decrypted · 16 july 2026 · vulnerabilities and patching · uk policy and law · ai and llm security · digital sovereignty

The National Risk Register grows seven cyber scenarios, one borrowed from CrowdStrike

For a document that gets quietly refreshed every couple of years, the National Risk Register doesn't usually make headlines. This week's edition should. The Cabinet Office has added seven new entries to its assessment of the risks Britain actually faces, and four of them are cyber: attacks on datacentres, on water infrastructure, on police systems, and a category the government calls "digital resilience failure," modelled explicitly on the CrowdStrike outage of 2024. It landed in the same week that UK financial regulators started directly overseeing the four cloud providers much of the country already depends on, and that a critical, unauthenticated Oracle flaw joined the US government's list of vulnerabilities under active attack. None of these things happened because of each other. All of them are the same story: Britain still doesn't fully control the systems it relies on, and is only now writing that down properly.

What the register actually says

The National Risk Register 2026, published by the Cabinet Office on 14 July, is the public face of the government's National Security Risk Assessment. Its new cyber scenarios are specific. A "disruptive and sophisticated" attack on one or more UK colocation datacentres, exfiltrating customer data and intellectual property. Malicious infiltration of a water company's operational technology, deploying destructive malware and losing visibility of the network entirely, a scenario the register says could take months to recover from and cause real casualties. A cyber attack on policing infrastructure, compromising live investigations and reducing frontline access to intelligence. And the CrowdStrike-inspired scenario: a single bad software update, pushed everywhere at once, taking down communications, transport, borders and payments simultaneously. The government rates each as "highly unlikely" in any given year, five to twenty-five per cent, but scores the worst-case impact in the hundreds of casualties and hundreds of millions of pounds. Chief Secretary Darren Jones was blunt about why AI made the list too: it "offers new ways for criminals to carry out cyber-attacks against us, as well as offering huge opportunities for our economy and security."

The Secure by Design lesson

A risk register doesn't stop anything. What stops the CrowdStrike scenario recurring is staged rollout: nobody pushes a kernel-level update to every machine on earth in one go, they push it to one per cent, watch, then the next ten. What stops the water scenario is keeping operational technology on a different network to the office IT that gets phished, so a compromised inbox can't reach a treatment plant's control systems. What stops the datacentre scenario is not concentrating an entire sector's infrastructure, or its intellectual property, behind one provider's front door. None of this is new advice. What's new is a government document formally conceding that these are now realistic enough to plan for, rather than theoretical. UK organisations reading it shouldn't wait for a ministerial campaign to act on any of it.

Also this week

The cloud gets a regulator. From 13 July, HM Treasury's designation of AWS EMEA SARL, Microsoft Ireland Operations, Google Cloud EMEA and Oracle Corporation UK as Critical Third Parties took effect, putting them under joint direct oversight from the Bank of England, the PRA and the FCA for the financial services they underpin. The regime requires resilience testing, incident reporting and self-assessment, but Treasury has been explicit that it doesn't move accountability off the firms that use these providers. Worth noting: two of the four are structured through Irish and Luxembourg entities, a reminder that "the cloud" has a physical address, and that knowing where your data actually sits is still a design decision, not an assumption.

Oracle's unauthenticated flaw joins the exploited list. CVE-2026-46817, a CVSS 9.8 privilege management flaw in Oracle Payments within E-Business Suite (versions 12.2.3 to 12.2.15), lets an attacker with nothing more than HTTP access take over a vulnerable instance. Oracle patched it in May; exploitation began around 30 June, and CISA added it to its Known Exploited Vulnerabilities catalogue on 15 July. No confirmed link to Cl0p's earlier EBS campaign yet, but the pattern is the same one that hurt organisations last year: patched doesn't mean safe once a flaw is public.

AI stops assisting and starts operating. Check Point's AI Security Report 2026, published 14 July, documents intrusions where AI ran the entire attack chain with minimal human direction, including one case where a single operator built an 88,000-line command-and-control framework in under a week using an AI coding environment. The report also logs a fivefold rise in malicious prompt-injection payloads between March and May, now approaching one in a hundred observed prompts. It's the same lesson the NCSC gave UK organisations back in the spring for any agentic AI they adopt: least privilege, no long-lived credentials, and secure defaults from day one, not bolted on afterwards.

Sources

Questions about what Secure by Design means for your organisation? Get in touch.

The National Risk Register grows seven cyber scenarios, one borrowed from CrowdStrike

What the register actually says

The Secure by Design lesson

Also this week

Sources

More like this