Behind the Lines

Biosecurity is the next front and it belongs in your risk assessment

Dr Paul Wood. Founder and CEO of Emerging Risks Global.

Russia rarely invents a problem. It finds one that already exists, inside a community, an industry or a national argument and applies pressure until the crack becomes a fault. Local grievance supplies the raw material. Amplification does the work. That principle makes the threat picture facing a British security manager easier to read, because what is arriving does not look like an attack. It looks like several ordinary things going wrong at once.

Something has changed in how that pressure is applied. The war in Ukraine has settled into a form where neither side can force a decision along the line itself and when a front becomes impassable the pressure does not disappear. It relocates to whatever sits behind it. Cyber operations against utilities and logistics. Arson and sabotage against infrastructure and against firms connected to Ukraine, carried out by people recruited for cash rather than for a cause.

In October 2025 six men were sentenced over the arson of a warehouse in Leyton holding humanitarian aid and Starlink equipment bound for Ukraine, a fire that cost around a million pounds in damage. The Crown Prosecution Service records that the ringleader had contacted the Wagner Group through Telegram and offered his services; he received seventeen years. The International Institute for Strategic Studies counted a 246 per cent rise in confirmed Russian sabotage of European critical infrastructure between 2023 and 2024, worked through much the same kind of recruitment. And, on a longer horizon, the biological domain. That last one is the subject of this article and the thing worth knowing in advance is that a biological attack may present first as a problem of trust and only second as a problem of health. It is also the one British organisations have thought about least, having convinced themselves that the last pandemic was the exercise.

Why biology

Biological attack has three properties that make it structurally attractive to a state that wants effect without accountability.

Attribution is slow and contestable. A pathogen release leaves no launch signature. The United Kingdom's 2023 Biological Security Strategy sets an outcome of "a strengthened national microbial forensics capability", resting on the Chemical and Biological Analysis and Attribution Capability at Dstl.

The capability exists. What no forensic capability supplies is speed and deterrence by punishment depends on naming an attacker while the decision to retaliate is still live. Where attribution lags the event, deterrence has to come from denial, meaning the ability to absorb the attack and carry on.

The barrier to entry has fallen while the barrier to defence has risen. The US National Security Commission on Emerging Biotechnology reported in April 2025 that China has treated biotechnology as a strategic priority for two decades and leads in synthetic biology and put Chinese biopharmaceutical research and development spending up four-hundred-fold over the past decade, a multiplier that is the Commission's own and measures money rather than output. The Commission recorded that around four fifths of surveyed US biopharmaceutical companies rely on China-based firms for at least some component of their manufacturing and asked Congress for at least fifteen billion dollars over five years simply to compete. That is a statement about industrial capacity and industrial capacity in this domain is dual-use by nature.

The defensive base is thinner than most people assume and this is the part that should worry corporate security most, because it does not wait on anyone choosing to attack. Antimicrobial resistance already kills more than a million people a year directly. The GRAM study in The Lancet in September 2024 forecast 1.91 million annual deaths directly attributable to resistant infection by 2050, 8.22 million associated with it and some 39 million cumulative attributable deaths between 2025 and 2050. Against that, the World Health Organization reported in October 2025 that the antibacterial pipeline had shrunk to ninety agents in clinical development, down from ninety-seven two years earlier, of which fifteen were judged innovative and only five active against the pathogens WHO classes as critical priority. WHO called it a dual crisis of scarcity and lack of innovation.

Read those two findings together. A deliberate release does not need to involve anything exotic to be effective if the treatments that would ordinarily contain it are no longer reliable. The most consequential biological vulnerability we face is not a novel agent. It is the steady erosion of the medical countermeasures that made ordinary bacterial infection a manageable inconvenience.

The axis that matters here is not a formal alliance. Russia, Iran, China and North Korea cooperate transactionally and unevenly and are quite capable of undercutting one another. What they share is an interest in raising the cost of Western resilience and a willingness to trade the components of it. The US State Department's 2025 compliance report notes that the 2024 Russia and DPRK strategic partnership provides for joint research in biology alongside nuclear energy. Given that the same report assesses North Korea to run a dedicated national-level offensive biological weapons programme and records that Pyongyang has filed no confidence-building return under the Biological Weapons Convention since 1990 despite acceding in 1987, that clause deserved more attention than it got.

The second weapon

Return to the point made at the outset. The first effect of a biological event lands on trust rather than health and that is where biology couples with cognitive warfare. The COVID period supplied the template. European External Action Service reporting documented sustained state-linked efforts to undermine confidence in Western vaccines while promoting alternatives. The objective was never persuasion toward a particular medical claim. Success looked like a population unable to settle on a shared account of events, at the moment when collective action depended on having one.

Now transpose that onto a deliberate release in a British city. The first authoritative statement will be incomplete, because early epidemiology always is and the gap between the event and the explanation is the operational window. An adversary who has spent three years cultivating distrust of public health institutions, local authorities and employers does not need to release much to achieve a great deal. The pathogen creates the uncertainty. The information operation converts it into refusal: refusal to attend a screening centre, refusal to accept a containment instruction, refusal to believe the employer who says the building is safe.

This is where the proximity point lands. Cities generate prosperity through density. The value of an office, an exchange, a hospital or a university comes from putting people close enough together that ideas, transactions and expertise move between them without friction. A biological weapon attacks that mechanism directly and it does so whether or not the pathogen performs, because the damage is done by people deciding that proximity is no longer worth the risk. We ran that experiment involuntarily between 2020 and 2022 and are still paying for it in commercial property values and city-centre footfall. An adversary who wants to degrade a rival economy without triggering an Article 5 conversation has been shown how.

Putting it in the risk assessment

Most organisations cannot solve this. What they can do is stop treating it as a public health matter that happens to them and start treating it as a named scenario in the security risk assessment, with the discipline applied to any other high-impact, low-frequency threat.

Name the scenario properly. Not "pandemic", which invites a repeat of the last one. The UK Covid-19 Inquiry's Module 1 report, published in July 2024, found that Britain had prepared for the wrong pandemic, that the institutions responsible for emergency planning were "labyrinthine in their complexity" and that responsibilities were "duplicative, diffuse and delegated too far from ministers and senior officials to allow them to be effectively overseen". Baroness Hallett's recommendations included UK-wide exercises at least every three years, the routine use of red teams to counter groupthink and a single independent statutory body for whole-system civil emergency preparedness and resilience. Those recommendations scale down to a corporate risk register almost unchanged. Write the scenario in terms of the effects you would have to manage, which are absence, contamination of premises, supply interruption and loss of confidence, rather than in terms of a specific organism.

Read Pegasus when it lands. Those recommendations are no longer theoretical. Exercise Pegasus, the Tier 1 national pandemic exercise and the largest such simulation the UK has run, took place between September and November 2025, involving every government department, the devolved administrations, local resilience forums, businesses and academics. A recovery phase follows in 2026 and the full report is due by winter 2026. If your organisation took part, it holds material its risk assessment should be absorbing. If not, the published output is the closest thing to a national baseline you will get.

Decide the stockpile question deliberately. Most organisations should not stockpile medical countermeasures and it is worth writing down why, so the question does not reopen under pressure. What is worth holding is what runs out in week one and cannot be sourced when everyone wants it at once: respiratory protection sized and fit-tested in advance, decontamination consumables and paper copies of plans that survive a network outage.

Work out your vaccination position before you need it. UK employment law makes compulsion difficult in almost all civilian settings, leaving occupational health provision, paid time to attend and clear internal communication as the practical instruments. That is a decision with legal exposure attached, belonging to the general counsel and the HR director as much as to security. Have the conversation while it is hypothetical.

Treat dispersal as a security control, not an HR concession. Moving a workforce out of a building at short notice is a real capability and it is only real if it has been tested. It also exports the attack surface into homes with weaker controls than the office it replaced. Both halves belong in the assessment and neither is free.

Define your triggers in advance. The single most valuable output of this work is a short, agreed list of observable conditions that change the organisation's posture, together with who is authorised to call them. The government's Prepare guidance to households talks in terms of an emergency lasting a few days and the EU's Preparedness Union Strategy puts a number on it at seventy-two hours. My own view is that seventy-two hours is the right unit for corporate planning, because it is roughly how long an organisation holds together before improvised decision-making becomes visibly incoherent.

Build the trust reserve now. The determinant of whether people follow instructions during a biological incident is whether they believed the organisation the last time it told them something inconvenient. That reserve cannot be created during the crisis. It is built through routine candour and it is spent very quickly.

None of this forecasts an imminent biological attack. It observes that the conditions which would make one attractive have been assembling for some time; a war displacing its own pressure from the front into everything behind it, an adversary grouping with the industrial base and the doctrinal interest, a medical countermeasure pipeline running down and populations already softened for the information operation that would follow. The security profession is good at threats that come through a door. This one comes through the air we share in order to be prosperous and the planning has to start while it is still an abstraction.

References

GBD 2021 Antimicrobial Resistance Collaborators, "Global burden of bacterial antimicrobial resistance 1990-2021: a systematic analysis with forecasts to 2050", The Lancet, September 2024.

World Health Organization, Analysis of antibacterial agents in clinical and preclinical development: overview and analysis 2025, 2 October 2025.

National Security Commission on Emerging Biotechnology, Final Report, 8 April 2025.

US Department of State, Adherence to and Compliance with Arms Control, Nonproliferation and Disarmament Agreements and Commitments, April 2025.

HM Government, UK Biological Security Strategy, 12 June 2023.

UK Covid-19 Inquiry, Module 1: The resilience and preparedness of the United Kingdom, 18 July 2024.

Ashley Dalton MP, "Pandemic Preparedness: Update on Exercise Pegasus", written ministerial statement HCWS1015, 4 November 2025.

Cabinet Office, Prepare guidance on household emergency preparedness, prepare.campaign.gov.uk.

European Commission, Preparedness Union Strategy, 26 March 2025.

Department of Health and Social Care, Pandemic Preparedness Strategy: building our capabilities, 25 March 2026.

European External Action Service, special reports on narratives and disinformation around the COVID-19 pandemic, 2020-2021.

Crown Prosecution Service, statement on the use of National Security Act 2023 legislation to prosecute the Leyton warehouse arson plot, 24 October 2025.

Charlie Edwards and Nate Seidenstein, The Scale of Russian Sabotage Operations Against Europe's Critical Infrastructure, International Institute for Strategic Studies, August 2025.