UK Terrorism Outlook: Threat Landscape & Risk Assessment

The UK National Terrorism Threat Level was raised to SEVERE on 30 April 2026.

The primary driver for the SEVERE threat level is a clear trend of attacks targeting Jewish communities, punctuated by an antisemitic stabbing in north London on 29 April 2026.

May 2026 assessments indicate that the severe designation — meaning an attack is highly likely within six months — is sustained by the increasing intent of both Islamist and right-wing extremists to target Jewish-linked locations.

The UK's SEVERE terrorism threat level is primarily sustained by a persistent trend of antisemitic attacks and the escalating use of local proxies by hostile states like Iran and Russia. Given the high frequency of recent incidents and the ongoing conflict in the Middle East, the SEVERE rating is likely to be maintained over the next 6–12 months.

Anticipated form & tactics

The current terror threat to the United Kingdom has been divided into three threat streams:

1. Islamist inspired ideologies, which are increasingly targeting Jewish, Israeli, and US-linked interests.
2. Right wing ideologies, whose actors commonly target religious minorities, women, and members of the LGBTQ+ community, with their threat characterized by stabbings rather than larger, organized plots.
3. Northern Ireland-related terrorism (NIRT), characterized by a persistent, low-level threat from paramilitary groups such as the New IRA.

The most likely threat stream in the near term involves lone actors or small, unaffiliated groups utilizing unsophisticated tactics such as bladed weapons or arson. In Northern Ireland, recent incidents demonstrate an intent to target police and public authorities.

Large-scale gatherings, including sporting events, cultural celebrations, and high-profile political conferences, historically attract opportunistic and ideologically motivated actors. Lone-actor attacks at crowded public venues remain the most likely near-term threat vector.

UK Terrorism Threat Outlook: Domestic and International Drivers

Overview

The UK terrorism threat environment over the next 12 months will be shaped by a convergence of state-sponsored hybrid warfare and decentralized extremist activity. Internationally, the ongoing conflict between the US, Israel, and Iran has significantly increased the intent of pro-Iran actors to target UK military, Jewish, and US-linked sites, as noted in March 2026 assessments. Hostile states like Russia and Iran are also expected to continue leveraging criminal proxies for sabotage and conducting advanced cyber operations against critical national infrastructure, as highlighted in the July 2026 National Risk Register updates.

Escalating state-linked proxy and hybrid threats

• Hostile state actors, specifically Iran and Russia, are increasingly utilizing proxies and organized crime groups to conduct kinetic attacks on UK soil.
• Analysts warned in June 2026 that these states outsource activity to hide involvement, with Iran primarily targeting Jewish entities and dissidents, while Russia-linked actors have orchestrated arson attacks, including one on the Prime Minister’s home in May 2025.
• To counter this, the government proposed the National Security (State Threats) Bill in June 2026, which introduces counter-terrorism-style powers to target these less formal proxy groups.
• The UK faces an escalating cyber threat from state-linked advanced persistent threat (APT) groups, with nationally significant incidents more than doubling between 2024 and 2025.
• Russia, Iran, China, and North Korea are identified as primary threats, focusing on espionage and pre-positioning for disruption within critical national infrastructure (CNI).
• In July 2024, the government updated the National Risk Register to include scenarios such as cyber-attacks on water and police systems, reflecting concerns that these digital breaches could result in mass casualties or property damage.

Outlook

• For the remainder of 2026 and into 2027, the United Kingdom faces a critical juncture characterized by relentless targeting of its critical national infrastructure (CNI) by Russia and Iran.
• Analysts assess that three-quarters of cyber incidents affecting UK CNI are now linked to hostile states, with Russia and Iran increasingly pre-positioning within energy, telecommunications, and transport systems for future disruptive operations.
• The rapid advancement of AI-enabled cyber tools by these adversaries is expected to increase the speed and scale of attacks, while the UK’s domestic terror threat remains ‘severe’ as of April 2026.
• Security operators should monitor the implementation of the National Security (State Threats) Bill in July 2026 and the potential designation of the IRGC as key indicators of the government’s response to these evolving proxy and hybrid threats.

Source: AskAnna NLQ output using Control Risks' analysis & high reliability news.

Terrorism at highest threat level in over four years

On 30 April, the UK's Joint Terrorism Analysis Centre (JTAC) raised the national terrorism threat level from SUBSTANTIAL to SEVERE — the second highest on a five-level scale. Current reporting does not indicate the designation is under review.

Primary driver — Islamist-inspired attacks: Threats are concentrated on Jewish targets and state-linked actors. Increasing activity by Iranian and Russian state proxies in the UK means some antisemitic attacks are likely externally facilitated, while others are carried out by self-radicalized individuals.

Secondary driver — Extreme Right-Wing Terrorism (ERWT): Increasingly linked to episodic violent unrest triggered by anti-migration sentiment. Incidents involving migrants or ethnic minorities can trigger immediate, localized riots, as seen in Belfast and Southampton. Civil unrest risk to commercial entities remains LOW, though radical rhetoric from populist parties is likely to fuel further violence.

Northern Ireland-Related Terrorism (NIRT): Small pockets of dissident republican extremism persist, primarily in Northern Ireland. The New IRA continues to conduct low-sophistication attacks targeting non-commercial entities — police stations and residential properties — at a rate of several incidents annually. This threat has significantly decreased in recent decades and is not expected to escalate.

Counter-terrorism arrests over Islamic festival plot indicate persistent right-wing extremist threat.

Overview

The authorities on 13 July arrested 12 people in connection with an alleged right-wing terrorist plot targeting an Islamic event at a country estate in Suffolk (east England). The alleged plot highlights the persistent threat posed by right-wing extremist terrorism in the UK, particularly towards minority ethnic and religious communities. It also reflects the authorities’ generally strong capabilities at foiling planned terrorist attacks. However, the security forces will continue to struggle to disrupt small-scale plots, particularly low-sophistication attacks carried out by lone or few perpetrators. Businesses are unlikely targets for right-wing extremist threat actors, with high-profile faith-based events such as the Suffolk event more likely to be targeted.

Alleged plot and right-wing extremist terrorism threat

• The event, the UK Ijtima, took place at Shrubland Hall near Ipswich with nearly 10,000 attendees. According to Counter Terrorism Policing (CTP), Suffolk Police worked with the event's organizers to close the event earlier than planned, following a suspected terrorism threat made towards the event.
• The alleged plot reflects the persistent threat posed by right-wing extremist terrorism in the UK, particularly directed towards minority ethnic and religious communities. Since 2019, counter-terrorism authorities have stated that the fastest-growing terrorism threat in the UK stems from the far-right, though they have also emphasized that the overall threat from such incidents is "small".

Outlook

• The arrests also reflect the authorities’ generally strong capabilities at disrupting terrorist attacks. However, we maintain our assessment that they will struggle to disrupt smaller-scale, low-sophistication plots and attacks involving individuals or few perpetrators, in comparison to more elaborate plots.
• Most businesses are unlikely targets for right-wing extremist terrorism. Threat actors of this nature are more likely to target religious buildings such as mosques and institutions otherwise perceived to be linked to Islam, or left-wing political organizations.
• Large faith-based events such as the UK Ijtima represent particularly appealing targets to potential perpetrators owing to their high profile. That said, the opportunistic and often improvisational nature of such plots means that sporadic episodes of uncoordinated violence directed in an apparently random manner in public places, including violence against targets perpetrators assess as low-risk, cannot be ruled out.
• Nevertheless, businesses may be targeted over alleged or perceived links to Islam. The most likely threat to business assets and personnel from right-wing extremist terrorism remains incidental.

Source: Control Risks' analysis.

Overview: A Westminster perimeter represents London's primary elevated-monitoring zone under the current SEVERE designation — capturing the majority of verified unrest and terrorism events recorded between January 2024 and July 2026.

The Westminster perimeter covers approximately 2.5km radius from Parliament Square, encompassing the UK's primary protest corridors: Parliament Square, Whitehall, Trafalgar Square, Speaker's Corner (Hyde Park), and Oxford Street, as well as key diplomatic flashpoints including the Israeli Embassy in Kensington.

The City of London and Canary Wharf financial districts warrant secondary monitoring given recurring direct action by environmental and pro-Palestine activists against banking and energy sector assets.

1. Islamist Extremism: There were 3 London terrorism events recorded (Jan 2024–Jul 2026), all knife attacks that targeted Jewish community members or Israeli-linked interests. Lone-actor knife attacks in open, crowded areas and religious community sites pose a HIGH near-term terrorism risk in London.
2. Extreme Right-Wing (ERWT): ERW terrorism typically involves low-sophistication attacks; however, violent anti-immigration unrest could escalate if protesters shift to systematic attacks on businesses with ties to immigrant communities. In London, 12 right-wing extremist events were verified from Jan 2024–Jul 2026, including a Tommy Robinson-led march in Whitehall that drew about 150,000 attendees in September 2025, with clashes that left 26 police officers injured.

Attack triggers SEVERE designation: Golders Green, 29 April 2026.

Overview

On 29 April 2026, a 46-year-old British national born in Somalia attacked two Jewish men with a knife outside a shop and a synagogue in Golders Green, London. The attack was declared a terrorist incident shortly after the suspect attempted to attack police officers. According to reports, the suspect had a history of mental health issues and serious violence. The Golders Green stabbing is characterized as part of a broader trend targeting Jewish communities, which has seen reported incidents more than double since October 2023.

Threat analysis

• This stabbing marked a shift in tactics, as it was the first in a recent series of antisemitic incidents in north London to result in physical injuries, whereas arson had previously been the primary tactic.
• While a group with apparent Iranian regime links, Harakat Ashab Al-Yamin Al-Islamia, initially claimed responsibility for the attack, analysts have noted that this may have been an opportunistic bid to increase its profile.
• The UK has experienced more antisemitic incidents than other European countries recently, which analyst assessments attribute to the UK having Europe's second-largest Jewish population and a high concentration of both Jewish and Muslim residents in London.
• This environment allows Iran-linked groups to recruit local proxies and lowers constraints on surveillance due to numerous, geographically concentrated targets.

Outlook

• Although the government announced additional funding to protect Jewish communities, assessments warn that increased police patrols will have a limited impact on preventing spontaneous, unsophisticated attacks like stabbing or arson.
• In April 2026, analysts assessed that further attacks against Jewish personnel and retail outlets are highly likely, particularly in London and Manchester.
• While security services maintain strong capabilities against complex plots involving explosives, lone-actor attacks using easy-to-obtain weapons remain significantly harder to thwart.

Source: AskAnna NLQ output using Control Risks' analysis & high reliability news.

Dissident Irish republican groups were largely dismantled in the early 2000s but have resumed their activities since 2008. Their activities remain overwhelmingly concentrated in Northern Ireland, and we assess that such groups lack the resources to re-launch a campaign in the rest of the UK.

The current outlook for Northern Ireland-related terrorism (NIRT) is characterized by a persistent but low-level threat from dissident republican groups, primarily the New IRA. Recent incidents in March and April 2026 demonstrate a continued intent to target police and public authorities.

Risk profile

• The security risk rating for Northern Ireland was lowered from Medium to Low in November 2025, reflecting a steady decline in paramilitary activity since 2020, which analysts attribute to greater post-Brexit stability and generational shifts away from the high-activity periods of the late 20th century.
• Recent June 2026 anti-migration riots in Belfast indicate a growing intersection between hardline loyalist groups and far-right sentiment, posing new risks for civil unrest in urban centers.

Dominant threat types

• Dissident Irish republican terrorist groups carry out occasional bomb attacks. However, these normally target the military and the police. Attacks within Belfast city center are rare.
• The New IRA has access to high-caliber weapons and explosive devices sourced predominantly from leftover Provisional IRA supplies but likely also from other terrorist groups.
• Perpetrators are unlikely to target businesses with explosive devices. However, the hijacking of delivery drivers' vans to transport bombs in recent incidents means that businesses in sectors such as freight and logistics face a heightened threat of dissidents targeting their personnel.
• Dissident republicans have adopted 'proxy bomb' tactics, such as incidents in March and April 2026, where delivery drivers were forced at gunpoint to transport IEDs to police stations.

Operational notes

• Escalation in Northern Ireland remains linked to external factors, such as deteriorating relations between Northern Ireland and Great Britain or major police scandals, which could drive a rise in dissident attacks.
• Travelers should anticipate localized disruptions near migrant facilities and urban centers in Belfast, as episodic violent unrest is likely to continue through mid-2026.
• Major scandal with the PSNI would serve as a primary trigger for an escalation in paramilitary violence.

Overview

Dissident republican activity in Northern Ireland is expected to continue at a low level through 2027, characterized by several low-sophistication attacks annually using pipe bombs and petrol bombs, April 2026 analyst assessments indicate.

The New IRA remains the most significant threat, recently employing "proxy bomb" tactics against police stations in Lurgan and Dunmurry by hijacking delivery drivers. While the overall security risk was lowered to LOW in late 2025 due to declining paramilitary activity, analysts warn that a major police scandal or a sharp deterioration in Northern Ireland-Great Britain relations could trigger an escalation. Although a unification referendum is highly unlikely before 2027, July 2026 news reporting highlights that Sinn Féin is actively pushing legislation for unity planning, a topic that historically serves as a primary trigger for increased paramilitary violence. Political stability is expected to hold through the May 2027 Assembly elections, though personal relations between the First and Deputy First Ministers will likely fray during the campaign, potentially resurfacing sovereignty grievances that dissident groups exploit.

Political and constitutional triggers for escalation

• Analysts warn that a significant deterioration in relations between Northern Ireland and Great Britain or a major police scandal would likely drive an increase in attacks. Furthermore, increased calls for Irish unification serve as a primary trigger for paramilitary violence.
• While the current stable power-sharing arrangement is expected to persist beyond the May 2027 Assembly election, the lead-up to the polls may see moderately frayed relations between First Minister Michelle O’Neill and Deputy First Minister Emma Little-Pengelly, potentially resurfacing grievances around sovereignty.

Security service countermeasures

• Security services have shifted toward "administrative strangulation" tactics, such as blocking debit cards and using targeted surveillance to disrupt paramilitary lives without direct force.
• Despite these efforts, the evolving structures and offshoot groups, such as those emerging from Óglaigh na hÉireann (ONH) in late 2024, continue to complicate prevention efforts.
• The New IRA remains a top priority for the Police Service of Northern Ireland (PSNI) as it continues to issue threats against "state collaborators."

Source: Control Risks' analysis.