MI5 says state-threat caseload quadrupled as Russia turned to proxies
Britain's domestic intelligence service says state threats now consume more resources than during the Cold War. Its annual assessment points to Russian proxy operations and more than 50 arrests linked to Iran-focused investigations, while Moscow and Tehran reject accusations of hostile activity.
MI5 says the balance of its work has shifted decisively. In an annual threat update on 13 October, Director General Ken McCallum said the service was devoting more resources to state threats in 2026 than it did during the Cold War, and that its state-threat caseload had quadrupled over the previous decade.
McCallum also said MI5's counterterrorism and state-threat missions were now roughly equal in operational scale. That is the strategic change behind the headline: state threats now command attention on the same scale as terrorist plotting. Reuters independently reported the speech and its account of the shift.
On Russia, Reuters reported that McCallum called Moscow MI5's foremost state adversary and described Russian activity as operating below the threshold of conventional war. The report said the expulsion of nearly 1,000 suspected Russian intelligence officers from European countries had weakened the Kremlin's traditional espionage footprint, while MI5 assessed that Russia was increasingly relying on criminals and other proxies. Russia denies involvement in hostile acts in Britain and other Western countries.
On Iran, MI5's published speech said its Iran-linked operations had led to more than 50 arrests in Britain during the previous 12 months. McCallum said Iranian ambitions had expanded toward harder targets, including military sites. Reuters and the Associated Press reported the operational claims. Both recorded Iran's rejection of British accusations, and AP reported Tehran's demand for evidence. Arrests and disrupted operations do not by themselves establish that every underlying allegation is true.
Europe's mass expulsions weakened Russia's traditional intelligence footprint but did not end the activity alleged by MI5; the service says criminals and other proxies increasingly filled the gap. MI5 has not published the underlying series for its ten-year caseload comparison or the case status of each Iran-linked arrest. Those omissions, and the Russian and Iranian denials, limit what can be concluded from the public account.
MI5 did not publish its underlying caseload methodology, resource comparison or the case status of each Iran-linked arrest. Russia and Iran deny hostile activity attributed to them. The article describes the agency's public assessment and reported official actions, not proof of every underlying allegation.
Corrections & updates
21 Oct 2026 Expanded the original brief with MI5's operational scale, separate Russia and Iran findings, Reuters' independent reporting and denials, explicit evidentiary limits, and a licensed portrait of the named speaker.
21 Oct 2026 Removed internal newsroom-process language and repeated qualifications, consolidated the evidentiary limits into one concise reader-facing paragraph, and preserved all sourcing, denials and canonical identity.