In his annual threat update on 13 October 2026, MI5 Director General Sir Ken McCallum warned UK tech start-ups to "expect to be spied on by foreign actors", and said MI5's state-threat caseload has quadrupled over the past decade. As reported by City AM, he also said MI5 now devotes more resources to countering hostile states than during the Cold War, and announced a new AI Threat Assessment Centre.
The message for business is direct: companies can no longer assume that state espionage is a problem for governments and defence contractors only.
What MI5 said
According to City AM's report of the speech at Thames House:
- State threats are rising sharply. MI5's state-threat caseload has quadrupled in ten years.
- Start-ups and tech firms are targets. Firms working on valuable technology should expect foreign intelligence services to try to obtain it, and should fix their cyber security.
- Critical infrastructure is exposed. He pointed to a destructive cyber attack on a UK energy generator, and warned that financial systems, energy grids and supply chains are vulnerable.
- A new AI Threat Assessment Centre. MI5's AITAC brings together the AI Security Institute, the National Crime Agency and the National Cyber Security Centre.
The speech followed MI5's first-ever Security Service Espionage Alert, published on 30 September 2026. It warned UK universities about a Chinese research funder that MI5 says has very strong ties to China's Ministry of State Security, and said about 100 UK-linked academics had contributed to projects it funded. As law firm Ashurst Perkins Coie notes, the National Security Act 2023 applies to businesses as well as universities, and companies in sensitive sectors should review their exposure.
Espionage is not only a cyber problem
Much of the public discussion focuses on hacking, and rightly so. But intelligence services and corporate spies also use physical and technical methods that no firewall stops:
- People with access, such as employees, contractors and visitors, recruited or placed to collect information
- Listening devices and cameras in boardrooms, executive offices, hotel suites and vehicles
- Trackers on executives' cars to map meetings, partners and routines
- Compromised equipment, such as conference systems, chargers and gifts
Two cases this year show how real this is. In October, US prosecutors charged an engineer with hiding a recording device in an executive conference room at OpenAI (our summary). In June, a hidden camera was found in a ceiling panel in UK government offices in Westminster (our summary).
What boards and executives should do
- Identify your crown jewels. Which discussions, documents and people would a competitor or foreign state most want access to: R&D, transactions, pricing, negotiations, government contracts?
- Protect the rooms where they are discussed. Sweep boardrooms and executive offices on a schedule and before high-value meetings. See office and boardroom bug sweeps.
- Protect executives when they travel. Hotel suites, meeting rooms and vehicles abroad are easier to target than your own building. See hotel suite sweeps.
- Check vehicles. A GPS tracker shows who your executives meet. See vehicle tracker checks.
- Make it routine. A recurring TSCM programme gives you a documented baseline and a record of the steps you have taken, which you can show to your board, auditors or insurers.
- Follow official guidance. The National Protective Security Authority (NPSA) and the National Cyber Security Centre publish free advice for businesses.
How Bureau Securitas can help
Bureau Securitas provides technical surveillance countermeasures (TSCM) across London and every EU capital, delivered by two-person teams with UK military and government backgrounds. Planned sweeps typically cost €2,500–5,000 per team-day plus travel, and every engagement starts with a fixed written quotation.
Contact us from a safe device at tscm@bureausecuritas.com. NDA on request.
*Sources: City AM, 13 October 2026; Ashurst Perkins Coie, 5 October 2026.*
Frequently asked questions
What did MI5 say in its 2026 threat update?
On 13 October 2026, MI5 Director General Sir Ken McCallum said MI5's state-threat caseload has quadrupled over the past decade, warned UK tech start-ups to expect to be spied on by foreign actors, and announced a new AI Threat Assessment Centre.
What was MI5's first espionage alert?
Published on 30 September 2026, it warned UK universities about a Chinese research funder that MI5 says has very strong ties to China's Ministry of State Security, and said about 100 UK-linked academics had contributed to projects it funded.
Are businesses targets of state espionage?
Yes. MI5 has warned that firms with valuable technology, data or access, including start-ups, should expect to be targeted. Methods include cyber attacks, recruiting insiders, and physical surveillance such as listening devices and trackers.
How can companies protect against physical espionage?
By identifying their most sensitive information and people, sweeping boardrooms and executive offices on a schedule and before key meetings, protecting executives' hotel rooms and vehicles when they travel, and following NPSA and NCSC guidance.