The spies, the schools and the supply chain: a week in UK cyber

There are weeks when the cyber security news is a list of unrelated incidents, and weeks when, if you stand back far enough, the separate stories turn out to be the same story told in three registers. The past few days in the United Kingdom were the second kind. MI5 took the unusual step of warning British academics directly that their research may have been quietly feeding Chinese intelligence. A respected defence think tank published an analysis arguing that Europe's fragmented technology rules leave its members exposed to the same state through their suppliers. And, almost unnoticed beneath both, the body that regulates England's exams reported that schools are getting measurably better at recovering when something goes wrong. Put the three beside one another and a single thread runs through them, one that matters as much to a small business as to a university or a government. Let me take them in turn and then pull the thread.

MI5's warning to the academics

The most striking story of the week, reported by The Register on 1 October, was a direct warning from the Security Service to more than a hundred UK-linked academics: the research you have been doing, funded through channels you may not have examined closely, may have assisted the espionage work of China's Ministry of State Security. At the centre of it is an organisation called the China General Technology Research Institute, which MI5 assesses as having very strong but deliberately obscured ties to the MSS. Money flowed from it into British university research on artificial intelligence, cyber security, covert communications and steganography, the science of hiding messages inside other data, and the people doing that research mostly had no idea whose ultimate purpose they were serving.

What makes this more than a national-security curiosity is the mechanism, because it is the same mechanism that turns up everywhere else in this article. The problem was not that a hundred academics were disloyal. It was that the true origin and beneficiary of their funding was hidden behind an intermediary with an innocuous name, and nobody had done the work of asking who, ultimately, was on the other end of the arrangement. MI5's practical advice to those affected is telling in its ordinariness: review your current and planned collaborations, establish who actually funds the work, make sure no further benefit flows to the MSS, and take independent legal advice, because the National Security Act 2023 now makes assisting a foreign intelligence service, or accepting a benefit from one, a criminal matter. Strip away the espionage drama and the instruction is one every business has heard from us about its suppliers: know who you are actually dealing with.

RUSI on Europe's exposure through its vendors

The second story, also covered on 1 October, came from the Royal United Services Institute, which looked at how European states buy their technology and concluded that the patchwork is itself the vulnerability. Different member states take sharply different approaches to Chinese equipment in critical infrastructure, and the inconsistency leaves the whole bloc exposed. The figures RUSI marshals make the point: in 2024 Germany still had around 59 per cent Chinese equipment in its 5G radio access network, Spain around 32 per cent, while the United Kingdom is on a path to remove Chinese technology from its networks by the end of 2027. Spain's arrangement to have Huawei store judicial wiretap data drew particular scrutiny.

RUSI's sharpest observation is not about any single vendor but about the structure behind them. Because the Chinese state can compel its companies to cooperate, the think tank argues, it effectively "converts China's private sector security research into a state-controlled pipeline that grants intelligence services privileged early access to exploitable vulnerabilities." That is a dense sentence worth unpacking, because it describes a supply chain risk of a particularly modern kind: the danger is not only that a vendor's product might contain a flaw, but that the state standing behind the vendor may learn of that flaw first and keep the knowledge. RUSI's recommendations are about coherence — a shared definition of what a high-risk vendor actually is, a common risk-assessment framework, procurement treated as strategy rather than paperwork. Once again, underneath the geopolitics, the lesson is the unglamorous one: you cannot manage a supplier risk you have not consistently defined and examined.

The quiet good news from England's schools

The third story is the one that did not make the front pages, and it is the one I would most like business owners to read, because it is good news that was earned rather than hoped for. Drawing on an Ofqual survey of 3,775 secondary teachers conducted in July, The Register reported that the share of schools experiencing a cyber incident has fallen for a second year, to 27 per cent from 29 per cent the year before and 34 per cent the year before that. More telling than the fall in incidents is the improvement in recovery: 66 per cent of affected schools said they recovered immediately, up from 55 per cent a year earlier, and the proportion suffering "critical damage" dropped from 10 per cent to 7 per cent. Ransomware touched only 2 per cent of respondents. Phishing remained the most common problem, and staff data the most commonly exposed, with pupil data involved in 13 per cent of incidents.

Schools are not awash with money or specialists, which is exactly why their progress is instructive. When the survey asked what they had changed, the schools that could answer pointed to the least glamorous measures imaginable: introducing a cyber security policy, testing their backups, and writing or updating an incident response plan. Those three things, and not any clever technology, are what turned a bad day from a term-ending catastrophe into something recovered from by the afternoon. It is worth being honest about the other half of the data, too, because it is where the work remains: around a third of staff had received no training or were unsure, slightly worse than the year before, and of those who were trained, roughly two-thirds made no change to their behaviour as a result. Training that changes nothing is a cost, not a control. But the headline stands, and it is a hopeful one: an under-resourced sector measurably improved its resilience by doing the ordinary things consistently.

A fair caveat, since we care about being straight with numbers: the Ofqual figure of 27 per cent sits well below the 73 per cent of secondary schools that the government's own Cyber Security Breaches Survey, published in April, found had identified a breach or attempted attack. The two are measuring different things — attempted attacks against confirmed incidents, different samples, different questions — and the gap is a useful reminder to read the methodology before celebrating or despairing at any single statistic. The direction of travel in the Ofqual data, measured the same way across three years, is the part that matters.

The thread

Set the three stories side by side and the common element is not China, though China runs through two of them. It is this: in every case the risk arrived through a relationship that had not been examined, and the defence in every case was the same set of ordinary, repeatable habits rather than any sophisticated tool.

The academics were exposed because nobody traced the funding to its source. Europe is exposed because its members never agreed on what a risky supplier is or looked at them the same way. The schools that came through well did so because they had written down who does what in a crisis, kept backups they had actually tested, and had a plan on paper before they needed it. The adversary at the top end is now frequently a state, or a company a state can lean on, and the target is increasingly the supply chain and the knowledge base rather than the front door, because that is where the examination is weakest. This is the same point we have made all autumn, from the City Relay breach, where a reporting tool had quietly been given the keys to everything, to the DriveWealth data taken from a supplier a firm had already stopped using. The scale changes from a nursery to a FTSE company to a nation; the discipline does not.

There is a forward-looking version of the same worry, and it surfaced this week in the industry coverage rather than the headlines. Microsoft and others have been warning that artificial intelligence is tightening the links between previously separate problems — identities, cloud services and software supply chains — and that a new category of participant, the machine or agent identity, now needs the same careful access control a human account does. The practical implication is continuous with everything above: the number of relationships your organisation holds, with vendors, with contractors, with software agents acting on your behalf, is growing, and each one is a door whose other side you are responsible for knowing. The organisations that will be fine are not the ones with no such doors. They are the ones that keep the list, check who is on the other side, and have practised what to do when one is forced.

What to take from the week

For a university or research body, the immediate action is the one MI5 named: trace your funding and your collaborations to their true source, and do not assume an intermediary's respectable name reflects its ultimate purpose. For anyone buying technology, the RUSI lesson is to define, in writing, what makes a supplier high-risk for you, and to apply that test consistently rather than deal by deal. And for every organisation, large or small, the schools have handed us the cheapest and most durable lesson of the three: the policy, the tested backup and the written incident plan are what turn an incident into an inconvenience, and they are within reach of an institution with no budget and no specialist. If you have been meaning to get to those, this is the week the evidence arrived that they work.

We set out the ground-level version of this in our guide to the basic cyber skills every UK business owner should have, and the supplier-review habit in our supply chain due diligence guide. Neither is difficult. Both are, in the end, the same instruction the Security Service gave a hundred academics this week: know who you are dealing with, write it down, and check it more than once.

Frequently asked questions

Who is affected by the MI5 warning about Chinese-funded research? MI5 warned more than a hundred UK-linked academics whose research — in artificial intelligence, cyber security, covert communications and steganography — was funded, through obscured channels, by the China General Technology Research Institute, which the Service links to China's Ministry of State Security. Affected researchers are advised to establish who ultimately funds their work, review collaborations and take independent legal advice, because the National Security Act 2023 makes assisting or accepting benefit from a foreign intelligence service a criminal matter.

Does the RUSI report mean Chinese technology is banned in the UK? No. The UK is on a path to remove Chinese equipment from its telecoms networks by the end of 2027, but RUSI's argument is broader and directed at Europe: that inconsistent rules between countries create collective exposure, and that what is needed is a shared definition of a high-risk vendor and a common way of assessing them, rather than each state deciding alone.

Are England's schools now safe from cyber attacks? Safer, not safe. The Ofqual survey shows incidents falling for a second year and recovery improving markedly, which is genuine progress driven by basic measures — policies, tested backups and incident plans. But a third of staff remain untrained or unsure, and most trained staff changed nothing, so the human side lags the procedural one. The figures also differ from other surveys that measure attempted attacks rather than confirmed incidents.

What is the single lesson a business should take from all this? Know who you are dealing with, and examine the relationship rather than trusting the label. Most of the week's risks arrived through a connection — a funder, a vendor, a supplier — whose true nature had not been checked. Keeping a register of those relationships, defining which are high-risk, and rehearsing what you would do if one went wrong is the common defence at every scale.

Where should a smaller organisation start? With the three things the schools credited for their faster recovery: a written security policy, backups you have actually tested by restoring from them, and an incident response plan on paper. Our basic cyber skills guide walks through these and the rest of the essentials, most of which are free and need no specialist.