The planned 2027 exercise shows Britain moving hybrid threats from intelligence warnings into whole-of-government resilience planning.

Britain is preparing its largest home-defence exercise in decades, a 2027 test intended to examine how government, local authorities, emergency services and critical-infrastructure operators would respond to cyberattack, sabotage, disinformation and disruption to essential services.

The announcement came as ministers updated the United Kingdom’s national risk planning. The Guardian reported that the exercise will involve hundreds of officials wargaming Britain’s preparedness for hybrid attacks, alongside a public awareness campaign encouraging households to make practical preparations for severe weather, cyber disruption and interruptions to water, power, phone signal or local shops.

The exercise is significant because it treats homeland resilience as part of national defence rather than as a separate civil-contingencies issue. Hybrid attack scenarios can combine cyber intrusion, physical sabotage, disinformation and pressure on public services. A hostile actor does not need to defeat the armed forces to create strategic effect if it can disrupt energy distribution, water systems, transport, communications or public confidence.

The updated risk picture reportedly adds new crisis scenarios including cyberattacks on data infrastructure, water infrastructure and police systems, a digital-resilience failure based on the 2024 CrowdStrike outage, and foreign interference in democratic processes. That selection reflects how the threat has changed. The most damaging disruption may not come from a single spectacular attack, but from several simultaneous pressures that overwhelm normal response structures.

The 2027 date gives departments and local resilience forums time to build scenarios, identify legal powers, map dependencies and test communication procedures. The exercise is expected to involve central government, defence and security bodies, emergency planners, critical-infrastructure operators and local authorities. The sectors most likely to be tested include power, water, telecommunications, transport, data infrastructure and policing, because those are the systems whose failure can cascade quickly into public order and economic disruption.

The NATO context is also explicit. Ministers want Britain to align more closely with allies that have moved faster on national preparedness since Russia’s full-scale invasion of Ukraine. Nordic and Baltic states have put stronger emphasis on civil defence, public guidance and stockpiling. Britain is now trying to close a planning gap between overseas military commitments and domestic resilience.

Russia is the central reference point, but not the only one. British cyber officials have repeatedly warned that hostile states and criminal groups are targeting critical infrastructure. Associated Press reported earlier this year that the National Cyber Security Centre identified Russia, Iran and China as sources of the most serious cyber threats to the UK. Those warnings make the home-defence exercise a practical test of assumptions rather than a symbolic drill.

Defence Matters has previously covered Europe’s growing concern over Russian cyber networks and critical-infrastructure targeting. The British exercise fits that pattern: governments are shifting from attributing hostile activity after the fact to rehearsing how systems would continue operating during an attack.

The most difficult part will be coordination. Cyber agencies can advise on network defence, police can manage public order, local authorities can coordinate community response, and infrastructure companies can restore services. But hybrid attacks are designed to blur those boundaries. A cyber incident at a water company could become a public-health issue, a communications failure, a policing problem and a disinformation opportunity within hours.

Public messaging is another test. Ministers are urging people to take small steps, such as preparing for temporary disruption to basic services. That must be done without creating panic or implying that households can replace state preparedness. Civil resilience works only if public guidance, corporate contingency planning and government response capacity reinforce one another.

The 2027 exercise will not prove that Britain is ready for every scenario. It should reveal where assumptions fail: who has authority, which systems depend on the same suppliers, how information moves, and whether the public receives clear advice during a fast-moving crisis. In that sense, the value of the exercise will lie less in a polished outcome than in the weaknesses it exposes before a real adversary can exploit them.