UK leaders warned country risks 'absorbing' cyber and hybrid attacks without offensive deterrence

Britain risks leaving itself exposed to cyberattacks and hybrid forms of warfare unless it exercises an ability to impose costs on hostile states, ministers were warned during a parliamentary hearing on national security.

The former national security adviser Lord Sedwill — now a member of the Joint Committee on the National Security Strategy — said that resilience measures alone would not deter adversaries conducting cyber operations, sabotage of critical infrastructure and disinformation campaigns against the United Kingdom.

“There needs to be essentially an offensive element to deterrence, as well as simply a defensive element,” Sedwill said at the hearing on Monday, warning that Britain risks “absorbing their attacks” rather than discouraging them. His comments echo those made by Lord Dannatt, the former head of the British Army, who previously urged the government to get on the “forward foot” with ransomware instead of just “absorbing the punches.”

Sedwill’s warning followed ministers defending their plans to raise security spending as set out at last year’s NATO summit. Allies agreed to increase total spending to 5% of GDP within a decade, with 3.5% allocated to core defense and the additional 1.5% earmarked for indirect defense and resilience spending, including on cybersecurity capabilities.

Committee members raised concerns that the indirect component of this could amount to repackaging existing activity rather than delivering new capability. Representing the government were Darren Jones, the most senior Cabinet Office minister; Dan Jarvis, the security minister; and Matthew Collins, the deputy national security adviser.

Jones said current budget settlements meant the government expected to reach the 1.5% target by next year “using existing NATO definitions,” but acknowledged that this reflected existing expenditure rather than additional investment.

While NATO has formal accounting rules for core defense spending, there is no standardized definition for civilian investments counted under resilience spending, which may include protection of energy systems, logistics hubs, supply chains and critical national infrastructure. Critics have warned that the lack of clarity could encourage creative accounting among allies.

Sedwill said he was concerned the resilience figure risked becoming a broad “basket” of spending that already exists, rather than delivering genuinely new capability. Drawing on his own experience at NATO, he said he was “very familiar with all the accounting games that can be played to shovel things in to meet the NATO definitions,” and pressed ministers to explain what additional capacity would actually be delivered by 2027.

Preparing, but quietly 

NATO allies warn that cyber incidents and other hostile acts below the threshold of armed conflict are already having “strategically consequential effects,” even without triggering a military response. NATO as a result has moved to strengthen its cyber posture, including plans for an integrated cyberdefense center at its military headquarters in Belgium.

Pressed on how Britain would respond to such attacks, Jones said the Strategic Defence Review recognizes that indirect and hybrid confrontation will become more frequent, but declined to discuss how the U.K. might retaliate or escalate, citing operational sensitivity.

Jarvis said the government will publish a refreshed National Cyber Action Plan in the spring, shifting from a strategic framework to a more operational plan focused on countering threats, strengthening resilience and supporting economic growth. He cited recent cyberattacks on major British companies as evidence of escalating risk, and said ransomware legislation remains under consideration following consultation with allies.

Ministers also acknowledged shortcomings in the U.K.’s ability to counter foreign disinformation. Jones said he was “not currently persuaded” that existing tools are sufficient and confirmed that an independent review led by senior civil servant Philip Rycroft will report by the end of March on whether stronger powers are needed.

On China, Jarvis said Russia and Iran have already been placed in the enhanced tier of the Foreign Influence Registration Scheme, while China remains under review. He defended the government’s approval of a new Chinese Embassy in London, citing security advice that consolidating China’s diplomatic presence provides national security advantages.

But Sedwill and other committee members warned that without a credible ability to impose costs on hostile actors, Britain’s growing emphasis on resilience risks becoming endurance rather than deterrence — particularly in cyberspace and other hybrid domains.