MI5 Faces More State Threats Than During the Cold War

MI5 Director General Ken McCallum has warned that the agency is tackling more state-related threats than it did during the Cold War. The assessment reflects the growing scale, variety and complexity of risks facing the United Kingdom.

Modern threats extend beyond traditional espionage. They include cyber operations, foreign interference, sabotage, artificial intelligence, intimidation and activity by state-linked proxies. Terrorist organisations may also exploit commercially available technologies, including drones.

A broader security challenge

The Cold War involved a relatively clear strategic rivalry between Western governments and the Soviet Union. Today, the UK faces activity linked to foreign governments, intelligence services, criminal networks, proxy groups and extremist organisations.

Digital platforms allow hostile actors to influence large audiences, steal information, hide their identities and coordinate operations across borders. Artificial intelligence can increase the speed and scale of these activities, while drones and other accessible technologies create new risks for terrorist groups.

McCallum’s comparison does not mean that every present-day threat is more dangerous than the most serious Cold War confrontations. It describes the range and complexity of cases confronting MI5. National security risks no longer fit neatly into separate categories such as espionage, terrorism and military conflict.

A single operation may combine cyber intrusion, online manipulation, covert financing and pressure against individuals in the UK. Reporting has identified Russia and Iran in connection with intensifying hybrid threats involving artificial intelligence. Another report describes a warning that terrorists may seek to use AI-enabled drones Source 5; Source 9.

What did MI5’s intelligence chief warn about?

Ken McCallum leads MI5, the UK’s domestic security and counter-intelligence service. Reports summarising his remarks say the agency is handling more state-related threats than during the Cold War Source 1; Source 3.

The statement concerns the volume and range of investigations. Public reporting does not provide a complete operational count because intelligence work is classified. The comparison should therefore be understood as a senior assessment of workload and complexity, not as a precise statistical measurement.

State threats may involve political interference, cyber operations, disinformation, sabotage, economic pressure and intimidation of dissidents. A broader report also described McCallum warning about threats facing Britain, although the available summary provides few further details Source 7.

How today’s threats differ from the Cold War

More actors and harder attribution

MI5 may assess activity involving governments, intelligence services, proxy organisations, criminal networks, terrorist groups and individuals influenced through online channels. A government may use an intermediary, while a criminal group may provide technical support to a state service.

This makes responsibility difficult to establish. Online campaigns may combine genuine material with fabricated content, and evidence linking an operation to a government may remain classified.

Blurred boundaries between peace and conflict

Hybrid threats operate below the level of declared armed conflict. They may include cyberattacks, covert financing, influence campaigns, threats against dissidents, infrastructure damage and proxy recruitment.

These activities can occur during peacetime and may aim to create confusion rather than provoke an immediate confrontation. Governments must weigh the need for a response against uncertainty about the perpetrator, purpose and scale of harm.

Faster and wider digital operations

Cold War espionage often relied on physical meetings, paper documents and carefully managed human networks. Modern operations can reach millions of people quickly. Hostile actors can automate messages, translate content, conceal identities and coordinate activity across multiple countries.

The same tools can support state agencies, proxy groups and extremist organisations. Automation does not eliminate human planning, but it reduces the time and resources required for an operation.

Main state threats facing the UK

Espionage and intelligence collection

Foreign intelligence services may seek government plans, defence information, diplomatic positions, scientific research and commercial technology. Universities, research institutions and businesses can be attractive targets because they hold valuable information and collaborate internationally.

Recruitment, coercion, cyber intrusion and apparently legitimate relationships may all provide access. Intelligence activity can also target diaspora communities and dissidents through surveillance, harassment or pressure against relatives.

Traditional human espionage has not disappeared. It now operates alongside cyber tools, data analysis and online communications.

Foreign interference

Covert interference seeks to influence political decisions, public debate or social behaviour while concealing a foreign actor’s role. Objectives may include undermining trust in institutions, exploiting social divisions, intimidating critics or promoting favourable narratives.

Artificial intelligence can help produce persuasive text, images and audio, including material designed to impersonate public figures or amplify social tensions. However, the existence of such capabilities does not prove that a particular election or political event was targeted. Specific allegations require independent evidence.

Cyber operations

Foreign services may use cyber activity to obtain confidential information, disrupt services, impose economic costs or create psychological pressure. Potential targets include energy systems, transport networks, communications providers, financial institutions, healthcare organisations and defence contractors.

The available reporting describes cyber operations as part of a broader hybrid-threat picture involving Russia and Iran and the use of artificial intelligence Source 5. The reported publication date of October 13, 2026, should be verified before publication.

Sabotage and critical infrastructure

Undersea cables, energy networks, ports, transport systems, telecommunications and data centres have strategic importance. Damage may initially appear accidental, making attribution difficult.

Specific incidents should not be linked to a foreign government without reliable evidence. Resilience requires vulnerability assessments, contingency plans and information sharing with national security authorities.

Threats against dissidents and communities

Foreign governments may target people in Britain who criticise or oppose them. Methods can include surveillance, harassment, online intimidation, threats against relatives overseas and physical attacks.

These cases connect international repression with domestic security. Effective protection requires cooperation among intelligence agencies, police, community organisations and affected individuals, while distinguishing lawful political activity from coercion carried out for a foreign power.

Russia, Iran and hybrid threats

Russia is identified in reporting about intensified hybrid threats involving artificial intelligence Source 5. The broad category may include cyber operations, espionage, disinformation, proxy activity and pressure against opponents overseas.

Iran is also named in the supplied reporting. Threats associated with Iran may include intelligence operations, pressure against dissidents, cyber activity and the use of intermediaries. Allegations require evidence showing the nature of any connection to the Iranian state.

Attribution is especially difficult when actors use proxies, third-country infrastructure or blended methods. Governments must decide whether to pursue criminal action, impose sanctions, take defensive measures or make a public attribution. A premature response can misidentify the perpetrator, while delay can allow a campaign to continue.

Artificial intelligence and national security

AI can help hostile actors generate content, translate material, adapt messages, automate reconnaissance and identify vulnerable targets. It can increase the scale of influence operations and support impersonation, fraud and intimidation.

AI also offers defensive benefits. Security agencies can use it to analyse datasets, translate material, identify patterns and prioritise investigations. Its effect depends on access, safeguards and the speed with which defenders detect misuse.

A report on McCallum’s warning says terrorists may seek to use AI-enabled drones in attacks against Britain Source 9. This describes an emerging risk, not evidence that a specific attack has occurred.

AI-generated material can also support false narratives, recruitment and threats. People may remember a false claim even after it is disproved. Checking publication dates, comparing reputable sources and avoiding the rapid sharing of emotionally charged material can reduce manipulation.

Why the Cold War comparison matters

The core intelligence problems remain familiar. Foreign services still recruit sources, seek sensitive information, use deception and compete over advanced technology.

The current environment, however, offers more tools and channels, including social media, encrypted communications, commercial satellites, artificial intelligence, drones and global financial systems. Online activity can produce physical consequences, while state-backed actors can operate through apparently independent networks.

McCallum’s warning does not necessarily mean that Britain faces imminent military conflict. It does not mean that every foreign government is an adversary, that all threats are coordinated or that every incident has a state connection. Classified intelligence cases also prevent the comparison from serving as a complete public measure of MI5’s workload.

What the expanding workload means for the UK

State threats require coordination among MI5, police forces, cybersecurity agencies, border and immigration authorities, government departments, businesses and research institutions.

Businesses and universities need effective channels for reporting suspicious approaches, cyber incidents and attempts to access restricted research. Defensive priorities include staff awareness, access controls, cybersecurity monitoring, research-data protection and prompt reporting.

Security policy must also protect civil liberties. Oversight should include parliamentary scrutiny, legal review and appropriate judicial safeguards. Countermeasures must not treat lawful journalism, peaceful protest, academic research or ordinary international engagement as evidence of wrongdoing.

What the public should take from the warning

Most people are unlikely to encounter an intelligence operation directly, but practical awareness can reduce risk. People should verify unexpected requests for sensitive information, protect accounts and personal data, treat suspicious online material cautiously and report credible threats through appropriate official channels.

Readers should check multiple reputable sources, review publication dates, look for named evidence and avoid amplifying unverified claims. Statements about specific countries, technologies and operations should remain carefully attributed.

Conclusion

Ken McCallum’s warning reflects a security environment with more actors, technologies and methods than the Cold War era. Espionage remains important, but it now overlaps with cyber operations, foreign interference, sabotage, intimidation and disinformation.

Reporting has also raised concerns about Russia and Iran’s alleged use of artificial intelligence in hybrid activity and about the potential use of AI-enabled drones by terrorists. The UK’s security challenge is no longer defined by one principal adversary or a clear boundary between war and peace.

Effective responses require intelligence, institutional cooperation, resilient organisations, informed citizens and strong legal oversight.

Frequently asked questions

Is MI5 dealing with more threats than during the Cold War?

According to Director General Ken McCallum, MI5 is tackling more state-related threats than during the Cold War. The comparison concerns the scale and variety of cases; detailed operational figures are not publicly available.

What are state threats?

State threats are activities conducted or supported by foreign governments to harm, influence or gather information about the UK. They can include espionage, cyber operations, political interference, sabotage, intimidation and covert influence.

Which countries are linked to the hybrid-threat warning?

The supplied reporting identifies Russia and Iran in connection with hybrid threats involving artificial intelligence Source 5. Specific allegations require independent verification.

How could AI affect national security?

AI can help hostile actors produce convincing content, automate campaigns, identify targets and adapt messages. It may also support terrorist planning and drone use. Security agencies can use it for analysis, translation and pattern detection.

What did MI5 warn about AI-enabled drones?

Source 9 reports that MI5’s chief warned terrorists may seek to use AI-enabled drones in attacks against Britain Source 9. The warning describes an emerging risk and does not establish that a specific attack has occurred.

How can people protect themselves from hybrid threats?

Use strong cybersecurity practices, verify suspicious information, protect sensitive data and report credible threats through official channels. Media literacy can also reduce the spread of manipulated content.