongside those from China and Russia.
How is artificial intelligence changing the threat landscape?
Artificial intelligence represents an emerging and multifaceted security challenge. MI5 has already identified and arrested terrorists attempting to exploit AI to enhance reconnaissance and attack planning, with AI-enabled drones representing a new operational capability for hostile actors.
The most serious concern, according to McCallum, involves extremist groups using AI to develop bioweapons. While this threat has not yet materialised, he warned that the technology carries the potential to fundamentally alter the stakes surrounding existing and novel bioweapon development. He stated: "We've caught terrorists seeking to exploit AI to improve their reconnaissance and attack methodologies, with AI-enabled drones adding a new twist."
In a broader context, MI5, MI6 and GCHQ chiefs briefed the Cabinet in September about AI risks, including potential exploitation by hostile states, terrorist organisations and lone actors. The briefing was part of routine threat assessment rather than a response to an imminent danger.
McCallum emphasised that the UK Intelligence Community—comprising MI5, GCHQ and MI6—is collaborating closely with the UK's AI Security Institute to address these emerging risks. He noted: "These risks are real. The UK Intelligence Community - MI5, GCHQ, MI6 - is working closely with the UK's globally respected AI Security Institute to take them on."
Testing conducted by the Government Cyber Co-ordination Centre on advanced AI models has identified 407 security vulnerabilities across nine government organisations, underscoring the scale of the challenge.
What is driving the rise in terrorism threat?
In April, the UK's terrorism threat level was raised to severe for the first time in five years, indicating that an attack is highly likely. This elevation reflects threats from multiple quarters: Islamist organisations including Al Qaeda and the so-called Islamic State continue to direct and inspire attacks, while extreme right-wing terrorism has become an increasingly significant driver of the overall threat.
McCallum highlighted a marked trend over the past year: extremist versions of anti-immigration and anti-Muslim grievance are increasingly crossing into terrorist intent. Extreme right-wing terrorism disproportionately affects younger people, with radicalisation driven substantially by online platforms and digital networks.
MI5 has recently investigated a radicalised extreme right-wing 13-year-old in the UK, an investigation that yielded intelligence enabling an international partner to prevent a lethal attack on their territory. This case exemplifies both the youth of some perpetrators and the transnational nature of modern extremist threats. According to MI5's 2024 threat assessment, 13% of individuals under investigation for terrorism involvement were under 18 years old, representing a threefold increase over three years.
How has the state threat landscape evolved?
The scale of state-sponsored threats has grown substantially. According to MI5's 2024 update, the number of state-threat investigations rose 48% in the preceding year, demonstrating the accelerating pace of hostile state activity. This expansion reflects not only Russian operations but also intensified activity from other state actors including China and Iran.
The National Security Act has proven instrumental in addressing these threats, with McCallum noting it is "in heavy use" across multiple adversary nations. The legislation provides prosecutors with tools to pursue individuals and networks operating on behalf of foreign powers against UK interests.
Key Facts
- MI5 now allocates more resources to state threats than during the Cold War, with terrorism and state-threat operations at roughly equal scale
- Nearly 1,000 Russian intelligence operatives have been expelled from the UK since the invasion of Ukraine, forcing Moscow to rely on criminal proxies
- MI5 has made over 50 arrests in the past year related to Iranian activities, with much targeting Jewish communities and military sites
- Terrorists have been caught attempting to exploit AI for reconnaissance and attack planning, with AI-enabled drones representing a new capability
- The UK terrorism threat level was raised to severe in April, with extreme right-wing terrorism and Islamist groups both driving the elevated risk
