Till a few years back, "hacktivism" meant a defaced homepage or a brief, annoying blackout of a government portal. Those days are behind us. In a sobering keynote at the CyberUK 2026 conference, Richard Horne, CEO of the UK’s National Cyber Security Centre (NCSC), delivered a unambiguous warning that felt less like a tech briefing and more like a wartime dispatch.

He told the gathering that the UK is now managing four nationally significant cyber incidents every week, and that profile of the threat attacker has shifted. We are no longer just fighting opportunistic digital shoplifters and petty scammers. Instead, we are facing the orchestrated precision of nation-states masquerading as grassroots activists.

In today’s blog we look at the various dimensions of the threat that state-backed hacktivism poses and explore ways to defend our critical infrastructure against this rising threat.

Before we move forward, don’t forget to check out our previous post on CVEs in OT infrastructure here.

A "perfect storm" of geopolitics and AI

Horne’s message was clear. The UK, and by extension, its allies is currently operating in the "space between peace and war." As geopolitical tensions simmer, particularly with Russia, Iran, and China, the digital front is where the first shots are being fired. We have all seen the manner in which threat actors are going after critical infrastructure and economically significant entities. Key takeaways from the speech:

• The scale shift: NCSC warns that if the UK were to enter a conflict situation, it should expect "hacktivist attacks at scale." This will be something way bigger than what we have seen so far.

• The ransom paradox: Unlike the ransomware hits on Jaguar Land Rover or Royal Mail, these state-aligned "hacktivists" aren't looking for a payday and some media attention. They are looking for paralysis and disruption at a nationals cale. Horne noted that in this new era, "paying your way out just isn’t an option."

• The AI accelerator: The emergence frontier AI models with extensive discovery pipelines capable of autonomously discovering thousands of software flaws, is lowering the barrier for entry significantly. Such models permit faster fuzzing, code analysis augmentation and exploit chain generation in one swing. It is allowing adversaries to map networks and find vulnerabilities at a speed human defenders simply can't match.

When seen together, these trends place added strain on defenders of infrastructure. We must respond proportionately to the scale of the threat, not with incremental, delayed controls. Four events a week is four too much. While he didn’t say whether these were attacks on OT or IT, the number itself is enough to warrant concern.  

This means that the attacks are targeted, persistent and dispersed. This raises a critical question: how would this scale under conflict conditions? Most nation states have cyber armies that are already running prepositioning campaigns. It just takes one attack for a nation to be distracted economically and strategically.

This speech has lessons for governments and infrastructure operators everywhere. By disclosing the number of attacks each week, Horne has not just quantified the problem but brought out the need to urgently ramp up measures across levels and countries to contain this challenge.  

Beyond British borders: A blueprint for cyber resilience

While Horne’s speech focused on the UK, the "Glasgow Warning" is a universal alarm. The tactics being refined in European theaters are being exported globally. Let’s now examine some of the key dimensions of the problem.

The OT vulnerability

This advisory is particularly acute for Operational Technology (OT) dealing with the hardware and software that controls power grids, water treatment, and manufacturing lines. Recent attacks by Iranian-linked groups on medical device makers like Stryker show that the target isn't just data. It is the physical world itself including critical services such as healthcare rendered to citizens. For any country with aging infrastructure or multiple single points of failure, the risk of "wiper" malware that is designed to permanently delete data and brick systems is a clear and present danger.

The remediation first approach

In the OT world, undiscovered threats can pivot from IT to OT through flat networks or enter via remote access pathways, vendor channels, or compromised engineering workstations. They may then tamper with the PLC logic or HMI, interfere with Safety Instrumented System (SIS) or manipulate setpoints to create a disruptive impact. More advanced actors may use Living off the land techniques to mask their presence for months. By misusing native engineering tools, they may do away with the need to deploy a payload or malware entirely making discovery difficult.

A mature enterprise that ensures proper segregation of OT and IT and applies specific security standards for both while maintaining visibility, control and enforcement of third-party controls will be better placed to deal with a nation state threat.  

Global organizations are moving toward what many call the "Remediation First" approach. This involves:

• Asset visibility: Comprehensive asset visibility across Levels 0–3, including unmanaged and legacy devices

• Mean Time to Disconnect: A new metric for resilience. How fast can you air-gap your critical systems from the internet when an attack begins?

• Zero Trust microsegmentation: Treating every device as a potential threat, especially legacy equipment that cannot be patched.

• Zone and conduit design as per IEC 62443

• Minimum OT security stack should cover:

  • Passive network monitoring (OT NDR)

  • Asset inventory (Level 0–3 visibility)

  • Secure remote access

  • Backup and recovery for engineering stations

  • Incident playbooks for plant shutdown scenarios

Shieldworkz has put together a set of OT security remediation guides that your security team can use to fix basic issues for free. The guides covering both standards and specific security issues can be downloaded from here. These guides are updated every month by our OT security remediation practice team. I am sure you will find them useful.

You can also head to the regulatory playbooks section to understand how you can implement regional and national security mandates here.    

The C-suite mandate

Cybersecurity is no longer a "IT problem" relegated to the basement; it is now a unignorable core corporate mission.

"Ensuring they understand the full extent of (the) risk they face, building defense in depth so that initial footholds by an attacker don't result in catastrophic impact." - Richard Horne, CEO of NCSC

The bottom line

The era of "implied trust" in digital networks is long gone. Whether you are a utility provider in the American Midwest, a manufacturer in Germany, or a government agency in London, the core playbook principles remain the same: Assume breach, automate defense, and prepare to operate without an internet connection. In 2026, resilience isn't just about stopping the hack. It is also about surviving the scale of it.