Summary

• The UK will run its largest home defence exercise in decades in 2027.
• The drill will test readiness for hybrid threats including cyber attacks, disinformation, and sabotage.
• The exercise links national security planning with the operational resilience of public services, infrastructure operators, technology suppliers, and businesses.

The UK government will run a major home defence exercise in 2027 to test Britain’s readiness for hybrid attacks involving cyber disruption, sabotage, disinformation, and pressure on critical infrastructure.

The multi day exercise is expected to involve ministers and hundreds of officials from across government and the public sector. It will sit alongside NATO crisis management work designed to test how allies coordinate political and military responses to major security crises, while the specific drill scenario will remain secret.

The exercise follows the publication of the 2026 National Risk Register, which adds democratic interference, cyber attacks on data infrastructure, cyber attacks on water infrastructure, cyber attacks on police systems, and digital resilience failure to the UK’s formal risk planning. The government is also preparing a public awareness campaign intended to encourage households to prepare for disruption linked to severe weather, flooding, and cyber incidents.

Hybrid threats are difficult for governments because they cut across defence, policing, civil contingencies, public communications, infrastructure regulation, and private sector resilience. A hostile actor can combine cyber operations with physical sabotage, information manipulation, legal pressure, economic disruption, and attacks on public trust. The resulting crisis may not look like war in the conventional sense, but it can still test national coordination.

The technology dimension is central to that problem. Public services, utilities, transport systems, finance, healthcare, communications, logistics, and government administration all depend on shared digital infrastructure. If attackers disrupt cloud services, identity platforms, managed service providers, operational technology, or communications networks, the effect can spread across organisations that have never thought of themselves as part of the same risk system.

A national exercise can expose those dependencies in a way that policy documents cannot. It can test whether departments know who is responsible for decisions under pressure, whether public bodies can share information quickly, whether businesses understand escalation routes, and whether public communications can counter false narratives during a technical incident. Those questions are as much about operating models as technology.

The UK’s planning reflects a wider European security environment shaped by Russia’s war in Ukraine and the growth of hostile cyber activity, sabotage concerns, and influence operations across the continent. Defence readiness is now measured through more than military capability. Governments are also being judged on whether public services, infrastructure operators, communications systems, and civilian supply chains can continue during sustained disruption.

Policy pressure around resilience planning is likely to increase for organisations that operate critical services, supply government, manage sensitive systems, or sit inside regulated sectors. Incident response, supplier risk, backup arrangements, and recovery times will attract closer scrutiny. Smaller suppliers may also be pulled into that pressure where their software or managed services support larger organisations.

Insurance and procurement are likely to amplify the effect. If national risk planning treats cyber and digital resilience as civil contingencies, insurers will look more closely at continuity controls, while public sector and regulated buyers will ask tougher questions of vendors. Cybersecurity will still matter, but resilience will be judged by whether essential operations continue when prevention fails.

The hardest part of hybrid preparation is that many of the assets involved are not owned by the state. Telecoms networks, cloud platforms, datacentres, software providers, utilities contractors, transport operators, and media platforms all affect how disruption is absorbed and explained. A credible exercise therefore has to test public private coordination, not simply the ability of departments to convene meetings.

The 2027 drill will not remove the risks it is designed to test. Its usefulness will depend on whether lessons from the exercise change procurement, supplier oversight, local resilience planning, incident communications, and the operating assumptions of organisations whose digital systems now sit inside Britain’s national security perimeter.