UK SECURITY
INTELLIGENCE BRIEF

1. WEEK AT A GLANCE

THIS WEEK IN 30 SECONDS

Counter-terrorism remained the dominant security theme. On 2 October, two men were charged with terrorism offences following an investigation into an alleged plot targeting the Jewish community in Manchester. The RAF Fairford investigation continued to wind down after police confirmed that no explosive device had been found. In London, a man was sentenced to 15 years for destroying a ULEZ camera in an offence the judge found had a terrorism connection. Alongside these incidents, government updates to the Crime and Policing Act 2026 and new NCSC resilience guidance created practical implications for retail, public-order and corporate security.

WHAT CHANGED?

2. KEY INCIDENTS OF THE WEEK

20 SEP / MANCHESTER — CHARGES ANNOUNCED 2 OCT

Source: Metropolitan Police / Counter Terrorism Policing — 2 October 2026

27 SEP / RAF FAIRFORD, GLOUCESTERSHIRE

Source: Counter Terrorism Policing — 28/29 September 2026

6 DEC 2023 / SENTENCED 2 OCT 2026 — SOUTH-EAST LONDON

Source: Metropolitan Police — 2 October 2026

3. NATIONAL CRIME & COMMERCIAL SECURITY CONTEXT

UK CRIME SNAPSHOT — LATEST AVAILABLE NATIONAL BASELINE

POLICE.UK — CURRENT DATA POSITION

Police.uk provides street-level crime, outcomes and stop-and-search data by police force and LSOA. Its crime data are updated monthly. The latest complete archive available for the reporting period contains data through August 2026. September data were therefore not yet available as a complete Police.uk national dataset by the end of Week 40. This brief does not invent weekly or September Police.uk totals.

Source: Police.uk data downloads / archive and methodology

RETAIL & COMMERCIAL SECURITY

The Crime and Policing Act 2026 factsheet updated on 30 September confirms a standalone offence for assaulting a retail worker and changes intended to ensure shop theft is treated with appropriate seriousness. The standalone retail-worker offence carries a maximum six-month custodial term and/or unlimited fine, with a presumption of a Criminal Behaviour Order on first conviction.

4. LONDON & METROPOLITAN ENVIRONMENT

LONDON WATCH

Source: Metropolitan Police newsroom — Week 40 developments

5. NATIONAL LEGISLATIVE & REGULATORY LANDSCAPE

CRIME AND POLICING ACT 2026

The Government's updated factsheets provide a useful operational picture of the new Act. Measures include stronger action against serious and organised crime, a standalone offence for assaulting retail workers, new public-order powers and provisions affecting vehicle-theft technology. The serious-crime factsheet also describes powers concerning electronic devices used in vehicle theft and court orders targeting criminally associated domains and IP addresses.

PUBLIC ORDER

Updated provisions allow police to impose conditions on protests where a senior officer reasonably believes the protest may create an intimidating atmosphere for people accessing a place of worship. The framework also gives BTP powers concerning public and trespassory assemblies at railway stations and requires consideration of cumulative disruption from repeat protests.

SIA / PRIVATE SECURITY

SIA enforcement remains relevant to contractor assurance. The current active-prosecution register includes cases involving alleged supply of unlicensed security operatives and false statements to the SIA. For management, licence verification, accurate records and controlled subcontractor arrangements remain important compliance controls.

6. CYBER & NATIONAL RESILIENCE

NEW NCSC GUIDANCE — 1 OCTOBER 2026

The NCSC published updated practical guidance on reducing the risk and impact of highly disruptive cyber attacks. It recommends organisations focus on five complementary capabilities: identifying critical systems and data; reducing exposure; limiting the impact of compromise; building resilience; and detecting/responding quickly.

WHY THIS MATTERS TO SECURITY OPERATIONS

Cyber incidents can affect physical security directly. Loss of network connectivity, CCTV, access-control systems, alarms, intercoms or digital reporting can change the risk profile of a site within minutes. Security teams therefore need clear fallback procedures rather than relying solely on IT recovery.

Source: UK Government, Cyber Security Breaches Survey 2025/26 — baseline used in Week 39 and still current for this report

SECURITY OFFICER BRIEF

7. OPERATIONAL ASSESSMENT

PRIORITY 1 — COUNTER-TERRORISM AWARENESS

Official threat level remains SEVERE. The Manchester charges and the Fairford investigation reinforce the importance of reporting suspicious behaviour around sensitive and community locations. Security teams should remain alert rather than alarmed and should focus on observable behaviour.

PRIORITY 2 — SUSPICIOUS VEHICLES & RECONNAISSANCE

Week 40 provides a clear operational reminder that seemingly minor vehicle observations can become significant intelligence. Where safe, record vehicle registration, make/model, colour, occupants, exact location, time and direction.

PRIORITY 3 — RETAIL / COMMERCIAL SECURITY

The new retail-crime provisions reinforce the importance of evidence quality. CCTV, witness details, incident chronology and linked reports can help demonstrate patterns and support enforcement.

PRIORITY 4 — CYBER / PHYSICAL RESILIENCE

Every site should know what happens if its digital security systems fail. Supervisors should have clear manual fallback arrangements for access control, CCTV, communications and incident recording.

PRIORITY 5 — LONDON / PUBLIC ORDER

Security personnel working around public demonstrations, places of worship, transport hubs and high-footfall venues should understand the client's escalation arrangements and avoid becoming drawn into confrontational activity.

8. DATA & METHODOLOGY

9. SOURCE STANDARD