UK firms exposed by simulated attacks on satellites, subsea cables and financial infrastructure

The UK Financial Conduct Authority (FCA) has tested how the financial system might withstand hostile action in a strategic resilience exercise conducted with the Ministry of Defence.

The exercise treated the continued operation of financial services during an attack as an important element of national resilience.

In its findings, the FCA says that strong defence starts with providing resilience to financial services and the economy during a hostile attack. Future wars are expected to be hybrid in nature.

The DSR Lab took its 120 attendees through a “deliberately challenging scenario.” The scenario included GNSS spoofing, multiple damaged subsea cables, and a cyberattack on a cable landing station.

It considered supply chain disruption, dual-use technologies (e.g., drones), and hostile activity.

The DSR Lab is focused on opportunities to strengthen national resilience through investment as well as to expose systemic risks.

Findings of the DSR Lab exercise

Working with the MoD brought defence expertise into the exercise and allowed firms to consider how hostile activity could affect Britain’s market integrity and wider security.

One of the findings was that firms may understand their own vulnerabilities and invest accordingly. At the same time, those firms are often less confident about dependencies and risks at a system level.

Building on the dependency picture between firms, it was found that firms may rely on the same infrastructure and often don’t understand how much they share that dependency with other firms. This includes communications networks, subsea cables, public sector databases, and satellite systems.

This highlighted the need to understand whether back-up systems are genuinely independent or if they overlap with the same points of failure. British firms also rely on international technology providers, and so it’s important to understand global dependencies and points of failure.

Another finding was that firms want more clarity on national threats and priorities before they invest capital. Meanwhile, some dependencies (e.g., power and telecoms) sit completely outside the sector’s control.

Participants in the exercise were clear that Britain needs a broader conversation about its threat landscape and its preparedness. This should challenge long-held assumptions and include the wider economy beyond financial services.

FCA’s evolving role in British preparedness

Other concerns include GPS/GNSS jamming, the increasing reliance on a handful of global cloud providers, vulnerabilities exposed by the 2024 CrowdStrike incident, and growing concern that AI will accelerate cyber vulnerability.

The Government now calls for a whole-of-society approach to national preparedness and resilience in recognition that the UK “cannot rely on any single sector to protect itself against modern, complex threats.”

FCA will continue helping the financial sector to understand risks, work with British defence and dual-use sectors, and build overall resilience.