Critical National Infrastructure
Design Basis Threat and the Threshold Gap
September 2026
By Stephen Hermanson
Introduction
MI5’s Director General has issued a rare public “call to arms,” asking government, business and academia to treat national security as a shared endeavour. It’s hard to disagree in principle. However, critical infrastructure operators already work to a formal ceiling on what they’re expected to withstand alone — the nuclear sector’s “Design Basis Threat” concept, now used more broadly. Below that ceiling, the operator’s problem. Above it, the State’s. What happens in between, where nation-state-linked attacks are already landing, is a potential gap that deserves more attention. This blog looks at where that gap sits and why closing it will take more than another round of compliance legislation.
National Security as a Shared Challenge
The head of MI5 (the UK’s domestic intelligence agency, otherwise known as the Security Service) wrote: “… government, business, academia, and the public must treat national security not as the specialist concern of a handful of agencies, but as a shared national endeavour. Contending with rising State-backed aggression — whether sabotage subcontracted to criminals, or covert interference in our democracy, or destructive cyber-attacks on power stations — demands new laws as well as new tradecraft.”
He continued: “In 2026, unlike 2001, many of the assets, systems and services under threat sit in private sector hands. This means many of the most critical decisions will be taken not in COBR (the Cabinet Office Briefing Rooms — a term adopted for the UK’s highest crisis and incident-management co-ordinating council) but in boardrooms. We need a new team of teams, preserving an open economy but cooperating across government, industry and academia, to close vulnerabilities and enable swift coherent action when crises hit.”
Design Basis Threat and the Threshold Gap
Design Basis Threat (DBT) is a formal description of the capabilities and attributes of potential adversaries (both external attackers and insiders) that a private critical national infrastructure (CNI) operator must be able to withstand.
CNI operators are defining their security objectives, strategies for implementation and investment requirements based on a perceived threshold of threat that private sector organisations would be reasonably expected to withstand (spanning identify, deter, respond and recover). This threshold is typically considered to sit below the level of sophisticated State actors, who are considered to possess resources and capabilities that far outmatch any defences that private operators could either reasonably afford to maintain or bring to bear.
In other words, private sector CNI is saying that it will prepare and respond to threats according to the capabilities that a private sector commercial operator could be reasonably expected to have and operate. For example, private organisations do not have law enforcement or other active defence mandates to collect intelligence and take courses of action that encroach on or compete with the remits of law enforcement, armed services or security agencies. Private organisations, for example, don’t operate armies, navies or foreign intelligence services. This level of capability is reserved for the State and when States deploy this level of capability against adversaries, the expectation is that the targeted State will respond.
The latest call to action by MI5 (Ken McCallum) is that States and private sector CNI should respond simultaneously and in partnership. This seems perfectly reasonable and familiar to security professionals across the private and public sectors that already collaborate in many ways. Nonetheless, there’s still a sense that the gap between States intervening and the point at which private operators decide that States should intervene, leaves room for misunderstanding. It appears quite possible that Boardrooms will assume (and expect) that Governments will intervene (and know when to intervene) at the precise point at which the Boardroom has decided risk mitigation and risk tolerance have exceeded any further investments the business could be reasonably expected to make — especially where fiduciary duty and returns on investment no longer support shareholder interests.
On the other hand, States are asking private operators to do more (and actively bridge the gap before State intervention is obvious). States are already setting rigorous security obligations for CNI operators. The effect, it seems, is for CNI operators to double down on compliance regimes that respond to the letter of the law or regulation, but not necessarily the spirit. Laws and regulations will typically require operators to “do everything necessary and proportionate to protect essential operations from state of the art threats”, but the interpretations of necessary, proportionate and state of the art leave room for debate. It’s accepted that CNI operators must be capable of understanding the specific threats to their operations and putting in place the basic hygiene measures to protect themselves from commodity and known attack vectors. It’s also accepted that States step in where it’s obvious that the threshold of war has been met.
The area around the threshold, when it’s not as obvious either way, is where CNI operators and States may struggle to respond effectively. At this level, operators are at the limit of their capabilities and fall back on the Design Basis Threat paradigm, and States are only just noticing their threshold for intervention. At this level, States are not likely or able to understand the specific nuances and characteristics of the operator’s environment or risk profile. At this level, the operator has no protocol for introducing State intervention into their response.
Instead, States seek to close the gap by introducing more security obligations through legislation, regulation, guidelines and standards. Operators in turn face more compliance and liability risks which consumes huge amounts of resources in governance and checking as opposed to implementing and protecting. Sprawling and complex corporate compliance regimes are trying to mitigate compliance risk — including the risk of misjudging the DBT threshold. Audits, assurance systems and reports are supposed to convince governments and regulators that somehow the Board has understood the correct DBT threshold and found the right level of investment to bridge the gap and provide a seamless hand-over when government has to step in to pick up the battle. If you’re thinking that this seems unlikely, then you’re probably correct.
So, this latest call by MI5 seems to be another reminder that the DBT gap remains. The State’s security and defence apparatus is already under intense pressure and scrutiny. The politics of defence spending are on display in the mainstream media and politicians are wrestling with the challenges of finding the money for more security and defence capability. What’s not always on display is the discussion in Boardrooms about the affordability of security investments. The private sector is already making huge investments, driven by their own risk calculus and the added compliance burden. What’s not clear is whether Boards are minded to go further, and make more investments beyond the commercial business case, and in so doing support the State’s broader security and defence strategy. It’s expensive and the returns are measured at national security and societal levels. It’s probably difficult to put a precise number on the benefits that would be imparted to the private operator for taking the decision to “sponsor” national security goals. ESG reporting might seek to convey the philanthropic corporate contribution to national security and defence, but the practical financial return for shareholders always seems tenuous and difficult to trace.
It seems that MI5 is saying that Boards can and should step a bit further into the DBT gap, but stop short, of course, of setting up private armies, navies and agencies that compete with the State. A bit more from robust corporate profit lines (in addition to taxes and other costs already levied by the State) seems necessary and possible (depending on the level of avarice that shareholders display). However, such extended contribution can easily be subsumed by an ever-growing compliance regime that begins to crumble under its own weight and complexity. Any additional corporate “contribution” should be ringfenced to look at how CNI operators and governments can properly agree on a system for partnership, collaboration and handover when threats and incidents approach the threshold area. The exam question that surfaces is what this operating model looks like and how it is sustained in such a way that Design Basis Threat caters for the full threat spectrum and is not simply a point at which private operators relinquish responsibility, but instead helps to mobilise State capabilities.
Case Study
In August 2025, Jaguar Land Rover (JLR) was hit by a cyberattack that eventually forced a total production shutdown, described as the most economically damaging cyberattack in British corporate history, with analysis by the Cyber Monitoring Centre (an independent, industry-funded body that assesses systemic cyber events) putting the cost to the wider economy at around £1.9 billion and JLR’s own losses running at roughly £50 million a week. A group calling itself “Scattered Lapsus$ Hunters” claimed responsibility, but investigators subsequently assessed the attack as the work of Russian-linked actors, with the question of Kremlin direction or tacit backing still unresolved. This offers a good example of the attribution ambiguity that sits at the DBT “threshold” (is this criminal, or State-backed aggression by another name?).
The State response wasn’t an explicit COBR-led national security intervention. Instead, the intervention came as a £1.5 billion government-backed loan guarantee to keep JLR’s supply chain solvent. This economic instrument arrived well after the fact, once the Board’s own resources and the commercial case for further private investment had been exhausted. This portrays the “gap” in action — a private operator absorbing a State-linked attack until it no longer could. There was no defined protocol for when or how the State would step in, and the eventual intervention came through the Treasury rather than through any framework built for the purpose. JLR is not technically classified as CNI, which reveals the threshold problem isn’t confined to CNI sectors, but extends to nationally significant private industry more broadly.
State-backed aggression against CNI-adjacent targets is likely the norm rather than the exception. Richard Horne, CEO of the UK National Cyber Security Centre, disclosed in his annual RUSI lecture (17 June 2026) that the NCSC assessed state actors as likely responsible for roughly 75% of the ~200 “nationally significant” attacks it responded to over the preceding twelve months. This reinforces the framing from Ken McCallum at MI5.
Recommendation
A possible operating model and response to the earlier exam question that appears to have strong potential is an initiative that UK lead government departments are already exploring.
Lead departments are using their convening power to bring government and industry parties together (including across national boundaries) for the precise purpose of finding a pragmatic solution to managing collaboration and handover in the DBT threshold phase.
The concept manifests as a “Joint Operational Plan” for the express purpose of strengthening situational awareness and providing trusted channels for communications that don’t get hamstrung by the complex bureaucracies and protocols of government and industry crisis management and response.
This informal and operational layer captures the moment at which security professionals are sensing a shift and noticing the need for extended collaboration (or at least posing early questions). It provides the space for trusted relationships to form and conversations to test the ground. These channels could be very useful at steering parties to look at the right areas and seeding the ground for structured collaboration.
References
- MI5 chief warns Britain faces greater danger now than on 9/11, The Independent, 11 September 2026, independent.co.uk
- NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK’s critical systems, NCSC, 17 June 2026, ncsc.gov.uk
- International Atomic Energy Agency, National Nuclear Security Threat Assessment, Design Basis Threats and Representative Threat Statements, IAEA Nuclear Security Series No. 10-G (Rev. 1), IAEA, Vienna (2021)
- UK Export Finance (UKEF) support for Jaguar Land Rover (JLR), Department for Business & Trade, 26 September 2025, gov.uk
- UK Export Finance Contingent Liability: Jaguar Land Rover, Hansard, 29 October 2025, hansard.parliament.uk
- Statement on the Jaguar Land Rover Cyber Incident, Cyber Monitoring Centre, October 2025, cybermonitoringcentre.com
Leave a Reply