Recommendation 22

The Government and NCSC’s approach to ransomware is often framed through the language of state threats. While we recognise that operators are often facilitated by the Russian harbour state, ransomware is primarily a problem of criminality for profit, rather than espionage or geopolitical sabotage. Through the 2021 Integrated Review and its 2023 Refresh, the Government has acknowledged that the blurred lines between state threats and serious and organised crime require more threat- agnostic capabilities—and yet ransomware is currently at risk of falling into a ‘no man’s land’ between state threats and criminality.