Summary

CIA Director John Ratcliffe conducted an unannounced visit to Moscow on 25 August 2026, arriving aboard a US Air Force C-17 Globemaster III staged out of Riga and landing at Vnukovo International Airport. The aircraft remained on the ground for over eight hours while a motorcade transited southwest Moscow, before returning to Latvia the same day. The Kremlin’s messaging was inconsistent initially denying scheduled talks, then confirming contacts occurred “within the scope of direct contacts between intelligence agencies,” while explicitly ruling out a meeting with President Putin. The White House characterised the visit as “semi-routine,” a framing that is assessed as unlikely to reflect the operational sensitivity of the trip.

• Ukraine was reportedly requested to suspend long-range drone strikes on Moscow for the duration of the visit, with strikes resuming almost immediately after the delegation’s departure behaviour inconsistent with a routine engagement.

• This is the first visit by a sitting CIA director to Moscow since William Burns’s November 2021 trip to deter the invasion of Ukraine, and the first such visit under the current administration, marking a notable departure from the stalled envoy-level track (Witkoff, Kushner).

• The visit followed, by one day, a US Treasury announcement of new sanctions targeting entities assisting Iran.

Share

Assessment

The primary objective of the visit is highly likely to have been deterrence signalling, specifically cautioning Moscow against further escalation targeting NATO’s eastern flank particularly the Baltic states amid Russia’s rising risk tolerance for hybrid and cyber activity against critical infrastructure. A secondary objective, realistically linked to the first, is likely to have involved pressure on Moscow to curtail military-technical and economic support to Iran, consistent with the sanctions timing and prior reporting on Russian assistance to Iranian proxies.

The choice of an intelligence-to-intelligence channel over public diplomacy almost certainly reflects a deliberate signalling strategy: it allows explicit redlines to be delivered with minimal public commitment and reduced risk to negotiating leverage, while the existing envoy track remains deadlocked. It is a realistic possibility that political prisoner negotiations formed a secondary or confidence building component, given Ratcliffe’s prior involvement in comparable releases, though this cannot be corroborated with the available reporting.

Indicators to monitor: any shift in Kremlin public narrative on Ukraine, NATO, or Iran in the coming days; announcement of resumed US envoy travel to Moscow, which would be a positive indicator of backchannel success; and, conversely, continuation or acceleration of Russian hybrid activity against NATO states, which would suggest the deterrent message was rejected and would likely precede further US sanctions or interdiction action against Russia and Iran-linked shadow fleet assets.

Sources

“CIA chief used Moscow visit to warn Russia against attacks on NATO allies, helping Iran” - Politico

“What we should make of CIA boss’s secret trip to Moscow” - BBC

Summary

On 24 August 2026, the US Maritime Administration (MARAD) and CORE POWER (US) Inc. signed a non-exclusive memorandum of cooperation to advance the commercial, industrial and regulatory pathway for future US-flagged nuclear-powered merchant ships.

The framework will bring together government, industry and other stakeholders to consider reactor regulatory acceptance, port operations, workforce credentialing, fuel and through-life services, insurance, finance, industrial capacity and potential federal demand. CORE POWER is targeting first construction from 2028, subject to regulatory, commercial, project and industrial readiness.

The agreement does not constitute a procurement contract, grant or commitment of US federal funds and does not require MARAD to acquire ships, technology or services.

Share

Key Judgements

• The US is seeking an asymmetric response to China’s dominance in commercial shipbuilding and its emerging nuclear-maritime capability. Rather than attempting to match China’s lower-cost, high-volume commercial shipbuilding model, the initiative is intended to establish a higher-technology niche centred on nuclear propulsion, US flagging and allied industrial participation.

• The strategic value is logistics, not merely shipbuilding. If operationally viable, nuclear propulsion could enable merchant vessels to sustain higher speeds and extended endurance while reducing exposure to conventional fuel supply disruption. This could improve the resilience of strategic sealift and commercial logistics in a prolonged crisis, particularly where fuel supply lines and maritime choke points are contested.

• The UK has an opportunity but not yet a capability. CORE POWER’s involvement gives Britain an important commercial and technical connection to the initiative. However, the UK would need supporting capability—nuclear-skilled personnel, maritime regulation, supply chains, port preparedness and insurance expertise to translate that connection into meaningful national or allied strategic advantage.

Assessment

Moderate confidence. Public reporting confirms the memorandum and its stated objectives. However, the commercial viability, regulatory pathway, reactor design, financing model and timescale for operational deployment remain uncertain.

The principal significance of nuclear-powered merchant shipping lies in its potential to alter the relationship between commercial logistics and military power. Merchant fleets are a core but frequently overlooked component of national resilience. They move military equipment, sustain overseas deployments, carry industrial inputs and provide the logistics base from which alliances reinforce contested theatres. In a prolonged conflict, commercial shipping capacity, port resilience, access to fuel and the ability to repair or replace vessels can be as strategically consequential as frontline platforms.

For Washington, the initiative reflects a judgement the US is unlikely to surpass China’s conventional shipbuilding capacity through a price-led strategy. Nuclear propulsion is therefore being explored as an asymmetric option: a way of prioritising vessel endurance, operating speed, cargo utilisation and energy independence over low construction cost. This would be consistent with a wider allied approach that seeks to compete through advanced technology, trusted supply chains and resilient infrastructure rather than production volume alone.

However, nuclear propulsion will not automatically translate into strategic advantage. Marine nuclear propulsion has been demonstrated for decades in naval vessels and specialised Arctic icebreakers. Its commercial deployment across international trading routes remains unproven at scale. A merchant vessel that cannot obtain insurance, enter major ports, secure internationally recognised certification, access fuel-cycle support or operate with qualified personnel does not provide usable strategic sealift. In practice, the decisive contest is likely to be institutional as much as technological. MARAD and CORE POWER’s decision to prioritise regulation, ports, workforce, finance and liability demonstrates that the US recognises this constraint.

The 2028 construction target should be treated cautiously. It is a CORE POWER objective rather than a US government commitment, and remains conditional on commercial, regulatory, project and industrial readiness. Even if a first vessel enters construction, scaling to an operational fleet would require durable demand, commercial confidence, standardised regulatory arrangements and multinational port acceptance.

CORE POWER’s proposed industrial model further illustrates this distinction. Conventional hulls and marine systems could be produced through allied shipbuilding capacity, while a dedicated US nuclear-grade integration and lifecycle shipyard would undertake nuclear installation, initial fuelling, testing, commissioning, refuelling, defuelling and through-life support. This model could allow allied states to contribute to construction while retaining sensitive nuclear integration and sustainment functions in the US.

For the UK, CORE POWER’s involvement is strategically relevant but should not be overstated. A London-headquartered company participating in a US-led programme does not by itself produce sovereign British capability. The UK’s more substantive opportunity lies in shaping allied standards and developing complementary capability: nuclear engineering skills, specialist supply chains, regulatory expertise, port-readiness planning, maritime insurance expertise and industrial partnerships with the US, Japan and South Korea.

The partnership should therefore be understood as an operational-resilience initiative as well as a maritime-industrial one. Nuclear propulsion could reduce dependence on conventional marine-fuel supply chains and eliminate propulsion emissions, but its strategic value would depend on the resilience of the wider operating system: reactor maintenance, specialist labour, fuel and waste arrangements, emergency services, cyber security, trusted shipyards and ports able to receive nuclear-powered vessels.

It is highly likely that port regulation and international acceptance will be decisive constraints on the programme’s scalability. The ability of nuclear-powered ships to transit, dock, load and unload at commercially significant ports will require common standards for safety, liability, inspection, insurance, emergency response and security. Early work around the Port of Corpus Christi illustrates this reality: the practical challenge is not simply building a reactor-powered vessel, but establishing the rules and infrastructure that enable routine operations across national jurisdictions.

Subscribe now

Outlook

In the near term, the initiative is likely to concentrate on regulatory and commercial groundwork rather than vessel delivery. Progress should be measured through licensing pathways, port-access arrangements, insurance solutions, workforce-development plans and the identification of viable integration and support sites.

In the medium term, a demonstrator or first commercial construction project could test whether maritime nuclear propulsion can move beyond policy ambition. Allied governments are likely to face difficult decisions on safety governance, liability, public consent and whether to underwrite early commercial risk.

Over the longer term, nuclear-powered merchant shipping could become a component of allied strategic logistics if regulatory acceptance, commercial demand and port access develop in parallel with reactor and shipbuilding capability.

Sources

“Turning policy into steel. Turning vision into ships.” - Core Power

“CORE POWER and Port of Corpus Christi to Study Maritime Nuclear Readiness” -Core Power

“MARAD and Core Power sign cooperation framework to advance nuclear-powered merchant ships” - Bunker Index

“US plans nuclear-powered merchant fleet to challenge China’s shipbuilding dominance” - FT

Summary

On 25 August 2026 Russian commentator and former deputy foreign minister Andrei Fedorov has signalled that unidentified actors could undertake “semi-military” action against UK enterprises or factories involved in producing drones for Ukraine. The remarks follow UK agreement to share designs for components of the Storm Shadow/SCALP missile system that could support Ukrainian domestic production. Kremlin spokesperson Dmitry Peskov separately stated that Russia was gathering intelligence on missile-production sites.

Key Points

• Fedorov’s language appears designed to preserve Russian deniability: he framed possible action as being conducted by “unknown sources,” rather than explicitly by Russian state forces.

• The threat messaging coincides with deeper UK support for Ukraine, including transfer of missile-component designs and renewed diplomatic efforts around Ukrainian air defence and broader military assistance.

• Peskov’s public claim that Russian forces are identifying missile-production locations creates a more direct state-linked signalling context than Fedorov’s comments alone. It does not, however, establish an imminent attack plan.

Subscribe now

Assessment

Recent Russian statements concerning United Kingdom defence-industrial activity are likely intended primarily as coercive strategic messaging. The remarks seek to increase the perceived political, commercial and security costs of British support to Ukraine, particularly assistance that could enable Ukrainian production or employment of long-range strike systems. They are consistent with a broader Russian effort to portray the United Kingdom as a direct participant in the conflict and to deter further defence-industrial cooperation.

The reference to potential action by “unknown sources” is notable. It likely provides rhetorical space for deniable activity while avoiding an explicit state threat against a North Atlantic Treaty Organization member. This framing is consistent with the use of ambiguity as a tool of Russian statecraft: it raises uncertainty for potential targets, complicates attribution and may amplify public concern without requiring Moscow to commit to overt military action.

In the near term, Russia is likely to prioritise activity below the threshold of direct armed attack. The most plausible manifestations include cyber-enabled espionage, hostile reconnaissance, influence activity, targeting of personnel or suppliers and, in a more severe scenario, attempted covert disruption of defence-related operations. These options offer Moscow greater deniability and a lower escalation risk than a conventional strike on UK territory.

A direct, attributable kinetic attack against a UK defence facility remains unlikely in the near term. Such an action would risk a serious confrontation with a NATO member and could generate a coordinated political, economic and potentially military response. Nevertheless, the rhetoric may create permissive conditions for more ambiguous activity by state-linked, proxy or criminal actors.

Outlook

The most significant warning indicator would be a transition from broad political messaging to detailed references to identifiable UK companies, facilities, production programmes, transport routes or personnel. Other indicators would include increased hostile cyber activity against defence-sector organisations, unusual surveillance near relevant premises, sustained narratives portraying individual firms as legitimate targets or credible claims of responsibility by opaque groups.

UK organisations connected to Ukrainian defence support should therefore treat the rhetoric as a heightened-warning signal rather than evidence of an imminent conventional attack. Priority should be given to protective security, cyber resilience, insider-risk management, supply-chain assurance and timely reporting of suspicious activity to the relevant authorities.

Share

Sources

“ UK drone factories may face attacks from ‘unknown sources’, says former Russian minister” - BBC

“Why is Russia threatening UK with ‘consequences’ over Ukraine drones?” - Aljazeera

Summary

A cyber attack reportedly linked to Iranian state-affiliated actors forced a small UK electricity generator offline for four days in July 2026. The UK Government stated that the incident posed no risk to the national electricity system or wider grid, but it represents a confirmed operational disruption to an energy asset rather than conventional espionage or reconnaissance activity.

Key Points

• The affected facility was a small-scale generator, rather than a major power station, grid-control facility or essential national service. Its outage did not affect wider electricity supply or generation capacity.

• Reporting attributes the operation to hackers affiliated with the Iranian regime, but UK authorities have not publicly identified either the affected site or a specific threat group. Attribution should therefore be treated as credible reporting rather than independently confirmed official attribution.

• The Department for Energy Security and Net Zero contacted energy companies following the incident to reinforce cyber-risk guidance. The event coincided with reported Iran-linked cyber activity against United States water infrastructure, including coordinated targeting of more than 30 Minnesota community water systems, but public reporting does not establish that the UK and United States incidents formed a single campaign.

Subscribe now

Assessment

It is likely that Iran-linked actors achieved a limited disruptive effect against UK operational technology or its supporting information technology environment. The reported four-day generator outage is more significant than its immediate physical impact: it demonstrates an ability to generate an operational effect affecting electricity-generation availability, rather than solely accessing or disrupting business systems.

It is unlikely that this incident alone demonstrates an Iranian capability to compromise the UK national grid at scale. The target’s limited capacity, absence of wider supply disruption and lack of reported effects on transmission or distribution infrastructure constrain its strategic significance.

It is likely that the activity was intended, at least in part, as a proof-of-capability or signalling operation. It is a realistic possibility that it also enabled the actor to test access, incident response, recovery arrangements and political thresholds. Targeting a lower-consequence asset allows an adversary to produce a visible coercive or psychological effect while reducing the escalation risk associated with mass casualties or a nationwide blackout.

The recent targeting of more than 30 community water systems in Minnesota provides relevant contextual evidence of continuing Iran-linked interest in operational technology-dependent critical infrastructure. While the cases are not directly comparable, they reinforce the assessment that lower-resilience and locally managed infrastructure can offer attractive targets for limited disruption, signalling and intelligence collection.

It is likely that the near-term UK risk is selective activity against smaller or less mature critical-infrastructure operators rather than an attempt to cause nationally consequential disruption to the electricity system. Such activity would allow an adversary to demonstrate access, impose localised operational and psychological costs, and assess UK response thresholds while managing escalation risk. A near-term attempt to create a nationwide electricity outage remains unlikely.

Share

Sources

“Iran-linked hackers behind cyber attack that shut down power plant, reports say” - BBC

“Unprecedented’ cyberattack on UK power plant caused by hackers linked to Iranian regime - report” - JPost

Summary

Russia has warned that the United Kingdom will face “consequences” following reports that British-manufactured drones were used by Ukraine in long-range strikes against targets inside Russian territory. The statement, issued by the Russian Embassy in London, followed reporting that UK-produced systems had featured in Ukrainian deep-strike operations. The UK Government has not publicly confirmed operational details, but has reiterated its commitment to supporting Ukraine’s defence.

• The Russian Embassy in London stated that the UK would face “consequences” for reportedly supplying drones used in strikes against Russian territory.

• Media reporting, subsequently corroborated by a military source, indicates that British-manufactured drones have been used in Ukrainian long-range attacks inside Russia.

• The UK Government has reaffirmed its commitment to providing Ukraine with the equipment required for its defence, without publicly confirming operational details concerning the reported drone use.

Analyst comment: Russia has repeatedly issued comparable warnings in response to Western military assistance to Ukraine since the full-scale invasion began in 2022. The latest statement follows reporting that British-manufactured systems have been used in strikes inside Russia. End comment.

Share St James Briefing Room

Assessment

Russia’s warning is consistent with a longstanding pattern of strategic messaging intended to deter, constrain, or raise the perceived costs of Western military support for Ukraine. Similar statements have been directed at the UK and other NATO members in response to the provision of weapons, training, and intelligence support to Kyiv.

We assess with moderate confidence that the statement does not indicate an imminent risk of conventional military escalation against the UK. Rather, any Russian response is more likely to occur through its established hybrid and sub-threshold toolkit, including cyber operations, espionage, influence activity, and diplomatic pressure. Russia has already been linked publicly to hostile cyber and espionage activity directed at the UK, while its embassy did not specify what “consequences” it envisaged.

This judgement is based on Russia’s demonstrated use of hostile measures against Western states throughout the conflict, alongside its broader strategy of competing with NATO below the threshold of direct armed conflict. The development provides further supporting evidence for scenarios involving sustained or intensified Russian hostile activity against UK and wider Western interests.

The statement is best understood as coercive signalling rather than evidence of imminent escalation; however, it reinforces the likelihood that Russia will continue to apply pressure against UK interests through deniable and sub-threshold means.

Sources

“UK-made drones strike targets inside Russia” - BBC "

“UK ‘supports Ukraine 100%’, Burnham says, after Russia’s drone warning” - BBC

“Ukraine begins using British drones to strike targets deep within Russia, Times reports” - The KYIV independent

Summary

England and Wales recorded 966 wildfires between 1 January and 10 August 2026, including 185 during the first ten days of August. July was the busiest month on record for wildfires, with 458 incidents.

On 9 August, the National Drought Group reported that 71.3 percent of England was in drought, affecting 45 million people, while more than 27 million people were subject to water-use restrictions. The declaration followed England’s driest July in 190 years and rainfall at 5 percent of the expected level for August to date.

Fire and rescue services declared nine major incidents linked to extreme heat and wildfires on 13 August, bringing the 2026 total to 25. The National Fire Chiefs Council reported damage to residential properties in Stourbridge, Sandwell, Stoke-on-Trent and Pershore.

Subscribe now

Assessment

The 2026 wildfire season is likely to be better understood as a resilience warning than as a stand-alone environmental story. The combination of exceptional dryness, repeated heatwaves and the volume of wildfire incidents indicates that the UK is facing a more persistent pattern of seasonal civil-contingency pressure rather than a series of isolated rural emergencies.

Wildfire is the visible edge of a wider system stress. Fires draw public attention because they are immediate, destructive and operationally obvious, but the more strategically significant issue is that the conditions driving wildfire also reduce water availability, strain emergency services, disrupt transport and place additional pressure on critical infrastructure.

There is a realistic possibility that drought will prove more strategically consequential than wildfire over time, given its direct implications for public water supplies, agriculture, river flows, navigation and infrastructure planning. Government reporting already links the current drought to pressures across public supply, agriculture, navigation and the natural environment.

The Government issued an Emergency Alert across England and Wales on 14 August, warning that wildfire risk was very high nationally and advising the public against activities that could ignite fires. The alert illustrates the degree to which wildfire risk has shifted from a localised land-management concern to a national civil-protection issue.

It is likely that repeated heat and drought will increase the frequency with which local incidents become multi-sector resilience events. A single blaze may remain localised, but concurrent incidents across several regions can consume command capacity, mutual-aid arrangements, specialist appliances and routine response flexibility, particularly when fire and rescue services are already operating in a high-demand environment.

This is where the operational-resilience angle becomes more compelling. If water scarcity becomes more persistent during periods of extreme heat, the principal question is no longer only whether the UK can suppress wildfires, but whether essential services can remain within tolerances while key dependencies come under simultaneous stress. These dependencies include public water systems, transport, electricity distribution, digital infrastructure and emergency response.

Data centres are a useful illustration of this wider challenge. The Government’s National Framework for Water Resources states that data centres require significant water for cooling servers, that large sites can consume millions of litres per day and that demand rises during summer. It also notes that reduced water availability can require operators to use less efficient cooling methods with higher energy demand.

The immediate risk is unlikely to be nationwide digital-infrastructure failure caused by drought alone. A more credible assessment is that water stress could gradually reduce operational flexibility, increase the energy demand associated with cooling, complicate future siting decisions and sharpen trade-offs between economic expansion, local water availability and critical-service continuity during severe weather.

Subscribe now

Outlook

Indicators to monitor include changes to drought status, water-use restrictions, reservoir and groundwater levels, the frequency of major wildfire incidents, mutual-aid activation, transport disruption and evidence of heat-related stress on water, power and digital infrastructure.

Sources

National Fire Chiefs Council, “Fire Chiefs warn of sustained wildfire pressures as drought spreads across England and Wales”

Environment Agency, Department for Environment, Food and Rural Affairs and Met Office, “More areas in England declared in drought after record dry July”

UK Government, “Emergency Alert to be sent to England and Wales as Government steps up wildfire response”

Summary

On 9 August, the UK Ministry of Defence (MoD) began investigating a security issue involving cameras fitted to Royal Navy (RN) K3 Scout uncrewed surface vessels, after a routine cyber-vulnerability assessment identified communications with IP addresses in China.

The cameras were supplied via a third-party contractor and contained Chinese-made components. They were reportedly transmitting routine “heartbeat” signals designed to confirm that the devices were online and functioning.

The MoD stated that it had found no evidence that sensitive data or systems had been accessed, compromised, or transmitted externally.

Subscribe now

Assessment

Although the transmitted data reportedly consisted only of diagnostic communications, the incident likely highlights enduring security risks created by complex defence supply chains and the integration of foreign manufactured components into military systems.

The central issue is not solely that the cameras communicated with IP addresses in China, but whether the MoD and its suppliers had full visibility of that behaviour, its technical purpose and the data involved. Undocumented or poorly understood external communications can create uncertainty over data integrity, platform availability and potential avenues for future exploitation particularly where equipment supports surveillance, reconnaissance, or operational decision-making.

The incident reinforces that hardware assurance cannot end with the prime contractor. Components, firmware, cloud services, maintenance arrangements, and subcontracted supply chains can introduce dependencies that may not be apparent during initial procurement. Even benign “heartbeat” traffic could expose system metadata, create an external network dependency, or provide a potential route for exploitation if device security is weak or updates are inadequately controlled.

The discovery is likely to increase scrutiny of procurement processes, supplier due diligence, hardware provenance, and continuous monitoring across UK defence programmes. It also probably reflects broader Western concerns over cybersecurity and espionage risks associated with Chinese technology and components, even though there is currently no evidence that sensitive information was compromised.

Subscribe now

Why it matters

This incident demonstrates that supply chain vulnerabilities can create security concerns even when no classified information is lost. For organisations responsible for critical systems, it reinforces the importance of supplier assurance, hardware provenance checks and countinous security testing to identify hidden dependencies and unintended communications.

Summary

On 24 July 2026 Belgian authorities, arrested a Canadian woman of Chinese origin who was interning at NATO’s ( Northern Atlantic Treaty Organisation) Supreme Headquarters Allied Powers Europe (SHAPE) in Mons on suspicion of espionage for a third country and involvement in a criminal organisation. NATO and SHAPE say there is currently no indication that the headquarters’ operational readiness or core activities have been affected.

• The investigation began after SHAPE’s own security services flagged concerns about the intern’s conduct and referred the case to Belgian military intelligence and federal prosecutors.

• Authorities conducted searches at both the suspect’s home and workplace inside SHAPE, but have not publicly identified her or named the state allegedly benefitting from the espionage.

• The arrest comes amid wider European concern over foreign intelligence activity targeting NATO institutions and member states, reinforcing scrutiny of insider‑threat and access to alliance command structures.

Assessment

Overall, this incident is assessed as a significant but contained counter‑intelligence concern for NATO, with further developments likely as the investigation progresses. It is likely that the intern was tasked to provide situational awareness, access to planning cycles and internal atmospherics from within SHAPE, reflecting the continued attractiveness of NATO command structures to hostile intelligence services and their use of junior roles and internships to penetrate alliance networks.

The decision not to attribute publicly at this stage suggests investigators are still analysing potential tasking and support networks. On that basis, it is unlikely that the detained intern represents the full extent of any hostile effort directed at SHAPE. Even with no current operational impact reported by NATO and SHAPE, the case is likely to accelerate allied moves toward stricter vetting, enhanced insider‑threat monitoring and tighter control of multinational civilian and intern access to sensitive systems and spaces.

Sources

Canadian intern at NATO military headquarters in Belgium arrested on spying charges. - CBC

Canadian Intern at NATO Arrested on Espionage Charges in Belgium.- Bloomberg

Summary

On 20 July 2026, a Russian warship, the frigate Neustrashimy, conducted a live‑fire artillery exercise in international waters approximately 40 nautical miles south of Plymouth.

The exercise involved the frigate firing its guns over a 30‑minute period and was carried out after the ship informed the Royal Navy offshore patrol vessel HMS Tyne of its intention to conduct gunnery activity and requested that Tyne reposition to a safer distance.

Throughout the exercise, HMS Tyne monitored the Russian vessel, and a French military aircraft also observed the activity and made radio contact with the warship to clarify its intentions.

The UK Ministry of Defence stated that the live‑fire drill took place in international waters, that the Royal Navy tracked the vessel’s activity closely, and that the Royal Navy “stands ready to protect UK national security,” highlighting official interest in Russian military activity near UK coastal approaches even when it occurs outside territorial waters.

Subscribe now

Share

Assessment

The Plymouth live-fire exercise is likely to have been a controlled signalling activity rather than a direct precursor to imminent military escalation against the UK. The fact that the drill was pre-notified to HMS Tyne suggests Russia intended to manage escalation risk and remain formally within accepted patterns of naval behaviour, while still demonstrating military presence close to the British coastline. This is consistent with a broader Russian approach of applying calibrated pressure below the threshold of open confrontation, using legality and ambiguity to shape perception without provoking a clear-cut military response.

The more significant analytic point is the cumulative effect of recent maritime incidents. The UK’s interception of a shadow-fleet tanker in the Channel was a more assertive use of state power against a Russian-linked economic asset, directly affecting a revenue stream tied to Moscow’s war effort. Against that backdrop, there is a realistic possibility that the subsequent warning-shot incident involving a British yacht, and now the Plymouth live-fire drill, form part of a tightening cycle of action and counter-action in waters that are commercially vital, politically sensitive, and close to key UK maritime approaches.

This incident does not by itself indicate an imminent step toward open war. However, it is likely to reflect a step-up in confrontation within the maritime grey zone, particularly given the growing number of interactions involving Russian naval units, shadow-fleet enforcement, civilian maritime traffic, and allied monitoring assets in and around the English Channel and Western Approaches. This trend likely increases the risk of miscalculation, narrative exploitation, and escalation through accident rather than deliberate strategic choice.

For a publication focused on defence, hybrid threats, and strategic warning, the incident is a useful case study in how conventional naval activity can connect to wider themes of coercive signalling, economic warfare, and maritime security. It also provides a clear bridge into discussion of subsea infrastructure, sea-lane resilience, and the monitoring burden placed on the UK and its allies as Russian activity near critical maritime routes becomes more routine.

Sources

“Russian warship carries out live-firing exercise off UK coast” - The Independent

“Russian warship carried out firing exercise” - BBC

Summary

On 13 July the UK’s National Cyber Security Centre (NCSC), alongside 18 partner agencies from 12 countries, has issued a joint advisory warning that cyber actors linked to Centre 16 of Russia’s Federal Security Service (FSB) are exploiting poorly configured routers and other internet‑facing network devices.

The advisory highlights weak or default Simple Network Management Protocol (SNMP) credentials, use of legacy SNMP versions, and unpatched firmware as key enablers for Russian access to critical sectors’ networks.

Centre 16 actors are assessed to rely primarily on wide‑scale scanning to identify routers and edge devices left in an insecure state, rather than bespoke zero‑day exploitation. Once they obtain access using legitimate but weak credentials, they deploy tooling that allows them to maintain persistence, collect traffic and position themselves for follow‑on operations if required.

Activity has been observed across multiple jurisdictions and sectors, including energy, telecommunications, and government networks.

Subscribe now

Share

Assessment

Russian state‑linked actors are conducting intelligence preparation of the environment by building durable footholds on edge devices that can support long‑term collection, situational awareness and provide options for follow on cyber operations in periods of heightened tension. Their success is being enabled by basic hygiene failures on internet‑facing devices notably default or guessable SNMP strings, legacy protocol use, and incomplete patching rather than by new or highly sophisticated technical capabilities.

For UK critical national infrastructure and government networks, router and edge‑device configuration now represents a persisting strategic exposure rather than a niche technical detail.

It is likely that Centre 16’s focus on poorly configured routers and edge devices will persist as a preferred access route over the short to medium term, because it offers low‑cost, high‑value footholds wherever basic hygiene is lacking.

The current advisory does not itself signal an imminent escalation to widespread disruptive operations against UK infrastructure; it instead underlines that Russian state‑sponsored actors continue to exploit long‑standing weaknesses at the network edge that many organisations have still not remedied.

For UK operators, the strategic risk is best understood as persistent exposure arising from weak network-edge security, rather than a new cyber threat. The risk can be materially reduced through robust configuration management and timely patching.

Sources

“UK and Allies urge critical sectors to improve defences against Russian intelligence targeting” - NCSC

“Russian State‑Sponsored Cyber Actors Targeting Network Infrastructure Devices (NSA and partners).” - Joint Cybersecurity Advisory

Subscribe now

Share

Summary

On 14 July 2026, the UK government confirmed that it will run its largest home defence exercise in decades next year under the title “Operation Albiston Shadow,” designed to test responses to hybrid attacks below the threshold of conventional war. The exercise is expected to involve ministers and hundreds of officials from across government and the wider public sector, and will run over several days alongside a wider NATO exercise.

Reporting on the same day also stated that UK defence planning is examining the possibility of public food stockpiles as part of preparations for disruption linked to Russian cyber attacks and wider resilience concerns. The government has additionally announced a new public campaign on national resilience to be launched later this year, alongside publication of an updated national risk register covering threats including war, cyber attacks, drought, and pandemics. On 13 July, the UK announced sanctions targeting Russian cyber networks, stating that they were responsible for cyber and hybrid activity intended to sow chaos and division across Europe.

Share

Subscribe now

Assessment

It is likely that these developments reflect a broader UK shift from a relatively narrow cyber-defence posture toward a more integrated homeland resilience model linking cyber security, civil contingency planning, supply-chain continuity, and public preparedness. The combination of a major national exercise, resilience messaging, food stockpile planning, and sanctions activity indicates that the government is treating hostile state activity as a cross-sector national security challenge rather than a purely technical threat.

It is highly likely that Russia is the principal threat actor shaping this planning cycle. The reported focus on Russian cyber attacks, combined with the UK’s sanctions against Russian cyber networks and its emphasis on hybrid activity below the threshold of war, suggests official concern that Russian or State backed actors could seek to exploit vulnerabilities in logistics, critical infrastructure, and public confidence without crossing into open interstate conflict.

It is likely that Operation Albiston Shadow is intended not only to test emergency response mechanisms, but also to improve coordination between central government, the wider public sector, and allied structures during a period of sustained grey-zone disruption. In this context, the exercise would serve both a preparedness function and a signalling function by demonstrating that the UK is adapting its domestic defence posture to a more contested security environment.

It is likley that public discussion of food stockpiles and resilience measures could produce mixed political and societal effects. While these measures may strengthen deterrence by denial and reassure some audiences, they could also reinforce perceptions of vulnerability if they are not matched by clear public communication about preparedness, continuity and state capacity.

Sources

“UK defence looks at public food stockpile amid Russian cyber attacks,” 14 July 2026”. - The Telegraph,

“ Deborah Haynes reporting on Operation Albiston Shadow and UK resilience planning” - Sky News,

Summary

The UK and the Netherlands have agreed a £2.4 billion maritime partnership to procure eight amphibious transport ships, with four vessels planned for each country. The programme will be delivered through UK shipyards using a Dutch design and is intended to strengthen the joint UK–Dutch amphibious force while supporting NATO maritime readiness.

The agreement aligns with a wider UK pattern of deeper bilateral and minilateral defence cooperation. This includes the December 2025 Lunna House Agreement with Norway, which expanded joint naval activity in the North Atlantic, and the July 2025 Geelong Treaty with Australia under AUKUS, which established a 50-year framework for submarine cooperation.

Taken together, these arrangements indicate that the UK is investing in more integrated defence relationships with trusted allies, particularly in maritime and undersea domains.

The UK–Netherlands ship agreement is part of a broader British trend toward more structured bilateral and minilateral defence cooperation.

Assessment

The UK–Netherlands agreement is more than a simple capability replacement programme. It is highly likely reinforces an established amphibious relationship while extending it into a jointly developed future force centred on common platforms, shared operating concepts and the integration of drones and autonomous systems.

Viewed alongside the Lunna House Agreement, the deal indicates that London is placing greater emphasis on northern maritime security and tighter operational integration with close European partners. It is likely that this reflects a broader UK effort to build a denser network of allied defence relationships across the North Sea, North Atlantic, and High North.

AUKUS broadens this picture and demonstrates that the UK is applying the same strategic logic beyond Europe through long-term, high-trust defence-industrial and military cooperation. Taken together, the available evidence suggests it is highly likely that the UK is pursuing a more networked defence posture built around selective but durable partnerships with key allies.

The trend is highly likley being shaped by concern over the future scale and consistency of US commitment to European security, even if the UK is not seeking to move away from either NATO or Washington. Instead, London is probably seeking to hedge against strategic uncertainty by increasing allied interoperability, industrial resilience, and regional burden-sharing

Sources

“UK and Netherlands Sign £2.4 Billion Deal for Next-Gen Amphibious Ships” - Naval News

“UK and Norway to operate together to counter Russian undersea threat through major new defence agreement” - GOV UK

Analytical Note and Scope

This assessment introduces three analytical constructs:

• Conversion Sovereignty

• Synchronisation Debt

• Regenerative Readiness

These are not official UK government terms. They are used here to examine how finance, industrial capacity, human skill, decision authority, coalition interoperability and operational systems combine—or fail to combine—into usable military power.

The assessment uses probabilistic language consistent with the UK Professional Head of Intelligence Assessment Probability Yardstick. Terms such as likely, highly likely, unlikely and realistic possibility express assessed likelihood. Analytical confidence refers separately to the soundness and stability of the evidence supporting a judgement.

This is not an assessment of the classified readiness of individual formations or platforms. It evaluates the Defence Investment Plan’s conversion architecture: whether Britain’s financing, institutions, industrial base, workforce, mobilisation arrangements, supply chains and military networks can produce the strategic effects the Plan promises.

Executive Summary

The Defence Investment Plan (DIP) is not principally a budget. It is a test of state capacity. Britain is attempting to do more than purchase equipment; it is trying to reconstruct the machinery through which political intent, public finance, industrial production, technological integration and human skill become usable military power.

Money can authorise programmes, but it cannot by itself generate fighting power. Ships can be funded without weapons, weapons without stock depth, autonomous systems without resilient communications, and trained units without the maintenance, infrastructure or logistics required to sustain them. Readiness appears only when these elements converge within the same operational window.

According to the official funding explainer, the DIP establishes a Ministry of Defence spending envelope of £297.7 billion between 2026–27 and 2029–30, including an additional £15 billion above the previous Spending Review settlement. Annual MOD spending rises from £68.3 billion to £79.1 billion across the period. NATO-qualifying defence expenditure is projected to reach 2.7 per cent of GDP from 2027–28, while the UK has committed with NATO allies to reach 3.5 per cent by 2035.

The Plan’s published allocations include:

• £63.6 billion for the Defence Nuclear Enterprise, excluding workforce costs;

• £7.5 billion for the Digital Backbone and Targeting Web;

• £11.1 billion for weapons and munitions;

• over £5 billion for advanced uncrewed systems;

• £78.5 billion for people and veterans;

• £22.7 billion for defence infrastructure and the estate.

These categories do not represent the entirety of MOD spending. Sensitive and operational expenditure is excluded, some cross-cutting costs cannot be mapped to individual lines, and assumptions concerning efficiencies, industrial capacity and realistic delivery schedules are not fully attributed.

These are consequential investments, but their strategic significance will not be determined by expenditure alone.

The central question is whether Britain retains conversion sovereignty: the capacity to transform national resources into coherent, activatable, sustainable and regenerating military effect on a timetable set by strategic necessity rather than institutional delay.

This assessment judges that the DIP is likely to improve readiness selectively, particularly in munitions, autonomy, digital targeting, nuclear renewal and selected priority forces. It is less likely to restore balanced and enduring readiness across the entire force before 2030.

The Plan reduces one category of risk: the visible danger of an overcommitted and insufficiently funded programme. But it does not eliminate defence risk. It changes its location.

Risk moves:

• from programme approval to programme execution;

• from financial allocation to institutional performance;

• from platforms to the networks connecting them;

• from national coherence to coalition interoperability;

• from domestic assembly to upstream supply-chain assurance;

• from acquisition to sustainment and replacement;

• and from the present settlement to decisions future governments must make.

This produces the Plan’s central paradox:

Britain may finance every component of the future force and still fail to possess the force as a coherent whole.

The hidden deficit is not necessarily money.

It is synchronisation debt.

Key Judgements

Strategic Signals — Osamah Almokdad

ST James Briefing Room

The Analytical Test

The Plan can be assessed through four competing explanations.

H1 — Funding Restoration

Previous readiness weaknesses resulted principally from insufficient or unstable funding. Sustained expenditure will therefore restore capability progressively.

H2 — Institutional Bottleneck

The principal constraint is not the quantity of money but the state’s ability to define requirements, contract, manage suppliers, integrate systems and field capabilities.

H3 — Synchronisation Failure

The individual elements of the future force may be funded and delivered, but on schedules too divergent to produce coherent readiness.

H4 — Strategic Overextension

Even successful execution may leave the force too small or shallow for the breadth of Britain’s nuclear, NATO, homeland, European and wider international commitments.

The evidence suggests that H1 is necessary but insufficient.

Additional funding removes a fundamental constraint. But previous affordability problems, programme delays, industrial limitations and the complexity of simultaneous institutional and force transformation mean that H2 and H3 represent the most substantial execution risks.

The National Audit Office assessed the 2023–33 Equipment Plan as unaffordable, with forecast costs exceeding the available budget by £16.9 billion.

The extent of H4 cannot be judged conclusively from public information because detailed Defence Planning Assumptions and significant readiness data remain classified.

Strategic Assessment

1. Readiness Is Convergence under Time Pressure

Readiness is less a static quality of formations than the convergence of capabilities, authorities and logistics within a decision-relevant window.

A force may be materially ready on paper yet strategically late if its activation mechanisms, networks and supply chains cannot move at crisis speed.

2. Conversion Sovereignty

Every defence programme contains a long-term conversion chain:

political authority → funding → contracting → production → delivery → integration → trained employment → sustainment → regeneration

Each transition is a potential failure point.

The speed at which resources pass through this chain is conversion velocity. That rate—not the announcement of expenditure—is the strategic variable separating financial commitment from military power.

The DIP seeks to improve conversion through stronger financial accountability, procurement reform, increased contingencies, centralised force design and annual reporting. It also states that new capability work should enter the programme only when demonstrably affordable and deliverable within its overall budget.

These reforms are directionally sound, but the organisation responsible for delivering the future force is itself undergoing transformation.

Britain is attempting institutional reconstruction and force reconstruction simultaneously. This is the core execution risk.

Conversion sovereignty will depend on whether the MOD can reform its decision and delivery machinery without slowing the programmes those reforms are intended to accelerate.

3. The Activation Layer: When Warning Must Become Action

Most defence investment plans examine what a state can generate over years. Crises test what it can activate in hours and days.

A military may possess available formations, stocked depots, functioning headquarters and credible industrial capacity, yet still respond too slowly if each crisis requires the state to define the problem, negotiate authorities and construct a response from first principles.

Readiness therefore depends on a second conversion chain:

warning → interpretation → decision → authority → mobilisation → deployment → sustained response

This activation layer requires more than intelligence collection or political awareness. It requires a prepared architecture of action:

• plausible threat scenarios and branches;

• predefined warning and escalation thresholds;

• authorities capable of urgent delegation;

• scalable mobilisation packages;

• rehearsed transitions from routine posture to crisis footing;

• reserve, industrial and civilian-support activation mechanisms;

• and fallback arrangements for communications loss, infrastructure disruption or simultaneous pressure across domains.

Prepared scenarios are not predictions of how a crisis will unfold. They are pre-negotiated pathways through uncertainty.

Their purpose is to preserve political choice by ensuring that viable options still exist when a decision is required.

Without such preparation, warning may arrive on time while action arrives too late, creating decision latency—the interval between recognising a threat and generating an executable national response.

Decision latency remains largely invisible in budget documents because the force appears funded, staffed and available. It becomes visible only when the state attempts to move the system at speed.

The most dangerous readiness gap may therefore be less the absence of capability than capability waiting for permission, permission waiting for consensus, and consensus waiting for a degree of certainty that crisis will not provide.

The Strategic Defence Review calls for up-to-date Home Defence plans, mobilisation of Reserves and industry, coherence with NATO planning, and exercises at political and national levels to test responses to attacks on the United Kingdom or its allies. It also proposes a Defence Readiness Bill to provide reserve powers supporting mobilisation and scrutiny of warfighting readiness. Subsequent measures to strengthen the Strategic Reserve indicate movement towards expanding the pool and flexibility of former Service personnel who could be called upon during transition to crisis or war.

These recommendations demonstrate movement, but they also confirm that readiness cannot be reduced to force structure or procurement.

A force can be materially ready and still be strategically late.

Warning without prepared options produces awareness, not readiness.

Subscribe now

Share

4. The Affordability Paradox: Risk Changes Its Address

The previous equipment-planning model repeatedly allowed the gap between ambition and funding to expand.

The DIP seeks to break that cycle through larger contingencies, stronger financial ownership, disciplined programme entry and the retention of future flexibility.

The Plan makes clear that its figures are indicative rather than binding commitments and remain subject to affordability, approval and contracting decisions. Programmes may therefore be reprioritised, deferred, re-scoped or cancelled as circumstances change.

That flexibility is rational. No long-term defence programme can remain credible if it cannot respond to changing technology, threats or costs.

But it creates an affordability paradox.

The more the Plan depends on reform savings, institutional efficiency and adaptive reprioritisation, the less affordability becomes a static question of whether the spreadsheet balances at publication.

It becomes a question of institutional performance.

Can the MOD:

• reform acquisition while delivering a more ambitious programme;

• reduce workforce and estate costs without weakening operational output;

• replace legacy digital systems without creating prolonged transition costs;

• generate savings before new obligations mature;

• and absorb cost growth in protected programmes without compressing conventional readiness?

The £10.7 billion efficiency commitment—of which £8.4 billion comprises lower-maturity plans—is therefore not an administrative detail. It is an operational assumption embedded in force design.

If savings fail to materialise, the effect is unlikely to appear as one dramatic shortfall. It is more likely to emerge through capability compression:

• fewer platforms;

• slower upgrades;

• reduced training;

• delayed infrastructure;

• thinner stockpiles;

• lower maintenance availability;

• and programmes stretched across longer timelines.

5. Synchronisation Debt

Synchronisation debt is the accumulated gap between possessing the components of military power and possessing military power as a functioning whole.

It develops when:

• platforms arrive before weapons;

• weapons arrive before trained operators;

• autonomous systems arrive before resilient networks;

• personnel arrive before training infrastructure;

• factories open before sustained orders;

• mobilisation authorities are created after crisis onset;

• or allied networks become technically connected before their decision procedures are aligned.

The programme may appear funded and active across every category, yet remain strategically underpowered as a whole.

Each project may remain individually compliant with revised timetables. The deficit becomes visible only when the force must operate as an integrated national and coalition system.

The DIP acknowledges that sensitive and operational spending is excluded from published categories, that some cross-cutting expenditure cannot be mapped to individual lines, and that assumptions about efficiency delivery, industrial capacity and realistic delivery schedules are not fully attributed.

This does not invalidate the Plan. It identifies the level at which scrutiny must move beyond expenditure.

The decisive metric is not whether every programme advances.

It is whether the force’s critical paths converge.

6. The Hybrid Force: Distributed Lethality, Concentrated Dependence

The DIP’s concept of an Integrated Force is operationally persuasive.

Modern military effect increasingly resides in relationships between sensors, decision-makers, weapons and support systems rather than within individual platforms alone.

The Digital Targeting Web is intended to connect sensors, deciders and effectors across domains and accelerate the process of identifying, assigning and striking targets. The wider Digital Backbone provides the communications and infrastructure required to support that architecture.

Distribution offers genuine advantages:

• affordable mass;

• wider sensor coverage;

• more complex targeting problems for the adversary;

• reduced exposure of scarce crewed platforms;

• and faster adaptation through modular and software-defined systems.

But distribution is not the opposite of concentration.

It changes what is concentrated.

Platforms become dispersed, while dependence becomes concentrated in:

• communications;

• data integrity;

• navigation and timing;

• electromagnetic access;

• software compatibility;

• machine-to-machine trust;

• and command authority.

An adversary may no longer need to destroy every platform. It may be sufficient to corrupt the relationships that allow those platforms to act as one force.

The central test is therefore not whether Britain can field autonomous mass under ideal connectivity.

It is whether Britain can preserve decision coherence under network fracture.

A network is not resilient merely because it is distributed. It is resilient when essential military functions survive fragmentation.

Without local autonomy, degraded-mode command, secure data validation and rehearsed responses to communications denial, distributed lethality risks becoming fragility distributed across a larger battlespace.

7. Coalition Coherence: Sovereignty through Interoperability

Britain will not generate its highest-end military effects in isolation.

Its principal warfighting framework is NATO, while many of its most advanced capabilities depend on bilateral and multinational relationships with the United States and European allies.

Conversion sovereignty should therefore not be confused with technological or industrial autarky.

In an alliance context, sovereignty includes the ability to connect national capabilities to coalition architectures without losing control over essential data, authorities or operational choices.

Britain’s Digital Backbone and Targeting Web will derive a substantial part of their strategic value from their ability to exchange trusted data and coordinate effects through NATO’s digital architecture and rapidly established mission networks.

The NATO Digital Backbone is designed as a federation of networks and systems connecting the operational edge to decision-makers and effectors across organisational, national and security boundaries. Its reference architecture is intended to ensure that nationally implemented systems can be integrated into a coherent and interoperable architecture.

This creates an additional test of force coherence.

A British sensor may identify a target, a US platform may possess the appropriate weapon, and a NATO commander may hold the relevant authority.

Military effect will still depend on whether classifications, technical standards, identification protocols, rules of engagement and decision procedures allow those elements to converge in time.

Synchronisation debt can therefore exist between allies as well as within a national force.

A nationally coherent force can still become coalition-incoherent if its data, authorities and operational rhythms cannot federate at crisis speed.

Interoperability is not merely the ability of systems to exchange information during demonstrations.

It is the ability of allied forces to preserve a common decision cycle under pressure, degradation and contested communications.

The relevant question is not only whether Britain’s future force can connect to its allies.

It is whether the coalition can continue generating coordinated effect when connectivity becomes partial, trust becomes conditional and national priorities diverge.

8. Regenerative Readiness and Supply-Chain Assurance

Readiness is not exhausted at the point of initial deployment.

A force may enter conflict with credible combat power yet be unable to preserve it after the first cycle of expenditure, damage, adaptation and loss.

Regenerative readiness is the capacity to restore usable military effect at a rate sufficient to prevent operational depletion from becoming strategic paralysis.

Regeneration follows a third conversion chain:

expenditure and loss → recovery and repair → replenishment → replacement → retraining → adaptation → re-entry into operations

The decisive measure is not whether each function exists institutionally, but whether the cycle closes within the tempo imposed by conflict.

A stockpile replenished after the operational window, a repaired platform without a trained crew, or a replacement system unable to rejoin the targeting network may restore inventory without restoring combat power.

Supply-chain assurance is therefore integral to readiness.

Domestic final assembly is not equivalent to sovereign production if essential energetic materials, batteries, semiconductors, rare-earth elements, specialist tooling, software dependencies or technical data remain exposed to denial, restriction or delay.

The Defence Industrial Strategy identifies resilient supply chains and industrial capacity as central to warfighting readiness. Vision 2035 likewise recognises that the UK remains a net importer exposed to geographically concentrated supply chains, and that resilience will depend on domestic production, recycling, substitution, international partnerships and reliable access to overseas supply.

This implies that assurance requires more than mapping suppliers. It depends on:

• sufficient stock depth;

• qualified alternative sources;

• component-substitution engineering;

• resilience against foreign export restrictions;

• contractual access to repair information and technical data;

• retained specialist labour;

• available production tooling and test facilities;

• protected transport and energy infrastructure;

• and procedures for activating those resources before normal commercial mechanisms become too slow.

Some dependencies may be best managed nationally. Others will require reliable allied arrangements.

Conversion sovereignty should not therefore be understood as autarky.

The test is whether military production and support can continue when one supplier, route, technology or partner becomes unavailable.

A distinction must also be maintained between surge capacity and regenerative capacity.

A production line may demonstrate a temporary increase in output while consuming finite inventories, exhausting specialist labour or relying on emergency measures that cannot be repeated.

Regeneration is inherently cyclical. It must survive successive rounds of operational demand, equipment loss, infrastructure disruption and adversary adaptation.

A one-off production surge may provide signalling value.

Only repeatable throughput provides endurance.

Regeneration also has cognitive, doctrinal and technological dimensions.

Conflict changes the operational value of systems after they enter service. Software may require rapid revision, tactics may require adaptation, and autonomous or networked systems may lose effectiveness once an adversary identifies their signatures, communications links or operating logic.

Replacing lost equipment without updating doctrine, code, training and systems integration can reproduce yesterday’s vulnerability at greater scale.

Replacement of quantity without restoration of relevance is not regeneration.

Coalition relationships can strengthen regenerative readiness when allied production, repair, logistics and munitions are sufficiently interchangeable.

They can also introduce delay when technical standards, export controls, security classifications, intellectual-property restrictions or national priorities prevent timely substitution.

British regenerative capacity should therefore be evaluated at two connected levels:

• what can be repaired, reproduced or substituted nationally;

• and what can be restored through allies quickly enough to remain operationally relevant.

The long-term strategic test of the DIP is consequently not only whether Britain can field the first force.

It is whether Britain can recreate coherent military effect through successive cycles of expenditure, loss, learning, replacement and adaptation.

A force capable of deploying once but incapable of regenerating is deployable.

It is not ready for endurance.

9. People and Infrastructure Are Combat Systems

The DIP assigns £78.5 billion to people and veterans and £22.7 billion to infrastructure and the estate during the first four years.

The central issue is not whether these categories are funded, but whether they are synchronised with the technological transformation they must enable.

An increase in recruitment does not automatically resolve shortages in nuclear engineering, cyber and software, data analysis, aircraft and submarine maintenance, weapons integration, medicine and electromagnetic warfare.

These functions require security clearance, specialist education, practical experience and retention.

Similarly, platforms cannot generate enduring availability without docks, airfields, secure networks, accommodation, storage, training ranges, maintenance facilities and energy resilience.

The future force may therefore experience capability asynchrony:

• systems without sufficient operators;

• operators without adequate training environments;

• munitions without storage;

• platforms without maintenance depth;

• and digital architectures without enough cleared specialists to secure them.

People and infrastructure should not be understood as support categories surrounding combat power.

They are systems through which combat power exists.

10. Strategic Optionality or Commitment Latency?

The Plan deliberately leaves part of the post-2030 spending space unallocated in order to respond to evolving threats and technological opportunities. In autonomy, AI, software and counter-drone technology, early prescription may lock Defence into solutions that become obsolete before delivery.

But defence capabilities operate on different clocks.

Software can change in weeks. Missile-production facilities, ships, nuclear infrastructure, specialist workforces and complex supply chains may require years or a decade.

Optionality therefore has unequal value across the force.

In rapidly evolving technologies, delayed specification may preserve advantage.

In long-lead capabilities, delayed commitment may eliminate the time needed to deliver.

The distinction is between:

• strategic optionality—preserving choice until evidence improves;

• and commitment latency—preserving choice until no viable option can arrive in time.

The Plan’s future credibility will depend on whether decisions are governed by explicit threat indicators, industrial lead times and capability-retirement schedules, or deferred until future political cycles have fewer usable choices.

Outlook

Most Likely Outcome — Selective Regeneration

By 2030, Britain is likely to possess stronger munitions pipelines, more autonomous systems, improved digital integration, modernised elements of the estate and greater operational effect in selected priority areas.

The force is also likely to remain uneven.

Advanced systems will coexist with legacy platforms, specialist workforce shortages, transitional support arrangements and infrastructure still catching up with the equipment it must sustain.

This would not constitute failure.

It would represent selective regeneration: a force with greater lethality and adaptability in priority missions, but whose ability to sustain simultaneous or prolonged high-intensity operations remains dependent on mobilisation time, allied support and the resilience of enabling systems and supply chains.

Upside Scenario — Conversion Sovereignty Restored

A stronger outcome becomes plausible if:

• acquisition reform materially reduces the time from requirement to fielded capability;

• efficiency savings are realised without weakening operational outputs;

• munitions investment creates measurable and sustained throughput;

• critical supply chains gain sufficient stock, alternatives and geographic resilience;

• recruitment becomes trained strength in critical trades;

• infrastructure arrives in step with equipment;

• hybrid systems demonstrate resilience under jamming and communications loss;

• British systems federate effectively with NATO networks under contested conditions;

• activation procedures are rehearsed before crisis;

• and post-2030 decisions respect industrial lead times.

Under these conditions, Britain could develop not merely a better-equipped force, but one capable of repeated adaptation, rapid activation, coalition integration and regeneration.

The result would be restored strategic agency: the ability to control the pace and terms on which national resources become military effect.

Downside Scenario — The Components Arrive, the Force Does Not

Risk will be deferred rather than resolved if:

• lower-maturity efficiencies fail to materialise;

• inflation and technical delay consume contingency;

• industrial expansion is slowed by labour or supply constraints;

• a small number of imported components become production bottlenecks;

• networks prove vulnerable under electromagnetic pressure;

• national digital systems fail to federate smoothly with coalition architectures;

• personnel and infrastructure lag equipment delivery;

• mobilisation procedures remain unrehearsed;

• or future decisions are postponed beyond recoverable lead times.

The likely result would not be the visible collapse of the Plan.

It would be an accumulation of synchronisation debt:

• platforms without adequate weapons;

• systems without sufficient operators;

• factories without assured inputs or sustained orders;

• forces without rapid activation authorities;

• national capabilities unable to integrate at coalition speed;

• networks without degraded-mode resilience;

• and commitments without the logistical depth required to support them.

Britain could then possess the visible components of a modern military without possessing enduring military power.

Indicators to Watch

The Plan should be evaluated through conversion outputs, not expenditure alone.

Financial Conversion

• Movement of efficiency initiatives from lower to higher maturity.

• Use of contingency and the reasons for drawdown.

• Frequency of programme re-scoping, deferral or cancellation.

Industrial Conversion

• Monthly weapons output rather than factory announcements.

• Repair and replenishment timelines after demanding exercises or operations.

• Sustained contracted demand rather than short-term production surges.

Supply-Chain Assurance

• Dependence on single-source or geographically concentrated inputs.

• Stock depth of energetic precursors, semiconductors and critical materials.

• Availability of qualified alternative suppliers.

• Time required to substitute a denied component.

• Exposure to foreign export controls and intellectual-property restrictions.

Human Conversion

• Trained strength rather than gross recruitment.

• Retention in nuclear, digital, cyber, engineering and maintenance trades.

• Time required to qualify personnel for new systems.

Force Coherence

• Operational availability of complete mission systems.

• Performance of digital networks under degraded conditions.

• Autonomous-system effectiveness following communications loss, spoofing or jamming.

Coalition Coherence

• Compatibility with NATO Digital Backbone and mission-networking standards.

• Performance in multinational exercises under degraded communications.

• Ability to exchange targeting data across national security and classification boundaries.

• Time required to establish a functioning coalition mission network at crisis onset.

• Alignment of national decision procedures, rules of engagement and operational tempo.

Decision and Mobilisation Readiness

• Time between strategic warning and executable orders.

• Clarity of mobilisation and emergency-procurement authorities.

• Exercises testing rapid transition from routine posture to crisis footing.

• Integration of Reserves into operational units.

• Mechanisms for activating industry, transport, energy, health and communications support.

• Continuity of command following disruption of networks or decision centres.

• Testing against simultaneous threats rather than isolated single-domain events.

Regenerative Capacity

• Time required to replace expended missiles and damaged systems.

• Availability of spare parts, storage, repair facilities and replacement personnel.

• Evidence that production surge can be sustained rather than temporarily demonstrated.

• Speed of operational and technological adaptation after adversary countermeasures appear.

Strategic Timing

• Whether post-2030 decisions precede critical industrial lead-time thresholds.

• Alignment between capability retirement and replacement.

• Whether Britain’s commitments expand faster than its usable and sustainable force.

Conclusion

The Defence Investment Plan is a serious attempt to reconstruct the machinery of British military power.

It recognises that modern deterrence requires more than platforms. It demands munitions depth, trusted data, resilient command, industrial throughput, assured supply chains, enabling infrastructure, skilled personnel, prepared mobilisation authorities and allied capacity to sustain and regenerate combat power after loss.

Expenditure does not become power when it is announced.

Power emerges through conversion.

Readiness emerges through synchronisation.

Action emerges through prepared authority.

Coalition effect emerges through interoperable command.

Endurance emerges through regeneration.

The Plan’s credibility will depend not simply on whether programmes remain funded, but on whether their critical paths converge before strategic demand overtakes delivery—whether decisions are governed by explicit threat indicators, industrial lead times and capability-retirement schedules, or deferred until future political cycles inherit fewer usable choices.

The DIP is neither a guarantee of restored readiness nor a concealed admission of decline.

It is a more disciplined architecture of risk—one that reduces the visible danger of unfunded ambition while transferring the decisive burden to institutional execution, force coherence, supply-chain assurance, mobilisation and time.

Britain’s strategic position will be determined by whether it can recognise danger, activate authority, assemble capability, federate with allies, sustain military effect and regenerate what conflict consumes.

If those functions converge faster than the threat evolves, the Plan will restore more than readiness.

It will restore strategic agency.

If they do not, Britain may possess the components of a modern force without possessing the force itself.

The strategic test has begun.

Primary and Official Sources

• UK Ministry of Defence, The Defence Investment Plan: Equipping Our Forces, Defending Our Future, 30 June 2026.

• UK Ministry of Defence and HM Treasury, The Defence Investment Plan Funding Explainer, 30 June 2026.

• UK Ministry of Defence, Strategic Defence Review 2025: Making Britain Safer—Secure at Home, Strong Abroad, 2 June 2025.

• UK Ministry of Defence, Defence Industrial Strategy 2025: Making Defence an Engine for Growth, 8 September 2025.

• NATO, NATO Digital Backbone and Reference Architecture, 13 December 2024.

• Department for Business and Trade, Vision 2035: Critical Minerals Strategy, published 22 November 2025 and updated 23 January 2026.

• UK Ministry of Defence, Major Boost to Pool of Skilled Former Military Personnel Called Upon in Crises as UK Strengthens Preparedness, 15 January 2026.

• National Audit Office, The Equipment Plan 2023 to 2033, 4 December 2023.

• Intelligence Analysis, Explaining Uncertainty in UK Intelligence Assessment, 24 March 2025.

Executive Summary

Europe’s semiconductor strategy is entering a new phase. The original European Chips Act (2023) aimed to reduce vulnerabilities in the global semiconductor supply chain and mobilise more than 52 billion euros in public and private investment. However, the EU now recognises that fabrication capacity alone will not deliver technological sovereignty if the materials, processing capacity and logistics underpinning semiconductor production remain exposed.

Subscribe now

The proposed EU Chips Act 2.0 reflects this shift. It aims to strengthen Europe’s semiconductor industry, reduce strategic dependencies, increase demand for European chips and support both advanced and mainstream chip production within the EU. It also widens the focus across the semiconductor value chain, including design, research, skills, manufacturing, packaging and access to critical inputs.

This links directly to the Critical Raw Minerals Act (CRMA), which seeks to strengthen Europe’s capacity across extraction, processing and recycling, while reducing dependency on single country suppliers. By 2030, the EU aims to meet around 10% of its annual strategic raw material needs through domestic extraction, 40% through EU processing and 25% through recycling, while ensuring that no more than 65% of any strategic raw material at any relevant processing stage comes from a single third country.

This matters because critical mineral diversification will create new maritime exposure. As Europe seeks alternative sources of lithium , cobalt, nickel , gallium, tungsten, titanium and other strategic materials, its supply chains will increasingly depend on longer, more complex and more contested routes linking Africa, Australia, Latin America, the Indo-Pacific and European processing hubs. The result is a new vulnerability: Europe may reduce dependence on Chinese-controlled supply chains, but increase exposure to maritime chokepoints, shipping disruption, insurance volatility and seabed competition.

Key Judgements

Share

Assessment

Europe’s Semiconductor Strategy is moving Beyond Fabs

Europe’s initial semiconductor response focused on manufacturing capacity. The objective was to reduce reliance on external suppliers and strengthen domestic production.

Chips Act 2.0 reflects a border shift. It aims to reduce strategic dependencies and strengthen the entire semiconductor ecosystem, linking chip production to AI, cloud, defence and industrial competitiveness.

This recognises a core reality: semiconductor resilience does not sit at fabrication alone. It depends on access to materials, processing capacity, logistics and downstream demand. The strategic question is no longer whether Europe can build chips, but whether it can secure the system that enables them.

The Critical Raw Materials Act Addresses the Upstream Risk

The CRMA directly targets the material dependency underpinning Europe’s industrial base. It sets a clear benchmark for 2030:

• 10% domestic extraction

• 40% domestic processing

• 25% recycling

• <65% dependency on a single external supplier

This reflects a structural insight: supply chain vulnerability is not just about access to raw materials, but about where they are refined processed and controlled.

Therefore the Chips Act 2.0 and the CRMA are complementary and together they represent a shift from industrial policy to systemic resilience.

Diversification likely increase Maritime Exposure

As Europe sources more materials from Africa , Australia, Latin America and the Indo-Pacific, supply chains almost certainly will become longer and more complex. This is likely to increase exposure to maritime disruption across already contested routes such as the Red Sea, Suez and the Indo-Pacific corridors.

Disruption does not need to target production sites. It can occur through:

• Delayed shipments

• Rising freight and insurance costs

• Port disruption

• Logistics or visibility gaps

The Vulnerability is shifting from who supplies minerals to how they are moved

The Seabed Is Emerging as a Strategic Resource Space

Deep-sea mining is being explored as a way to diversify supply chains and reduce dependency on dominate suppliers. Research and Development Corporation (RAND) assesses it could provide new sources of critical minerals relevant to energy transmission and defence technologies, while introducing new geopolitical and regulatory changes.

However governance remains fragmented. The international Seabed authority has yet to finalise a clear exploitation framework, with key issues around liability, environmental standard and unilateral action unresolved.

Structural Dependence Remains a Constraint

China’s advantage remains embedded in processing , refining and magnet production, this creates a persistent risk, even if Europe diversifies upstream, it may remain dependent on external processing nodes. Export controls or administrative restrictions can therefore disrupt supply without direct confrontation.

The challenge for Europe is not simply to diversify, but to do so at sufficient scale and speed to reduce exposure.

Strategic Implications

The European Union

The EU is attempting to build a more resilience semiconductor ecosystem by linking demand, production, raw materials and industrial capacity. Chips Act 2.0 seeks to strengthen the chip sector and stimulate demand, while the CRMA addresses upstream vulnerabilities in the raw materials base.

However, Europe will face execution risk. Permitting, financing, environmental approval, skills shortages and competition for investment likely to slow progress. Chips Act 2.0 aims to accelerate permitting for semiconductor projects, but raw material projects remain complex and politically sensitive.

Risk: Europe may achieve nominal semiconductor capacity while remaining exposed to upstream and maritime chokepoints.

The United Kingdom

The UK is outside of the EU’s Chip Act framework, but remains exposed to the same structural pressures. UK defence, advanced manufacturing, cloud infrastructure, telecommunications and clean technology sectors all depend on global semiconductor and critical mineral supply chains.

the UK roles is unlikely to be defined by large-scale semiconductor manufacturing. It is more likely to sit in design, research, defence applications, specialist supply chains, maritime security, insurance , standard and allied coordination.

This gives the UK a narrower but still important role: supporting allied resilience by strengthening high-value niches while monitoring maritime and supply chain risk.

Risk: The UK overestimates the value of domestic fabs and underinvests in maritime, insurance and standards leadership

NATO

Critical minerals are becoming a defence readiness issue. Missiles, drones, sensors, communications systems, electronic warfare platforms, armoured vehicles and precision weapons all rely on advanced components and specialist materials. If Europe cannot secure access to those inputs, NATO’s wider sustainment problem becomes harder.

This links directly to NATO’s existing industrial challenge. NATO may be able to deploy forces quickly, but a prolonged confrontation would test whether members can manufacture, transport and replenish equipment at scale.

Critical minerals therefore sit beneath NATO readiness. They are not just an economic issue, they are part of the defence industrial base.

Risk: Critical mineral constraints manifest as a sustainment problem, not an initial readiness problem.

Indicators to Watch

Short Term

• Emergence of CRMA-Linked strategic projects, especially in refining, process and recycling capacity within the EU.

• early signs of freight, insurance or port disruption on routes relevant to critical mineral transport.

Medium Term

• Acceleration of deep-sea mining activity, including exploration licences, contested or unilateral regulatory moves.

• Expansion of EU partnerships with third countries to secure critical raw material supply chains and diversify sourcing.

Bottom Line

Europe’s push for semiconductor sovereignty is evolving into a broader system-level competition over critical minerals, industrial capacity and maritime access.

The contest for chips is becoming a context for minerals. The contest for minerals id becoming a contest for routes and the contest for routes is increasingly talking place at sea.

Sources

1. Chips Act – Shaping Europe’s Digital Future - Chips Act

2. Critical Raw Materials Act,” official communication and factsheets setting out the 2030 benchmarks - Critical Raw Materials Act

3. Meeting the Costs of Resilience: The EU’s Critical Raw Materials Act - Hertie school

4. “(2024), overview of marine critical minerals, defence applications and environmental/regulatory considerations.” - State of the Science: Deep-Sea Mining

Finland is no longer preparing for ambiguity on its eastern border. It is preparing for conflict conditions.

Since 2023, Helsinki has progressively hardened its 1340 km frontier with Russia through a combination of physical barriers, legal authorities and military integration. What began as a response to so-called instrumentalised migration has evolved into a broader deterrence posture aligned with North Atlantic Treaty Organisation (NATO) northern flank. The closure of all land border crossings , the extension of the emergency border legislation and the construction of a selective but technology dense fence all point to the same conclusion: Finland now assesses that long-term confrontation with Russia is plausible and that the border must be treated accordingly.

This shift is not simply defensive. It reflects a deeper strategic recalibration in which Finland has moved from managing a difficult neighbour to actively shaping the security architecture of the High north.

Key Judgements

Subscribe now

The Border Reimagined

Finland’s eastern frontier is no longer understood as a passive boundary. It is an active security systems integrating infrastructure, surveillance and legislative authority.

The fence itself, standing approximately 4.5 meters high and equipped with motion detection, cameras and communication systems, will ultimately cover only a fraction of the border.1 But that is deliberate. Finnish planners prioritise strategic choke points, where terrain and surveillance create a multiplier effect for limited personal.

Border guards, historically positioned as civilian law enforcement, are increasingly integrated into a “total defence” framework. The closure of all land crossings since December 2023 reinforces the logic, normalising a persistently securitised frontier.

From migration Crisis to Deterrence Doctrine

The catalyst for this transformation remains the 2023 migration episode, which Finnish authorities assess as deliberate hybrid pressure. The response has been structural rather than reactive. The Border Security Act extended through 2026 provided exceptional authorities to control flows and limit exploitation of legal grey zones. 2

The underlying lesson is clear: Low-cost, deniable pressure can generate disproportional disruption unless pre-emptively constrained.

Operationalising Deterrence: NATO on the Northern Flank

This shift is increasingly visible in large-scale NATO exercises across the Arctic and the High North.

Since joining the alliance, Finland has participated in multinational drills spanning Norway, Sweden and Finland, testing the ability of allied forces to operate together in extreme cold-weather and high-intensity scenarios. Recent exercises have involved approximately 25,000 thousand troops from 14 nations, rehearsing territorial defence, rapid deployment and multi-domain operations in Arctic conditions. 3

The United Kingdom (UK) has played a prominent role. Royal marines commandos , the UKs specialists in cold weather and amphibious operations, have deployed in significant numbers to the region, conducting reconnaissance , raids exercises and life-fire exercises as part of alliance planning. 4

These activities are explicitly framed as efforts to deter aggression on NATO’s northern flank. At the tactical level, such exercises enhance interoperability and readiness. At the strategic level, they serve as a visible demonstrations on allied cohesion, signalling that Finalnd’s defence is now embedded within a collective framework rather than a purely national one.

Subscribe now

Second Order Effects : The quiet Breakdown of the Border Region

The deterioration in Finnish-Russian relations is also producing less visible consequences.

Cross-border cooperation has largely ceased, contributing to disruptions in local governance and economic activity. One example is the rise in wolf attacks on reindeer in northern Finland, with over 2,100 recorded loses in 2025, highlighting how geopolitical rupture can generate second-order effects in borderland systems.5

Strategic Outlook

Indicators to Watch

Bottom Line

Finland is not preparing for imminent war with Russia. But it is preparing for a security environment in which conflict conditions are increasingly plausable and ambiguity is weaponised.

The hardening of the eastern border, deeper NATO integration and the expansion of activity into the Arctic all point in the same direction: Finland now treats its frontier as a persistent zone of competition.

In that context, the Arctic is no longer a distant flank. It is a frontline.

Share

Scope

This assessment examines how the United States (US)–China contest over semiconductors is reshaping the strategic position of the United Kingdom (UK) and its European partners over the medium to long term. It focuses on semiconductors not simply as a commercial sector but as a strategic system linking military capability, economic resilience, critical infrastructure and state power.

Summary

The United States (US) and the People’s Republic of China (PRC) are now in a sustained contest over advanced computing power, with semiconductors at its centre. Britain and Europe sit inside that system as essential users and niche producers but remain dependent on foreign fabrication, foreign intellectual property and upstream critical‑minerals chains they do not fully control. The result is a growing strategic vulnerability: London and its European partners are increasingly aware that technology dependence is a national‑security issue but have not yet built the industrial depth, regulatory coherence or political urgency needed to reduce it.

Recent UK strategy documents and speeches suggest that this vulnerability is now being recognised at the top of government. The National Security Strategy 2025 frames the country as operating in an era of “radical uncertainty” while the Cyber Security and Resilience Bill is intended to harden essential and digital services against disruption and coercion. Anne Keast‑Butler’s annual Government Communications Headquarters (GCHQ) threat lecture sharpened that picture further, warning of a narrowing window to retain technological advantage and of an increasingly active hybrid threat environment driven by both Russia and China.

Yet the UK still risks treating the chip war as a distant geopolitical contest rather than a direct challenge to domestic resilience, economic security and strategic freedom of action.

Subscribe now

Key judgements

The chip war in context

For Britain and Europe, the central problem is not total technological absence. It is structural dependence within areas of real but incomplete strength. The UK retains genuine capability in semiconductor design, research, specialised intellectual property and compound semiconductors and its strategy reflects an implicit recognition that it cannot compete head‑on with the fabrication scale of Taiwan, South Korea or the United States. That is a rational judgement. The risk is that a sensible niche strategy is mistaken for strategic security.

Recent research on UK semiconductor firms underlines the problem. Major British chip‑related companies are deeply embedded in international capital networks, with significant United States ownership and meaningful Chinese investment spread across much of the sector. That exposure creates political and strategic pressure from both directions. Washington can use access, standards and alliance expectations to shape the operating environment of UK firms while Beijing can still seek influence through investment, market access and upstream supply. Britain is therefore not outside the chip war. It is already positioned inside it but without the scale to set its own terms.

Europe faces a parallel dilemma. Political language around resilience, sovereignty and strategic autonomy has become more common but fabrication capacity, equipment dependence and investment intensity still leave the continent exposed. In practice, Europe remains reliant on a combination of East Asian manufacturing depth, American design and tooling ecosystems and globally distributed supply chains that were built for efficiency rather than geopolitical stress. This leaves European policymakers in a familiar position: rhetorically committed to sovereignty, materially still dependent.

Share

Subscribe now

Britain and Europe: strength and exposure

For Britain and Europe, the central problem is not total technological absence. It is structural dependence within areas of real but incomplete strength. The UK retains genuine capability in semiconductor design, research, specialised intellectual property and compound semiconductors and its strategy reflects an implicit recognition that it cannot compete head‑on with the fabrication scale of Taiwan, South Korea or the United States. That is a rational judgement. The risk is that a sensible niche strategy is mistaken for strategic security.

Recent research on UK semiconductor firms underlines the problem. Major British chip‑related companies are deeply embedded in international capital networks, with significant United States ownership and meaningful Chinese investment spread across much of the sector. That exposure creates political and strategic pressure from both directions. Washington can use access, standards and alliance expectations to shape the operating environment of UK firms while Beijing can still seek influence through investment, market access and upstream supply. Britain is therefore not outside the chip war. It is already positioned inside it but without the scale to set its own terms.

Europe faces a parallel dilemma. Political language around resilience, sovereignty and strategic autonomy has become more common but fabrication capacity, equipment dependence and investment intensity still leave the continent exposed. In practice, Europe remains reliant on a combination of East Asian manufacturing depth, American design and tooling ecosystems and globally distributed supply chains that were built for efficiency rather than geopolitical stress. This leaves European policymakers in a familiar position: rhetorically committed to sovereignty, materially still dependent.

Subscribe now

Strategy and speeches: what London says it is doing

The UK has begun to describe this wider environment in terms that are much closer to strategic competition than to normal market risk. The National Security Strategy 2025 presents a world of radical uncertainty and sets out a framework built around security at home, strength abroad and stronger sovereign and asymmetric capabilities. Read alongside the Strategic Defence Review 2025, it suggests that technology security, industrial resilience and national power are now seen as part of the same strategic problem rather than separate policy silos.

The Cyber Security and Resilience Bill pushes in the same direction. The bill is intended to update the Network and Information Systems regime, widen the number of entities in scope, tighten incident reporting and strengthen the resilience of essential and digital services. In formal terms, it is a cyber‑defence measure. In strategic terms, it is also an acknowledgement that digital infrastructure now forms part of the state’s national‑resilience base. The gap is that most public discussion of resilience still centres on ransomware, disruption and criminal cyber activity while the chip war exposes a deeper layer of dependence: access to hardware, compute and specialised inputs that cannot be patched or restored quickly once constrained.

Anne Keast‑Butler’s annual GCHQ speech sharpened this picture further. She described the UK as being in a moment of consequence, warned of a narrowing window to maintain technological advantage and argued that cyber security now needs to be treated with greater urgency across government, business and society. She also pointed to Russia’s daily hybrid activity and to China’s scale as a science and technology power. That matters because it brings together two themes often treated separately in public debate: direct hostile activity against critical infrastructure and the slower structural erosion of advantage through technological dependence.

Even the wider political tone is shifting. The King’s 2025 Christmas message appealed to unity and wartime spirit in a more divided and unstable world, reflecting a broader effort to socialise resilience and shared sacrifice as political ideas rather than purely technical concepts. That does not amount to a coherent whole‑of‑state mobilisation. It does, however, suggest that the language of national endurance is returning to the centre of British public life.

Share

Subscribe now

Chips, minerals and the resilience problem

One of the weaknesses in much public discussion of the chip war is that it treats semiconductors as a discrete industrial issue. In practice, the semiconductor stack rests on a wider foundation of minerals, processing capacity, specialist chemicals and manufacturing equipment. Materials such as gallium, graphite, silicon and rare earths sit further upstream but they still shape the resilience of the systems downstream.

This is why the semiconductor contest increasingly overlaps with the critical‑minerals scramble. As these supply chains harden into strategic dependencies, cyber operations against mining firms and regulators are increasingly used to gain advantage in future resource access and rule‑setting.

The United States and its partners are building new alliances and policy frameworks around minerals while analysts and industry groups are openly discussing the need to reduce concentrated dependencies and create more resilient supply chains. China’s position in processing and upstream control means it retains multiple ways to exert pressure even where it lags at the cutting edge of chip fabrication. The chip war therefore cannot be understood purely as a fabrication or export‑control story. It is also a contest over the industrial base beneath it.

For Britain, that has direct resilience implications. A strategy focused only on cyber incident response or software assurance would address part of the problem but not the strategic vulnerability created by dependence on contested hardware and upstream inputs. If national resilience is now being taken seriously as a cross‑government mission, then access to semiconductors, compute and critical‑minerals supply should increasingly be treated as core resilience questions rather than specialist industrial concerns.

Assessment

The UK is beginning to speak the language of systemic competition more clearly than before. It now has a National Security Strategy, a Strategic Defence Review, a cyber‑resilience bill and a more explicit public narrative from GCHQ and ministers about hostile states, technological rivalry and domestic vulnerability. That is a meaningful shift. The problem is that language moves faster than state capacity.

At present, the UK approach still appears stronger at diagnosis than at strategic correction. The semiconductor strategy is selective and limited, the cyber‑resilience agenda is necessary but incomplete and the broader industrial response remains modest compared with the scale of the challenge posed by the United States–China technology contest. Britain is not facing an immediate semiconductor collapse. The more plausible risk is a slower erosion of strategic room for manoeuvre as allies, adversaries and markets make the key choices first.

This is where the chip war becomes a useful test case for a larger question. Can the UK translate a growing awareness of radical uncertainty into a practical model of national resilience that connects cyber, industrial policy, economic security and strategic warning? Or will it continue to recognise the problem faster than it can reorganise around it?

Subscribe now

Share

Indicators to watch

The following indicators would suggest that the UK is moving from rhetorical recognition to practical adaptation:

• Explicit incorporation of semiconductor and hardware‑supply‑chain risk into the implementation of the Cyber Security and Resilience Bill, not only software and incident‑reporting obligations.

• Greater specificity in GCHQ, National Cyber Security Centre (NCSC) and ministerial speeches on semiconductors, compute access and critical‑minerals dependence as national‑security issues rather than peripheral industrial matters.

• Explicit recognition in UK cyber‑security guidance that critical‑minerals and mining organisations are priority targets for state‑linked and criminal cyber operations, and that disruption here feeds directly into semiconductor and compute risk

• Stronger investment‑screening and ownership scrutiny for strategically relevant semiconductor and chip‑adjacent firms in the UK.

• More ambitious long‑term support for UK niches such as design, research and compound semiconductors, backed by clearer alignment between industrial policy and national‑security strategy.

• Formal linking of semiconductor, AI, data‑centre and critical‑minerals policy in future national‑security or economic‑security statements.

The following indicators would suggest continued strategic drift:

• Continued treatment of the chip war as a primarily foreign‑policy or trade issue rather than a resilience issue for critical national infrastructure.

• Repetition of sovereignty language without corresponding investment, regulatory follow‑through or institutional coordination.

• Increased Chinese or other hostile leverage in upstream materials and investment channels without a visible UK policy response.

• Further United States tightening of controls that materially affects UK and European firms before domestic contingency planning is in place.

Outlook

The chip war is not a peripheral technology dispute. It is becoming one of the clearest examples of how strategic competition now reaches directly into domestic resilience, industrial policy and national‑security planning. For the UK, the most important question is not whether it can win such a contest on its own. It cannot. The more relevant question is whether it can reduce the extent to which others are able to impose costs, constraints and strategic choices upon it.

That is why semiconductors should now be understood as part of a wider national‑resilience problem. The same logic that drives concern over cyber security, hostile state activity and critical infrastructure now applies to the hardware, minerals and compute base that sits beneath modern economic and military power. If that connection is taken seriously, the chip war becomes more than a foreign‑policy story. It becomes a test of whether Britain can turn strategic warning into strategic adaptation.

Sources

1. “The Limits of Chip Export Controls in Meeting the China Challenge” - CSIS

2. “Department for Science, Innovation and Technology, “National Semiconductor Strategy”, HM Government, 19 May 2023” - GOVUK

3. “UK’s GCHQ chief warns of AI’s role in Russia’s hybrid warfare” - GCHQ

4. “Understanding the Cyber Security & Resilience Bill” - PWC

5. “EU targets tungsten, rare earths stockpile to counter China’s grip” - Mining.com

6. “Below the Threshold: Russian Submarines, UK Waters & the New Maritime Grey Zone” - St James Assessment

7. “HM Government, “National Security Strategy 2025” - GOVUK

8. “Strategic Defence Review 2025” - GOVUK

9. “Critical Minerals and Cyber Operations” - Recorded Future

Russia’s shadow fleet is no longer a sanctions‑evasion workaround at the edge of European security policy. It has become a persistent hybrid‑war instrument, operating in waters where the concentration of undersea cables, pipelines and offshore infrastructure is highest and where deniability is easiest to sustain. In the Baltic, that combination has already outgrown a narrow “resilience” frame. It is a deterrence problem, and one that Europe is only beginning to confront honestly.1,2

Share

Summary

In an earlier assessment on Russian submarine and seabed activity in UK waters, we argued that persistent grey‑zone operations were redrawing the maritime battlespace without a shot being fired. The central judgement there was that repeated sub‑threshold activity mapping, probing, loitering near critical infrastructure risks becoming normalised if treated as background noise rather than cumulative coercion. The Baltic is now where that logic is advancing fastest, and with a different instrument at the centre of it.

Where the North Atlantic contest plays out largely beneath the surface, the Baltic version is conducted partly in plain sight: ageing tankers with opaque ownership, flags of convenience and degraded safety standards moving through waters that contain some of Europe’s most exposed seabed infrastructure. The shadow fleet does not need to be covert to be effective. It needs only to be ambiguous.

Since the Nord Stream explosions in 2022 and the Balticconnector damage in 2023, the Baltic has produced a pattern of cable and pipeline incidents that looks less like a run of bad luck and more like accumulation. Public broadcasters now ask, bluntly, whether NATO can realistically protect undersea cables and pipelines in a shallow, crowded sea where most incidents look like grey‑zone activity rather than overt attack. NATO’s Baltic Sentry mission, launched in January 2025, formalised the alliance’s response. Finland’s move in early 2026 to strengthen undersea monitoring in the Gulf of Finland a transit corridor for shadow‑fleet vessels shows that regional states are now treating this as a standing surveillance challenge, not an attribution puzzle to be solved after each incident.

This piece argues that if the shadow fleet is the enabling mechanism for hybrid pressure at sea, then Baltic subsea cables and pipelines are among its most attractive pressure points. The framework is the same one applied to the submarine and seabed contest around the UK: the instrument is different, the strategic logic identical.

Key Judgements

Subscribe to St James Briefing Room

The Shadow Fleet as a Hybrid-War Instrument

At its core, the Russian shadow fleet is a sanctions‑evasion mechanism: a constellation of older tankers operating under opaque ownership, flags of convenience and alternative insurance arrangements to move Russian oil despite Western restrictions. But the strategic significance extends beyond revenue, and treating it primarily as a compliance problem misses what makes it genuinely dangerous.

Because shadow‑fleet vessels are deliberately difficult to trace, poorly regulated and operating with degraded transparency standards, they create a maritime ecosystem in which risky or coercive behaviour is easier to conduct and harder to police. The fleet does not need a handler issuing instructions to be strategically useful. It needs only to operate in waters where its presence is hard to challenge, its intent is difficult to prove and the infrastructure beneath it is consequential enough to make its proximity uncomfortable.3

Share

This is the commercial surface counterpart to the covert seabed contest described in the earlier UK assessment on Russian submarines and undersea infrastructure. Instead of naval platforms quietly surveying cables below the waterline, ageing tankers with obscure ownership move through the same strategic corridors under a veil of regulatory ambiguity. The mechanism is different. The logic pressure, uncertainty, optionality is the same.4’5

European and transatlantic analysis now increasingly frames this as part of a broader Russian shadow war: a campaign that uses deniability, legal grey areas and infrastructure pressure to advance strategic aims without triggering the kind of escalation that collective defence commitments are designed to address. Recent investigations explicitly describe the shadow fleet as a hybrid‑warfare platform rather than just a sanctions shield, underlining that this is becoming the mainstream analytical view rather than a niche concern.

Why the Baltic is Uniquely Exposed

Geography matters here in ways that compound rather than simply add up. The Baltic is relatively shallow, semi‑enclosed and threaded with narrow straits that concentrate traffic and complicate surveillance. It carries critical flows of energy and trade for Northern Europe. And it is dense with the seabed infrastructure – telecom cables, gas pipelines, power interconnectors that underpins digital connectivity, energy exchange and financial flows between NATO and EU member states.

That density is the key point. A relatively small physical disruption – a cable fault here, a pipeline incident there – can have disproportionate effects on both the practical functioning of networks and the wider perception of security. The Baltic’s seabed is not just strategically important; it is strategically legible to anyone who wants to apply pressure to it.

The incident record reinforces this. Nord Stream in 2022 demonstrated that major seabed energy infrastructure could be attacked with dramatic strategic and psychological effect. The Balticconnector damage between Finland and Estonia in October 2023 showed that even links between close allies were not immune, reviving energy‑security concerns across the region. The cable faults and disruptions that followed through 2024 and into early 2025 added to a picture of accumulating risk rather than isolated bad luck, with multiple incidents affecting at least ten cables and several pipelines in the Baltic Sea.

Subscribe to St James Briefing Room

The analytical shift is the same one made in the UK submarine assessment: from presence to purpose. The question is not simply whether incidents are happening. It is what the pattern of incidents, vessel behaviour and operating environment together enable over time. In the Baltic, the shadow fleet is central to that operating environment because it supplies much of the ambiguity and risk that surround these infrastructure nodes. BBC and other broadcasters now routinely frame the issue in those terms, asking whether NATO can truly protect Baltic undersea assets given this mix of vulnerability and deniability.6

Cables and Pipelines as Pressure Points

Subsea cables and pipelines are attractive instruments in hybrid competition for a specific reason: they sit at the intersection of physical vulnerability and political ambiguity. Damage to a cable can disrupt data flows, create market uncertainty and impose costly repairs while still leaving open the question of whether the cause was accident, negligence or deliberate interference. Pipelines carry similar strategic weight. Even the perception of vulnerability affects energy‑security calculations and alliance confidence before any incident occurs.

Maritime‑intelligence analysis has documented a pattern of anomalous vessel behaviour drifting, slow‑speed transits, anchor dragging and AIS gaps – in and around sensitive seabed corridors, including incidents where commercial ships have sliced cables and pipes by dragging their anchors for extended periods. This does not automatically mean sabotage. But it reinforces the core point from the UK assessment: persistent anomalies around critical nodes should be treated as warning indicators, not background noise. The value to a hostile actor lies not only in what might be done to a cable, but in the constant pressure that proximity and ambiguity impose on defenders forced to monitor, attribute and respond.

The legal picture compounds the problem. Existing law‑of‑the‑sea frameworks, combined with the forensic difficulty of seabed investigation, mean that states frequently struggle to attribute responsibility quickly or convincingly. 7That prosecution gap is not incidental. It is the same functional feature of grey‑zone strategy identified in the submarine context: it complicates proportional response, slows political consensus and allows hostile behaviour to accumulate past the point where individual incidents would have triggered a sharper reaction.

This is the same structural weakness identified in the UK seabed contest: infrastructure that is simultaneously critical, fragile and politically awkward to defend becomes a natural pressure point in hybrid competition.

NATO and Regional Responses

NATO’s decision in January 2025 to launch the Baltic Sentry mission marked the alliance’s formal acknowledgement that undersea infrastructure protection in the Baltic had become a collective defence concern rather than a national policing matter. Baltic Sentry brings together frigates, maritime patrol aircraft and naval drones, and seeks to integrate national surveillance assets through NATO’s Critical Undersea Infrastructure Network in order to improve detection and response to threats against cables and pipelines.8

Regional governments have moved in parallel, though the pace has been uneven. Finland’s strengthened cooperation with EU and Baltic partners in early 2026, focused on undersea monitoring in the Gulf of Finland, reflects the same logic that drove the UK’s response to submarine activity: treat this as a standing surveillance and warning challenge, not a series of post‑hoc attribution exercises. Finnish authorities have also highlighted the risks posed by idling or loitering tankers, including those linked to the shadow fleet, whose presence near critical infrastructure is seen as both an environmental and security concern.9

The direction of travel is correct. The structural problem is that increased presence and improved monitoring do not by themselves close the gap that makes hybrid maritime pressure attractive especially when much of the risk is generated by nominally civilian shipping. Ambiguity remains a renewable resource for the adversary. As long as attribution is contested and legal thresholds are unclear, the benefits of deniable infrastructure pressure are likely, from Moscow’s perspective, to outweigh the risks of being caught, just as they do in the seabed contest around the UK.10

Outlook : A Persistent Hybrid Theatre

The most plausible scenario for the Baltic over the short term is not a single decisive attack but a continuation of low‑visibility incidents, anomalous vessel behaviour and politically contested infrastructure damage. That pattern serves Russian interests because it keeps constant pressure on governments to prove intent, reassure allies and calibrate responses without the clean evidence base that would make decisive action straightforward.

This mirrors the conclusion of the UK submarine assessment: the strategic risk is not a single act of sabotage. It is the gradual conditioning of policymakers to regard hostile probing as unavoidable background noise a new normal that imposes costs through sustained uncertainty rather than one dramatic event.

Closing that gap requires more than presence. It requires clearer declaratory language about what constitutes unacceptable behaviour around critical infrastructure, more robust enforcement against unsafe and opaque shipping practices and pre‑agreed consequences that can be applied before a catastrophic incident forces the question.

Conclusion

Russia’s shadow fleet has become one of the most visible maritime expressions of a broader hybrid campaign against Europe. In the Baltic, its significance lies not primarily in sustaining sanctioned oil exports though it does that but in the permissive and ambiguous operating environment it helps sustain around critical infrastructure. That environment turns commercial opacity into a strategic asset.

The parallel with Russian submarine and seabed activity around the UK is deliberate. Both cases reflect the same underlying reality: maritime grey‑zone competition is now as much about insurance tables, cable corridors and forensic attribution as it is about warships and missiles. In the Baltic, that contest is playing out on the surface, in plain sight, among vessels that look like ordinary commercial traffic right up to the moment that something stops working on the seabed beneath them.

The policy challenge is therefore less about spotting the next incident and more about whether European states and NATO can build a deterrence posture credible enough to change the cost‑benefit calculation for an adversary that appears, so far, to judge that the benefits of persistent ambiguity exceed the risks of being caught.

Sources

Case Study: Brian Thompson

At 06:46 in the morning on 4 December 2024, Brian Thompson, Chief Executive Officer of UnitedHealthcare, was shot three times outside the Midtown Hilton Hotel in Manhattan. He was heading to his company’s annual investor conference, and he had no security detail with him.1 The conference itself had been publicly disclosed in advance under Securities and Exchange Commission (SEC) filing requirements, which meant his location, the time of his arrival and his identity as the attending executive were matters of public record before he left his hotel room.2

This was not random. Bullet casings recovered at the scene carried the words “deny,” “defend” and “depose,” echoing widespread and long-standing public anger at UnitedHealthcare’s claim denial practices.3 The sentiment that motivated the attack had been building visibly across online platforms for years before it materialised physically, accessible to anyone monitoring the information environment around executives in the health insurance sector. His wife later confirmed that there had been prior threats.4 The attack was not an intelligence failure in the sense of missing something obscure or technical, it was a failure to look at what was already available.

Following the killing, executive security firms reported a significant surge in enquiries from corporate clients who had never previously considered protective measures.5 The Thompson incident did not create a new threat environment, it made an existing one impossible to ignore.

In our experience working on protective details, the Thompson case illustrates failures that are not uncommon in corporate security architecture and that are, individually, entirely addressable. There can be an attitude across the C-Suite of “it will never happen to me”, the data often says otherwise.

The investor conference created a fixed, publicly known location and time in advance. From a preventative perspective, prior threat indicators had been noted but not actioned. From a reactive perspective, the absence of any close protection presence meant there was no protective buffer between the principal and an uncontrolled approach route.

The broader digital environment, in which hostility toward health insurance executives had been a persistent and escalating feature for several years, had not been subject to any systematic monitoring. Each of these failures is correctable. Together, in the absence of an intelligence-led protective framework, they proved fatal.

Black Widow Security - From the Field

Most close protection work looks nothing like the version people imagine. There is rarely dramatic intervention, no visible tension and, on a well-run detail, very little that the principal notices at all. The job is to make the environment safe enough that the person you are protecting can focus entirely on the work they came to do, whether that is a board meeting, a series of back-to-back client engagements or a multi-city trip through environments that carry different risks in different ways.

I have worked on protection details with senior corporate leaders across a broad range of industries, primarily financial services, and almost always as part of a team rather than as a single operator. That distinction matters, because a single body on the ground with no intelligence support is not a protection detail. It is a physical presence, and a physical presence alone is reactive by definition.

Before any principal moved, we ran advance recces on every location they were scheduled to visit. Those recces were not box-ticking exercises. They produced structured reports on the environment, covering approach routes, access points, vulnerabilities, crowd dynamics where relevant and the specific conditions that would require us to adjust the plan. Simultaneously, another operator was running continuous open-source intelligence collection to build a risk score for each leg of the day, drawing on everything publicly available about the environment, the context and any relevant threat indicators. That intelligence fed directly into how we moved, when we moved and the decisions we made on the ground in real time.

The principal was always briefed. Not with everything, and not in a way designed to create anxiety, because an anxious principal changes their behaviour and changed behaviour creates its own vulnerabilities. Our role was to be facilitators, not restrictors. The aim was always to allow the person we were protecting to do their job as normally as possible, with the risk managed around them rather than imposed on them. There is, however, a line, and when the intelligence picture demanded a different approach, that conversation happened clearly and without ambiguity.

The protest intelligence work I have undertaken is a direct extension of the same philosophy. On several occasions I have been contracted to embed within protest activity surrounding a client’s operations and report in real time to the team managing the protective operation from the outside. The principle is identical: understand the threat environment from the inside, feed that understanding into the intelligence picture and give the people making protective decisions the information they need before the situation forces their hand rather than after it already has. A team watching from outside a protest can observe behaviour. They cannot hear what is being planned, identify who is making decisions or know the difference between a crowd that is venting and a crowd that is organising. That intelligence shaped building access decisions, route planning, executive entry and exit timing and the specific windows during which it was safe to move senior leadership. Not as a replacement for the external operation, but as the dimension of it that the external operation could not generate itself.

The gap that the Thompson case exposed is not just a gap in physical capability but also a gap in intelligence architecture. The protective detail that could have made a difference that morning was not one that was bigger or more visible. It was one that had already mapped the environment, scored the risk, briefed the principal and positioned itself accordingly before Brian Thompson stepped outside.

Subscribe to Black Widow Security

St James - Bottom Line Up Front

Senior executives have become visible pressure points for activism, protest mobilisation and hybrid information operations, rather than insulated decision makers operating behind institutional brands. Traditional executive protection models focused on venues, travel and event security are increasingly misaligned with threat vectors that now develop across interconnected digital, geopolitical and personal domains.

It is likely that organisations which fail to adopt intelligence-led protective security and structured due diligence around executive exposure will face avoidable operational disruption, reputational damage and heightened duty-of-care scrutiny over the medium term. Executive targeting incidents reached their highest recorded levels in 2025, doubling year-on-year across 424 documented incidents worldwide.678

Physical activity accounts for 85 percent of those incidents, including assaults, kidnappings, stalking and protest-related actions, and one third of all incidents resulted in injury or death.9 The executive protection industry, valued at $427.8 million in 2024, is projected to nearly double to $853.7 million by 2032, with 72 percent of security professionals citing an increase in public threats against executives as the primary driver of enhanced protective measures.10

This shift matters because most executive protection architectures were designed for an earlier era, one in which threats were slower, more geographically bounded and primarily physical. Today, hostility often incubates first in the information environment before manifesting in the real world, compressing warning timelines and expanding the number of actors capable of generating disruption. The Thompson case is the most visible recent illustration of this dynamic, but it is not an isolated event. It is a data point in an accelerating trend.

Subscribe to St James Briefing Room

Key Judgements

Assessment

Geopolitics and the politicisation of leaders

The central claim of this assessment is straightforward: as geopolitics becomes more volatile, chief executives who once operated in the background are increasingly pulled into the foreground of political and social contention. Conflicts, sanctions and great-power competition are reshaping trade, finance and technology in ways that force visible, value-laden choices onto boards and executive teams.

Since the COVID-19 period, protest mobilisation has become more decentralised, digitally coordinated and personalised, narrowing the distinction between political and corporate authority figures where executives are perceived to influence socially contentious outcomes. In many jurisdictions domestic politics is more polarised, with sharper narratives about inequality, corporate power and the perceived capture of government by business interests. Executives making decisions in that environment are no longer treated as neutral technicians but are framed, fairly or not, as political actors.

It is likely that this politicisation of executive decision making will persist over the near to medium term. Decisions about health-care reform, energy transition, cost-of-living measures, sensitive technologies or financial stability are now routinely framed in moral terms, where who pays, who benefits and who decided carry as much weight as the technical details of the policy or strategy itself. Once those questions are personalised, senior leaders become natural focal points for public anger and organised campaigns, moving executive risk from a narrow concern of physical security teams into a wider strategic issue for boards and resilience leaders.

The contemporary information environment amplifies this trend. Social media, partisan commentary and loosely organised online communities make it easier than ever to attach a name and face to complex grievances, and a handful of viral posts is often sufficient to recast an unknown executive as the perceived architect of an unpopular decision. For hostile or disaffected actors, the operative question becomes less how do we challenge this institution and more which person can we pressure to get a reaction, making senior leaders attractive pressure points even when they are several steps removed from the front line.

How Executives Became Pressure Points

Executives were not designed for this role. The legacy model assumed leaders operated in relatively closed spaces, shielded by institutional brands, controlled communications and physical security, with visibility largely limited to investor calls, conferences and managed media engagements. Everyday life was separate, home addresses were functionally private, and family members were rarely part of the public story unless by deliberate choice.

That separation has thinned considerably. Many executives now maintain a deliberate public profile online, engaging with staff, customers and peers under their own name, while corporate and property records are searchable at scale and conference appearances live indefinitely on video platforms. Friends, family and routines appear inadvertently in social media posts, creating a composite picture of the individual that is far richer than anything most organisations systematically map for security purposes. In effect, executives have become open-source individuals to a degree that would have been unthinkable a generation ago.

From a protective security standpoint, this openness is one of the most significant and underappreciated shifts in the executive risk environment. What an operator or a threat actor can learn about a principal’s movements, preferences, family, home location and professional schedule through open-source research alone would, in many cases, be sufficient to plan and execute a targeted approach without any specialist capability whatsoever. The Thompson investor conference is the clearest available illustration of this principle: the time, location and identity of the attending executive were matters of public record before the event took place, and no protective framework existed to account for what that public knowledge created.

For actors seeking influence, this openness is an opportunity. Targeting a named individual generates more attention and emotional energy than challenging a faceless entity, and it is considerably easier to tell a story about what this person did than to explain complex institutional processes. There is also a widespread belief, sometimes justified, that senior leaders respond more quickly to discomfort directed at them and their families than to more abstract reputational risk aimed at the organisation. These perceptions make executives an appealing route for applying pressure when other channels feel blocked or too slow, and the data reflects this clearly: residential and workplace targeting of executives has risen significantly since 2020, with activists demonstrating a consistent preference for predictable, high-visibility locations that maximise both disruption and media coverage.

Share

The Digital Shadow

Every executive carries a digital shadow, which is the accumulated and publicly accessible record of their professional and personal life as it exists across the internet. This includes their own posts, media appearances, conference schedules, company filings, property records, political donations, family members’ social media accounts and the secondary sources that reference them. For most executives, this shadow is larger, more detailed and less well understood than they realise.

The intelligence value of a digital shadow to a motivated actor is considerable. A thorough open-source profile of a senior executive can reveal predictable daily routines, residential locations, family vulnerabilities, ideological exposures, reputational weaknesses and the specific grievances most likely to be used to frame them as a target. This is not a theoretical concern. It is precisely what occurred in the period before the Thompson shooting, when online communities were actively aggregating information about executives in the health insurance sector and the sentiment environment around them had been deteriorating visibly for years.

From an operational perspective, the digital shadow is simultaneously an intelligence source and a risk surface that requires active management. As an intelligence source, systematic monitoring of a principal’s digital footprint provides early warning of emerging threats, including escalating sentiment, the appearance of personal details in activist forums, specific threats or the identification of an executive as a campaign target. As a risk surface, an unmanaged digital shadow increases the probability that a motivated actor can plan and execute a targeted approach with minimal operational effort and no specialist resources.

What we find consistently in practice is that most organisations have not yet operationalised digital shadow management as a routine component of their executive protection programme. It is typically treated as a communications or reputational function rather than a security one, which means the threat intelligence value is lost entirely and the risk surface remains unmonitored. The gap between what is visible about a principal in the open-source environment and what their security team knows about that visibility is, in most cases, significant and, in some cases, dangerous.

The Emerging Risk Surface Around Leaders

The shift from background manager to visible pressure point has generated a broader and faster-moving risk surface around executives than most organisations currently acknowledge. At least four dimensions stand out.

Physical and protest-related risk. Demonstrations have moved beyond traditional sites of power to include corporate offices, shareholder meetings, private venues and, in some cases, residential areas. The home has emerged as the most common single location for targeting incidents, a shift that reflects activist groups’ preference for environments where executives are less likely to have any protective presence. It is likely that protests targeting locations associated with executives will remain a feature of contentious issues in the near term, with consequences for the safety of families, staff and neighbours alongside operational and reputational impacts.

Digital and information risk. Executives are increasingly named, discussed and targeted online in ways once reserved for senior politicians, with doxxing, harassment campaigns and manipulated content now accompanying conventional criticism. Cyber incidents now account for fourteen percent of documented executive targeting incidents, including death threats, impersonation, swatting and account compromise, and hybrid cases that begin online before transitioning to physical behaviour represent an emerging and concerning pattern.

Travel and geopolitical exposure. Senior leaders who travel to or operate in countries involved in conflicts, sanctions regimes or sharp diplomatic disputes carry a materially different risk profile from those whose work remains domestic. Their presence can be framed by local actors as endorsement, complicity or provocation regardless of nuance, and without robust geopolitical context and protective intelligence support it is more likely than not that routine trips will intersect with unanticipated flashpoints.

Legal and reputational risk. Executives are increasingly named personally in litigation, regulatory actions, shareholder activism and public inquiries. In these cases activist materials and media coverage often move rapidly from criticising an institution to focusing on the statements, personal associations and perceived moral responsibility of specific executives, with organisations facing growing scrutiny over whether foreseeable risks to their senior leaders were adequately addressed.

Taken together, these dimensions describe an executive risk landscape that has outpaced the assumptions built into many existing protection programmes. The case for a more explicitly intelligence-led approach lies precisely in this gap between a static, logistics-centric model and a set of threats that are dynamic, narrative-driven and increasingly personalised.

Recommendations

If you would like to discuss what an intelligence-led executive protection programme looks like in practice, contact Black Widow Security. For geopolitical intelligence assessments, strategic briefings Country analysis, visit St James Briefing Room.

Subscribe to Black Widow Security

Subscribe to St James Briefing Room

Sources

Summary

The 2026 US–Iran war has turned the Red Sea–Hormuz arc from a long‑discussed vulnerability into an active maritime crisis. Houthi forces in Yemen have resumed threats and attempted attacks on commercial shipping in and around the Red Sea and Bab al‑Mandab, periodically forcing carriers and tanker operators to reconsider or reverse their return to the Suez route. Further east, a United States‑led naval blockade of Iran, Iranian restrictions on shipping and the broader conflict have reduced traffic through the Strait of Hormuz to a fraction of normal levels, with ship‑tracking data showing daily crossings collapsing from typical pre‑war averages of 125–140 vessels to single‑digit numbers in some 24‑hour windows.

Before hostilities, the Red Sea–Suez corridor carried an estimated 12–15 percent of global trade by volume, while around a quarter of seaborne oil and roughly one‑fifth of liquefied natural gas exports transited Hormuz, much of it bound for Asia but with global price effects. The central judgement of this assessment is that the combination of persistent Red Sea risk and sustained disruption at Hormuz now constitutes a “southern squeeze” on global shipping and energy flows. That squeeze is already raising prices and insurance costs and tying down Western naval assets, with a realistic possibility that Iran will seek to convert its de facto gatekeeper role into lasting political leverage even if fighting de‑intensifies.

This assessment focuses on impacts over the near to medium term, with particular attention to the United Kingdom and European exposure. For the United Kingdom and Europe, the challenge is not only whether a sudden escalation might trigger a sharp supply shock. It is also whether a prolonged period of constrained traffic, elevated risk and stretched naval commitments erodes resilience and forces hard trade‑offs with other theatres such as the High North, the North Atlantic and the Indo‑Pacific.

Taken together, the judgements below point to a drawn‑out “southern squeeze” that is reshaping routing assumptions, energy risk premia and Western naval posture rather than a short‑lived shock that can be assumed to revert quickly to the pre‑war status quo.

Key Judgements

Subscribe now

The maritime crisis below the equator

The southern maritime crisis sits at the intersection of long‑standing vulnerabilities and the acute dynamics of the 2026 US–Iran war. In the Red Sea, Houthi attacks launched from Yemen against commercial vessels in 2023–24 halted or diverted the majority of Suez‑bound traffic, driving carriers to reroute around the Cape at significant cost until a ceasefire and Gaza peace plan temporarily reduced the tempo of strikes. Analysts warned at the time that the quiet was conditional and that the underlying capability and intent remained intact. That judgement has been borne out by renewed Houthi threats and propaganda signalling a willingness to resume attacks and even consider a blockade of Bab al‑Mandab if the regional conflict escalates further.

At the eastern end of the arc, the Strait of Hormuz has shifted from a theoretical risk to an ongoing disruption. Following United States and Israeli strikes on Iranian targets in late February and Tehran’s retaliatory threats, Washington announced a naval blockade of shipping to and from Iran, while Iran imposed its own restrictions in the strait. Ship‑tracking and satellite data show traffic collapsing from typical pre‑war daily averages of 125–140 crossings to single‑digit numbers, with some 24‑hour periods registering only a handful of vessels transiting and many tankers forced to turn back. Iran’s Islamic Revolutionary Guard Corps has simultaneously claimed to “coordinate” or authorise passages, reinforcing its narrative that access to Hormuz now runs through its hands.

This dual‑pressure environment—threatened Red Sea attacks in the west and constrained Hormuz traffic in the east—creates systemic uncertainty that extends beyond the immediate conflict parties. It affects carriers, insurers, energy traders and governments who must decide, voyage by voyage, how much risk to accept in an environment where both geography and the use of force are being actively politicised.

Share

The southern vice: chokepoints as instruments of coercion

The strategic logic binding the Red Sea and Hormuz together is straightforward: both are narrow sea‑lines of communication that concentrate a disproportionate share of global trade and energy flows into confined, monitorable spaces. The Bab al‑Mandab Strait links the Red Sea and Suez Canal to the Indian Ocean; disruption there forces traffic between Europe and Asia onto far longer routes around southern Africa, adding roughly ten days to some voyages and contributing to sustained higher freight and insurance costs. Hormuz funnels Gulf energy exports to world markets; constraining it directly affects supply volumes and heightens price sensitivity to shocks.

For Iran and its allies, operating in and around these chokepoints offers several advantages. It allows them to exert leverage on adversaries not primarily through territorial gains but by demonstrating the ability to increase costs and volatility across the global system. It also exploits the asymmetry between the relatively low cost of missile, drone or small‑boat operations and the high economic value of the cargoes and routes at risk. Crucially, it creates opportunities to calibrate pressure: attacks or threats can be dialled up or down, directed at specific flags or cargoes, or selectively suspended to gain diplomatic or economic concessions.

From a Western perspective, the problem is not simply the physical vulnerability of the routes but the cumulative effect of persistent uncertainty. Even without a formal closure of Bab al‑Mandab or Hormuz, the combination of sporadic attacks, near‑misses, political declarations and blockading operations is sufficient to force detours, change insurance terms and absorb limited naval resources in sustained escort and surveillance missions. Over time, that pressure risks becoming a new background level of friction in the maritime system, even as it quietly reshapes routing decisions and supply assumptions.

Subscribe now

Share

Assessment

The most persuasive analytical conclusion is that the Red Sea–Hormuz crisis should be viewed as an evolving campaign of maritime coercion rather than a series of isolated incidents. Houthi actions in the Red Sea are closely aligned with Iranian regional interests but also display a degree of autonomy, giving Tehran a proxy that can apply pressure with some deniability while still contributing to a broader strategic objective. The United States naval blockade of Iran, in turn, seeks to constrain Tehran’s ability to fund and sustain its regional influence, but it also entrenches the perception that Hormuz is now a contested space in which access is negotiated, authorised and occasionally denied by armed actors on both sides.

For global markets, the immediate impact is visible in longer voyage times, higher freight and insurance premiums and heightened energy price volatility, with analysis suggesting that renewed or intensified attacks could push oil prices sharply higher from already elevated, crisis‑driven levels. For the United Kingdom and Europe, the primary near‑term exposure lies in price and timing rather than physical scarcity, but the second‑order effects on inflation, business confidence, supply chain planning and the financial sector are significant.

For Western navies, the crisis imposes a sustained operational burden. The United Kingdom, France and other European allies have deployed warships to help secure Red Sea traffic and support United States operations around Hormuz, even as they face demands to maintain presence in the High North, the North Atlantic and the Indo‑Pacific. Over time, these simultaneous commitments risk stretching limited fleets and specialist crews thin, complicating readiness for other contingencies, including Russian naval activity in northern waters and Chinese grey‑zone operations in the Indo‑Pacific.

Share

Outlook

In the near term, the most likely trajectory is a messy and unstable equilibrium. Houthi threats and occasional attacks in the Red Sea are likely to persist, ensuring that a full and confident return to the Suez route remains fragile and contingent on the wider course of the US–Iran war. In Hormuz, commercial traffic is likely to remain constrained even if ceasefire talks reduce the immediate risk of direct strikes, because both the United States blockade and Iranian restrictions inject political risk into every transit decision.

Over the medium term, outcomes turn on whether the conflict produces a political settlement that durably re‑opens Hormuz and reduces incentives for proxy escalation at sea. There is a realistic possibility that, even after major combat operations end, Iran will seek to preserve some form of leverage over shipping—whether through implied veto power, informal tolls or heightened “coordination” requirements—embedding an additional layer of political risk into global energy flows. For the Red Sea, the key risk is that Houthi capabilities and narratives remain intact, enabling rapid re‑escalation whenever regional tensions spike.

For the United Kingdom and Europe, the policy implication is that the southern maritime corridor can no longer be treated as a stable default route whose security can be assumed at low cost. Energy diversification, alternative routing options, and investment in naval capacity, maritime domain awareness and resilience in shipping and financial services will become core elements of economic and security planning rather than niche concerns. The strategic question is less whether this crisis will end with a single dramatic event, and more whether it marks the beginning of a new normal in which key sea‑lines of communication are persistently contested below the threshold of declared war.

Conclusion

The Red Sea–Hormuz crisis fits the logic of maritime coercion in an era of strategic competition. It exploits geography, proxy relationships and the political caution surrounding escalation to impose costs and uncertainty on a global system that still depends on a handful of narrow waterways. The core thesis stands: the southern maritime flank is shifting from a background assumption of stability to a contested space in which persistent, calibrated disruption is likely to remain a feature of the environment rather than an exception.

The central policy challenge is therefore not only how to respond to a catastrophic closure, but how to manage, deter and adapt to a prolonged period in which critical sea‑lines of communication are under systematic pressure from both state and non‑state actors. In practice, the “southern squeeze” is best understood not as a temporary shock but as a vice that can be tightened or loosened at will by actors who have learned how to turn chokepoints into instruments of coercive statecraft.

Sources

“Potential Houthi threat to Red Sea shipping could further damage global economy” - BBC News

“Report to Congress on the Iran Conflict and Strait of Hormuz” - USNI News

“The Houthis And Maritime Vulnerability: Implications For 2026 – Analysis” - Eurasia Review

“Iran oil tankers turned back by US blockade, Hormuz traffic sparse” - Reuters

“Full return to Red Sea route could be paused after new threats from Houthi rebels” - ICIS

“U.S. Enforces Blockade, Sends Tankers Back to Iran” - Wall Street Journal

Executive Summary

By May 2026, the distinction between peace and war has collapsed into a state of permanent grey-zone competition. The battlefield in Ukraine—spanning an 800-mile frontline where over 1,000 autonomous artificial intelligence (AI)-enabled strike missions occur daily—has become the proving ground for a fundamental restructuring of how lethal force is delivered, deterred and denied. Simultaneously, European waters have sustained eleven confirmed subsea infrastructure incidents since October 2023, The Russian auxiliary vessel Yantar, officially classified as an oceanographic research ship but assessed by UK Defence Intelligence to conduct subsea infrastructure reconnaissance.

These are not isolated crises; they represent the operational convergence of three strategic shifts: the replacement of traditional kill chains with AI-driven autonomous systems that render legacy electronic warfare (EW) obsolete, the weaponisation of civilian communications infrastructure through cognitive operations that turn commercial networks into precision targeting beacons and the normalisation of deniable maritime sabotage as a sustained instrument of state strategy.

This assessment examines the integration of these vectors—autonomous lethality, cognitive manoeuvre and clandestine infrastructure targeting—between late 2024 and May 2026. Unlike conventional deterrence models calibrated to binary thresholds, the current security environment is characterised by continuous technological adaptation and data-driven targeting cycles that exploit the very systems Western economies depend upon. The strategic question is no longer whether conflict will occur, but whether the North Atlantic Treaty Organization’s (NATO) procurement timelines and doctrinal frameworks can adapt faster than adversaries can degrade them.

Share

Subscribe now

Key Judgments (KJ)

• KJ1: We assess it is highly likely that AI-driven autonomous terminal guidance has achieved operational maturity in Ukraine, rendering legacy EW countermeasures increasingly ineffective against this class of threat. We further assess it is probable that this represents an irreversible shift toward autonomous feedback loops as the dominant kill-chain model for low-cost mass strike platforms in the medium term.

• KJ2: We assess it is probable that cognitive manoeuvre – the integration of social engineering with cyber intrusion to generate kinetic targeting data – has been operationally validated in Ukraine and represents a scalable methodology applicable to broader campaigns against UK and NATO infrastructure operators.

• KJ3: It is highly likely that Russian vessels are conducting detailed reconnaissance of UK subsea infrastructure. Based on patterns of deliberate cable damage in the Baltic and the vessel’s known intelligence collection role, we assess it is probable that this activity is intended to develop contingency sabotage options that could be activated to coerce or disrupt the UK in a crisis.

I. AI-Driven Autonomous Systems and the New Kill Chain

The battlefield in Ukraine has become the primary laboratory for a structural transformation in how lethal force is delivered. AI-powered autonomous drones are now conducting daily combat operations across an approximately 800-mile frontline without sustained human control.

Traditional remotely piloted systems depend on a continuous communications link between operator and platform. Russian EW capabilities originally degraded these links sufficiently to force a Ukrainian response: autonomous terminal guidance. Rather than maintaining operator control throughout the flight envelope, next-generation systems hand targeting decisions to onboard computer vision at a designated point in the attack sequence.

Analyst comment: By spring 2025, Ukrainian forces deployed over 1,000 AI-enabled autonomous strike missions using the “Bumblebee” quadcopter, according to multiple open sources though independent verification of daily mission counts is not available. End comment.

For NATO, the challenge is structural. Countermeasures calibrated to jam operator-to-drone frequencies are largely ineffective against systems that do not require a signal to complete their terminal strike. Effective responses must instead target onboard sensor packages or exploit adversarial machine learning vulnerabilities.

II. Cognitive Maneuver and the Weaponisation of Infrastructure

NATO’s Chief Scientist concluded in early 2026 that adversaries now treat human perception and behavior as a distinct operational domain. When cognitive operations are integrated with cyber intrusion, they function as a weapons system capable of enabling precision strikes without direct access to protected networks.

The clearest documented case study is Ukraine’s “Operation Self-Liquidation,” conducted in early 2026. When Russian forces—dependent on black-market Starlink terminals—became vulnerable due to SpaceX geofencing, Ukrainian operatives established Telegram channels posing as black-market registration services.

• The Outcome: Russian soldiers voluntarily submitted terminal identifiers and precise geographic coordinates.

• The Impact: A five-person team generated targeting-grade geolocation data on 2,420 Russian positions through deception alone.

This case illustrates the central logic of cognitive maneuver: civilian commercial infrastructure becomes simultaneously a dependency, a vulnerability, and a targeting beacon.

III. Baltic and UK Maritime Sabotage: Anatomy of the Grey Zone

Between October 2023 and May 2026, the Baltic Sea sustained at least eleven confirmed or suspected incidents of deliberate subsea damage. This has established a pattern of deniable maritime sabotage as a sustained instrument of Russian strategy.

The threat extends directly to UK waters. The Russian vessel Yantar—officially an oceanographic research ship—has entered UK waters on multiple occasions, most recently in November 2025. UK Defence Secretary John Healey confirmed the vessel is used for “mapping the UK’s critical underwater infrastructure.”

• Escalation: In late 2025, the vessel directed lasers at RAF pilots monitoring its movements—the first confirmed use of active countermeasures against UK surveillance aircraft.

• Strategic Risk: The UK’s subsea infrastructure carries over 90% of international data transfers. The ability to physically damage these cables provides Moscow with a “strategic switch” capable of triggering systemic economic instability.

  

  Subscribe now

  Share

  ---

  Strategic Assessment: The Doctrine of Integrated Attrition

  The three vectors identified in this paper—autonomous systems, cognitive maneuver, and maritime sabotage—are not isolated phenomena. When viewed through the lens of Russian “New Generation Warfare,” they represent a move toward Integrated Attrition. The objective is not necessarily a decisive military victory in the Napoleonic sense, but the sustained degradation of Western technical, economic, and psychological resilience.

  1. The Erosion of Technical Deterrence

  The rapid obsolescence of NATO-standard Electronic Warfare (EW) suggests that the Alliance’s technical edge is being eroded faster than traditional procurement cycles can adapt. We assess that the deployment of autonomous “pixel-lock” systems in Ukraine is a precursor to a wider shift where quantity and software agility become more decisive than the individual platform’s sophistication.

  2. The Weaponization of the “Commercial Commons”

  The use of Starlink as a kinetic beacon and the “Shadow Fleet” as a tool for cable sabotage indicates that the “Commercial Commons” (international waters, space-based internet, global shipping) is now a primary battleground. Adversaries are exploiting the very systems that Western economies rely on for globalized trade. This creates a “Dilemma of Response”: a kinetic response to a “civilian” vessel dragging an anchor risks escalation, while no response invites further degradation.

  3. Cognitive-Kinetic Convergence

  The convergence of social engineering and precision strikes represents the most significant shift in the 2026 landscape. We have moved from “Information Operations” (designed to change minds) to “Cognitive Targeting” (designed to find and fix targets). This collapses the traditional wall between Cyber Security and Physical Security.

• 

  ---

  Strategic Pivot: From Reactive Defence to Proactive Resilience

  To counter the doctrine of Integrated Attrition, the UK and NATO must pivot from traditional platform-centric defence to a model of Distributed Resilience. This requires three immediate shifts in posture:

  1. Accelerated “Attritable” Procurement: To counter mass-produced autonomous drones, the UK must shift funding from a small number of “exquisite” high-value assets to vast quantities of low-cost, expendable autonomous systems. Deterrence in 2026 is achieved through the ability to absorb losses and maintain “mass” on the battlefield.

  2. Subsea “Mesh” Networking: To protect critical national infrastructure (CNI), the UK should deploy a persistent “underwater shield” of autonomous subsea sensors. By moving from intermittent patrols to a permanent, uncrewed presence around data cables and interconnectors, the “cost of entry” for Russian sabotage is significantly raised.

  3. The “Cognitive Firewall”: National security must expand to include the “Commercial Commons”. This involves formalised intelligence-sharing partnerships with private satellite and telecommunications providers to “harden” civilian networks against cognitive targeting. The goal is to turn the “targeting beacon” back into a “deception tool”, feeding adversaries corrupted data to neutralise their targeting cycles.

  ---

  Outlook: Strategic Trajectories

  The convergence of autonomous terminal lethality and infrastructure weaponisation is not a static threat; it is an evolving doctrinal shift. We assess the trajectory as follows:

  Short-Term: Tactical Saturation

  • Autonomous Proliferation: It is almost certain that ‘pixel-lock’ autonomous guidance will become the baseline for all frontline FPV operations, nullifying the current generation of tactical EW jammers.

  • Shadow Fleet Posture: We anticipate an almost certain increase in “navigational accidents” in the North Sea and Baltic, specifically targeting electricity interconnectors during peak winter demand periods to test NATO’s threshold for Article 5.

  Medium-Term: Systemic Vulnerability

  • The “Swarm” Epoch: Deployment of decentralized autonomous swarms is highly likely. These will utilize mesh-networking to overcome point defenses, shifting the advantage decisively toward mass-expendable strike platforms over high-value manned assets.

  • Cognitive Infrastructure Mapping: It is probable that adversaries will move from targeting frontline soldiers to targeting the “Digital Twins” of UK CNI. Expect social engineering campaigns to focus on the private contractors who maintain subsea and satellite telemetry systems.

  Long-Term: The Post-Binary Order

  • Erosion of Traditional Deterrence: By 2030, the ability of a “Small State” or non-state actor to achieve strategic effects via deniable autonomous sabotage will be highly likely. Traditional maritime and air superiority will be increasingly contested by “permanent” subsea and low-orbit autonomous presences.

  • Structural Economic Attrition: War will likely cease to be a discrete event, evolving instead into a permanent state of grey-zone attrition where the goal is to drive the “cost of defense” to a level that triggers systemic Western economic decline.

    Thanks for reading St James Breifing Room! Subscribe for free to receive new posts and support my work.

    Share

  ---

Sources

1. “Preparing for Russia’s New Generation Warfare in Europe” -Recorded Future

2. “Russia’s hybrid warfare rattles Poland and NATO” - NPR

3. “Robot wars - what an operation in Ukraine tells us about the battlefield of the near future” - BBC

4. “Ukraine’s battlefield is entering a new phase as AI-powered autonomous drones are now operating without human guidance after launch” Linkedin

5. “Ukraine deploys AI drones that strike autonomously” -

6. “In the past year, drone warfare in Ukraine has undergone a chilling transformation.” - NY Times

7. “Ukraine's AI drone war is accelerating” - BFPS

8. “ Ai powered loitering munition systems set new starter for battlefield autonomy” - Autonomy Global

9. “What is the mysterious Yantar ‘spy ship’ - and is it mapping Britain’s undersea cables?” - Sky News

10. “UK exposes covert Russian submarine operation in and around UK waters” - UKGOV

11. “Cognitive Warfare 2026: NATO’s Chief Scientist Report as Sentinel Call for Operational Readiness” - INSS

12. “What Russia’s Baltic Cable Sabotage Tells Us About Its Shadow Fleet: - United24 Media