Security Operations

UK sends military cyber ‘hunt forces’ abroad to stop attacks early

UK cyber commander says ‘hunt forces’ now chase hackers abroad as AI cuts response time to minutes. What UK SOCs should change now.

Radar graphic with the headline UK cyber hunt forces deployed overseas

The UK’s military cyber commander says specialist teams are now being deployed overseas to find hostile hackers before they reach British defence networks. His warning that AI has cut the time to respond to an exploited weakness from days to minutes should change how every UK security operations centre plans its week.

What happened

Major General Mike Fayers, who commands the Defence Cyber and Electromagnetic Force, has said that specialist teams, which he calls “hunt forces”, are being sent abroad to locate and disrupt adversaries in the places where they prepare their operations. The comments came in an interview with The Times and were widely reported on Monday 9 November 2026 by LBC, the Express, The National and the German news agency dpa.

According to those reports, the aim is to catch hostile activity early, before an intrusion grows into a large-scale attack on UK military systems. These operations often need sign-off from the Defence Secretary, Wes Streeting. Fayers described the approach as a move away from guarding UK territory and towards defending networks before an adversary’s campaign gets going, and he was explicit that people are being physically sent to locations so they can hunt virtually from there.

Two remarks stand out for defenders. First, he told The Times that the problem was not confined to the Ministry of Defence, calling it a “whole-of-UK challenge”, as reported by the Express. Second, he said AI is exploiting vulnerabilities faster than anything seen before: where the military once had a few days to fix a flaw, it now has what LBC quoted him as calling “double-digit minutes” to respond.

Coverage linked the interview to the recent attacks on connected refrigeration across Europe, including French blood banks, and to Streeting’s view that Russia is the UK’s greatest threat.

The detail

The published reporting does not say which countries the teams operate in, how many people are involved or which adversaries they have engaged, and the MoD has not, as far as I can find, released further detail. What it does describe is a defensive posture that has moved upstream. Rather than waiting for an alert on a UK system, the hunters go looking for the staging infrastructure, tooling and preparatory activity that precede an attack, then disrupt it.

For SOC teams the model is familiar, minus the passports and ministerial approvals: hypothesis-led threat hunting pushed as far left in the attack chain as it will go.

The second half of the story is about tempo. Fayers’ claim that the remediation window has collapsed from days to minutes is consistent with what the National Cyber Security Centre said a week earlier. Its State of the Cyber Nation report, published on 3 November, assessed that within two years attackers using AI will very probably run exploitation, ransomware and social engineering campaigns faster and in greater volume. NCSC chief executive Dr Richard Horne argued that the danger lies less in brand new techniques than in long-tolerated weaknesses being found and abused at a scale that was previously impractical, and he called time on what he described as “tech on the cheap”.

Checklist of five SOC actions prompted by the UK military's warning that response windows are now minutes

Why it matters for UK organisations

Most organisations cannot send teams abroad, and nor should they try. Offensive or forward operations against attacker infrastructure are the business of the state, and anything resembling “hacking back” by a private company risks breaching the Computer Misuse Act. The lesson is not to copy the method but to copy the mindset.

The assumption baked into many UK patch and vulnerability management policies is that you have days, or at best a fortnight, between a fix becoming available and meaningful exploitation. Cyber Essentials requires high and critical updates to be applied within 14 days, and plenty of organisations treat that as a target rather than a ceiling. If a senior military commander is now planning on minutes for the systems he protects, a manufacturer or a local authority running internet-facing VPNs, firewalls and file transfer appliances cannot safely plan on a fortnight.

The whole-of-UK framing matters too. Supply chains connect defence primes, small engineering firms, managed service providers and public bodies. An adversary preparing to hit military systems may well rehearse on, or route through, a far less defended civilian network.

Expert view

In my experience, the gap between organisations that cope with a fast-moving exploitation wave and those that do not rarely comes down to tooling. It comes down to whether they know, with confidence, what they have exposed to the internet and who is allowed to switch it off at two in the morning without a change board.

When we test external estates, the findings that matter most are almost never exotic. They are forgotten management interfaces, appliances two versions behind and remote access portals nobody owns. Those are precisely the weaknesses AI-assisted attackers are now able to find at scale, and the NCSC has said so in plain terms.

The “hunt” framing is also a useful corrective for SOC teams that live inside their alert queue. Alerts tell you what your controls already recognise. Hunting asks what an adversary would need to do first, and whether you would notice. That means looking for reconnaissance against your own domains, newly registered lookalike domains, suspicious authentication attempts against edge devices and unusual administrative logins, rather than waiting for malware to detonate.

One caution: minutes-not-days is a planning assumption, not licence to panic-patch production. Isolate or disable the exposed service first, then patch properly.

What to do now

  1. Know your edge. Maintain a live inventory of every internet-facing system, its owner and its version. Remove anything that does not need to be exposed, in line with the Cyber Essentials firewall and secure configuration controls and the NCSC’s advice not to connect technology to the internet unnecessarily.
  2. Rewrite your emergency change rules. Agree in advance who can disable a VPN portal, management interface or file transfer service on suspicion of exploitation, without waiting for a meeting.
  3. Shrink patch windows for exposed kit. Treat the 14-day Cyber Essentials security update requirement as the maximum for internal systems and aim for same-day mitigation on internet-facing devices with actively exploited flaws.
  4. Schedule proactive hunts. Give analysts protected time each week to hunt for early-stage indicators: scanning of your ranges, lookalike domains, failed and anomalous authentication on edge devices, and new administrative accounts.
  5. Tighten privileged access. Enforce MFA and named accounts for every administrative interface, consistent with the Cyber Essentials user access control requirements.
  6. Talk to your supply chain. If you supply defence or critical infrastructure customers, ask how quickly they expect you to act on a critical advisory, and make sure your own suppliers can meet the same pace.

Bottom line

The UK’s military cyber force has concluded that waiting behind the perimeter is too slow, and that AI has turned days of grace into minutes. Civilian organisations cannot deploy hunt forces abroad, but they can hunt earlier on their own networks, know exactly what they expose and empower someone to pull the plug quickly. That is the part of this story every UK SOC can act on this week.

Sources

Related Posts