The UK government has released its National Risk Register, highlighting key risks to the wellbeing of the country and our citizens. This is always an interesting document to read through to get a sense of the government’s assessment of the threats we face.
The National Risk Register used to be released biannually, but now appears to have become an annual event. Unlike MOD documents, which tend to drown in acronyms and terrible writing, it is a remarkably lucid piece of reporting that boils down to a matrix plotting likelihood of risk vs impact; Anyone who has ever done a risk assessment will be familiar with the concept. The NRR is based on the National Security Risk Assessment, which is classified at SECRET, and as such several risks are not plotted on the public-facing chart (more on that below).
What are the top risks to the UK?
The most likely risks to happen with the chosen timescale – 2 years for malicious risks, 5 years for non-malicious risk – include a terrorist attack in a public place (3), technological failure in the financial sector (30b), disaster response in one of the UK’s Overseas Territories (48), and an outbreak of the plant pest Xylella fastidiosa (59a).
Various forms of domestic terrorism remains a key high-likelihood threat throughout the NRR. Though less acute in the public consciousness than it might have been a few years ago, the UK’s Terrorist threat remains SEVERE, with both Islamic and right-wing terrorism in particular being key threats to the UK’s way of life.1 On a similar level, the assassination of a public figure (6) is also considered to have the highest possible likelihood within the next two years, which is exceptionally troubling but unfortunately not that surprising. The increasing toxicity of politics in the UK makes this more likely, and there are unfortunately many state and non-state actors who are willing to use violence to achieve their aims.2
Also considered relatively likely is another pandemic (56) and, notably, failure of water infrastructure (38), both of which are assessed as having catastrophic consequences. The latter has rocketed up the scale, being considered only a minor/low impact risk in the 2025 NRR, and is worth looking at in detail. In 2025 it was obviously assumed that not only was there a low likelihood of water failure happening, but any incident could be quickly resolved. By contrast in 2026 it is assessed that there would be limited ability to reroute water to the affected region from outside, and repairs would take ‘months’. I assume that somebody in the Cabinet Office has finally done an actual assessment of our water infrastructure, and realised how vulnerable it is, especially as we are experiencing mounting extreme heat in the UK due to climate change. With a national security hat on, I’d also note that water infrastructure would be an obvious and key target for state actors to attack if they wanted to create widespread disruption in the UK, though technically on the risk register attacks on broader infrastructure (10 and 11) are treated separately.
Another area of infrastructure damage that is often doesn’t get enough attention is that of data infrastructure (41), whether through malicious or non-malicious means. Talk of data centres is now commonplace in the news, and data infrastructure more broadly is of increasing importance for our day-to-day life and economy. Disrupting data services would have severe consequences for the country, and restoring operations properly can also take a long time. As a historian, I’ve been recently spending a lot of time in the British Library, which suffered a severe cyber attack in 2023. This massively disrupted the operations of the Library, severely impacting British research and businesses and costing millions – services are still in the process of being restored today.
A word also on Chemical, Biological, Radiological, and Nuclear (CBRN) threats, as a former CBRN specialist. One of the most catastrophic risks, but mercifully at quite low likelihood, is a major CBRN attack (7). However, low and medium-level CBRN attacks (8 and 9) are considerably more likely. CBRN attacks, though often not causing massive fatalities, are incredibly disruptive and take up huge resources in order to resolve. The Russian Novichok attack in Salisbury in 2018 is estimated to have cost the UK at least £150m as well as the death of a British national, Dawn Sturgess. CBRN has become an increasingly urgent priority in British national security discourse and has received some additional funding in the recent Defence Investment Plan.
So far, reasonable. However, the National Risk Register always contains oddities, most likely due to its public-facing nature. One of them, for instance, is the risk of ‘Disruption to Global Oil Trade Routes’ (12) which is put at a score of Moderate/1-5%. Considering the world is currently experiencing a global oil shock due to the war against Iran, and has had several similar energy shocks in recent years, this seems to be a peculiar assessment to make.
What is not Assessed
There are quite a few risks on the Register which are not assessed on the public-facing matrix, for political sensitivity. Most of these relate to acute state threats.
One of the new risks added to the Register this year is ‘Interference in the UK Democratic Process’, which is pointedly not scored. This is odd, considering that it is a well-known problem from a variety of sources, not least very rich tech barons. Is the UK government wimping out on properly calling out malicious interference in our democratic life? Quite possibly.
The threat of a conventional war involving the UK is also not scored, though smaller-scale conventional attacks on infrastructure are (10). Considering that the Prime Minister is on record as having said that an armed conflict with Russia could happen within this decade, you can imagine that the likelihood is probably quite high. While it is classic UK government practice not to publish such information, if they want to prepare the public, you’d think it would make sense to give the British people an accurate sense of the threat. Alas.
Conclusion
Despite its flaws, I’m glad that the UK government publishes the National Risk Register and updates it yearly. It is an excellent reminder of many risks that we would not often consider, especially non-malicious but still dangerous threats. Fundamentally, it is right that British citizens, businesses, and institutions receive an official baseline assessment from the government regarding the threats we face as a nation.
Cracking Defence is a reader-supported publication. If you enjoy my work, please like, share, subscribe, and if you are able, buy me a coffee to support my work. All and any support is hugely appreciated.
Northern Ireland-related terrorism is classified separately as SUBSTANTIAL.
A reminder that two MPs, Jo Cox and David Amess, have been murdered in the past 10 years.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.