Overview
In a July 2025 report, the UK Parliament's Intelligence and Security Committee (ISC) assessed that the Iranian regime and its affiliates represented a “wide-ranging, persistent and unpredictable threat” to UK security. Official assessments of risks posed by Tehran have escalated significantly in recent months, as the outbreak of direct conflict launched by the US and Israel on 28 February 2026 have given rise to more frequent statements of threat and increased incidence of attacks within the UK which have been linked to the network of actors aligned with, if not coordinated by, the Iranian regime. On 1 March 2026, UK Defence Secretary John Healy stated that the UK's terror threat level assessment was under review following the Iranian regime's retaliatory attacks on multiple regional and neighbouring states. This article presents an overview of current risks posed to the UK by Tehran, its proxies and affiliates, and the likely means and severity of relevant threats.
Physical threats
In responding to the ISC's July 2025 report, the UK government reported that threats of physical attacks on individuals were the most severe posed by Iran within the UK, with at least 15 attempted murders or kidnappings since 2022 and an increase in such incidents within the preceding 18 months. Such attacks, frequently coordinated via proxies, have primarily targeted Iranian dissidents, and in some cases Jewish and Israeli targets, in patterns indicating that Tehran views the UK "as collateral in its handling of internal matters". The ISC concluded that these risks "could continue to increase rapidly if Iran’s intent or capability develops further", with an especially high risk of continued attempts at forced repatriation of individuals viewed as threats to the Iranian regime. The more recent outbreak of direct conflict with Iran, anti-regime protests held in London, and any increased military or logistical commitments by the UK may be expected to further elevate these risks.
With regard to threats of conventional military strikes, speculation has been raised by claims that the Iranian regime has developed ballistic missiles with operational ranges enabling strikes on European cities including London. European leaders including Mark Rutte, former Dutch Prime Minister and current NATO Secretary General, have warned about this; some analyses have argued that the Iranian regime's capacity to produce such weapons amid current pressure imposed by the US and Israel is unclear, and that such systems would likely be limited in number if in fact fielded by regime forces. Further, given the severe escalatory implications of such theorised attacks on major cities, and European states' limited deployments and commitments in the war to date, such risks may be seen as unlikely at this stage of the conflict.
Potential risks posed by Iranian Shahed drones – which have been extensively deployed by Russia in the Ukraine theatre, as well as in Iranian attacks launched against Middle Eastern and Gulf states – and by possible usage of other unmanned systems have also been subject to debate in recent weeks. Shahed drones have a claimed operational range of approximately 2,500km – making it possible, if not realistically probable, for them to travel from Iranian launch sites through countries such as Turkey or Jordan: the recent strike on a RAF base in Akrotiri, Cyprus likely involved a Shahed-type drone launched from Lebanon by Iranian proxy Hezbollah, demonstrating expanded reach afforded by the Iranian regime's network of overseas assets. While Iranian regime forces or overseas proxies would unlikely be able to launch Shaheds or similar systems with a view to striking the UK directly, the possibility of UK-based Iranian assets using simpler drones – even commercially available models – to disrupt UK aviation or to damage infrastructure through purely kinetic attacks has also been highlighted.
Cyber threats
Aside from the potential physical threats to UK security outlined above, the Iranian regime may pose digital risks, in line with the considerable cyber warfare capabilities demonstrated by Tehran and its proxies in recent years. Aligned cyber actors have targeted UK industrial control systems in the past, and increasing interconnectivity in information systems implies growing exposure to attacks on critical infrastructure. The UK government has also reported significant and consistent espionage threats from Iran, in which cyberattacks and digital operations have often been opportunistically employed; where used in service of information operations, cyberattacks by Tehran-aligned actors may also aim at silencing critics of the Iranian regime, or at weakening the UK's security relationships.
On 3 March the National Cyber Security Centre reported no significant change in the levels of cyber risk posed by Iranian actors since the start of the current conflict, but warned of spillover risks and indirect cyber threats for organisations and entities maintaining a presence, or supply chains, in the Middle East. Such attacks would likely target UK-based organisations and assets in response to significant escalation, and potentially material commitments or statements of support by the UK (or other European countries) for US-Israel actions against Iran.
The grey zone
Since 9 March a series of attacks were carried out on Jewish sites in Liège, Rotterdam, Amsterdam and, most recently, London. A previously unknown group, identifying themselves as Harakat Ashab al-Yamin al-Islamia (HAYI), claimed responsibility for these attacks in posts circulated on Telegram and X channels affiliated with Tehran-aligned proxy groups. This has raised speculation around associated risks and implications for material threats of hybrid operations coordinated by the Iranian regime and conducted within the UK. Some analyses have highlighted the sudden emergence of HAYI and the style of these attacks as consistent with Iranian hybrid warfare practices observed in other incidents – affording ambiguity and plausible deniability, while aiming primarily to confuse, destabilise and intimidate rather than to kill. On the analysis that HAYI may not represent an authentic, organised group, claims of responsibility for the recent incidents in Belgium, the Netherlands and the UK – and for attacks on unspecified locations in Greece and France – may constitute a broader disinformation campaign.
European officials recently warned that Russia – a pioneering and prolific utiliser of hybrid and "grey" warfare – has been making increasing use of young, locally recruited individuals for destabilisation tactics in target countries including Moldova. Tehran has reportedly made similar use of such "disposable agents", as evidenced in an October 2024 grenade attack on the Israeli embassy in Stockholm, Sweden which was carried out by local recruits aged 16 and 18. In a report published that month, Europol highlighted the emergence of Belgium and the Netherlands as major hubs for European criminal networks, which have increasingly recruited local individuals for specific tasks through online platforms. Tehran's reported collaboration with such networks in Ireland, Sweden and other European countries, and the apparent perpetration of the latest London attack by several young men in purported association with HAYI, imply the possibility of further such activity coordinated by Tehran and conducted in the UK.
The Islamic Revolutionary Guard Corps (IRGC), the primary security and power-projection arm of the Iranian regime, has long been engaged in transnational hybrid activities through its specialist Quds Force. While the IRGC has been designated as a terrorist group by the US, and by the EU in February 2026, there is long-standing debate in the UK as to whether the IRGC should be proscribed under the Terrorism Act 2000. The primary difficulty in this debate, as stated by UK lawmakers, is the IRGC's integral position in the Iranian state; former Home Secretary James Cleverly also stated in 2023 that projected effects of proscription would likely be limited due to designations already in place under existing sanctions on the IRGC. Terms of reference for a new review and design of a new proscription system were published in March 2025. If a proscription does materialise, this could result in further retaliatory threats and escalations in use of unconventional tactics like those outlined above.
The Iranian regime is also recognised as a prominent employer of information manipulation and interference methods, and in March UK MPs criticised major social media platforms for continued hosting of accounts and content recognised as spreading disinformation in a campaign orchestrated by the Iranian regime. While the UK has not figured among Tehran's primary targets in recent years – these being the US, Irael and Saudi Arabia – a 2024-2026 report by the House of Commons Foreign Affairs Committee noted that the UK has been increasingly targeted due to its engagements in the Middle East and its hosting of the independent Persian-language media outlet Iran International. Government reporting has indicated that Tehran's efforts to intimidate the regime’s perceived opponents have had a significant impact on the Iranian diaspora community in the UK, with targets limiting their social contact with other Iranians and reducing their advocacy for contentious topics in Iranian affairs.
Outlook
Taken together, the threats outlined above indicate that the Iranian regime currently poses persistent and multifaceted risks to UK security, characterised less by the likelihood of large-scale military confrontation than by the continued use of targeted and deniable tactics. These risks are likely to remain closely tied to the trajectory of the ongoing conflict and to the extent of the UK's material involvement.
Looking ahead, the UK's principal security challenges with respect to Tehran will be managing sustained lower-level pressure, rather than isolated major events, with the risk landscape best understood as featuring gradual intensification and episodic incidents, particularly during periods of heightened geopolitical tension or vocal criticism of the Iranian regime by UK-based actors. Continued vigilance, intelligence coordination with European partners, and clear communication of deterrence thresholds will be crucial to mitigation of these risks while avoiding unintended escalation. Threats from Tehran, its proxies and affiliates are likely to persist beyond the immediate conflict and to evolve alongside broader patterns of geopolitical competition, transnational repression and hybrid warfare.