A shifting U.K. terrorism threat landscape: 2025 risk assessment

The terrorism threat landscape shifts over time, and effective terrorism risk modeling needs to reflect this.

In early 2025, Moody’s will release an update to Moody's RMS Terrorism HD Model to reflect the latest evolution of the threat landscape in the U.K., introducing an expanded U.K. model domain, and incorporating a shift in attack mode relativity.

On February 18, Moody’s will be hosting a webinar discussing this shift, and how this will be reflected in the forthcoming model update.

The original RMS terrorism risk model covering London was developed after 9/11 and for as far back as the early 1970s, U.K. terrorism risk had been characterized by the Irish Republican Army (IRA) terrorist campaign. Just over a month after 9/11 on October 23, 2001, the IRA announced they were decommissioning their weapons.

Another shift came for the U.K., as the terrorism void created by the IRA was filled by Al-Qaeda, and motivated by the Iraq War, the London Transport attacks on July 7, 2005, killed 52 people.

Then in 2017, terrorism risk saw another shift highlighted by the prevalence of multiple small attacks. For the U.K. police and security services, 2017 was their most challenging year in decades, with five serious terrorist attacks:[1]

• March 22: Khalid Masood drove a car over Westminster Bridge, London, mounted the pavement, and hit pedestrians walking on the bridge. Once inside the grounds of the Palace of Westminster, he fatally stabbed a police officer. Five were killed in the attack with many more seriously injured.
• May 22: Salman Abedi detonated an improvised explosive device (IED) in the foyer of Manchester Arena as the venue hosted an Ariana Grande concert: 22 people were killed, and over 200 others were physically injured.
• June 3: Khuram Butt, Rachid Redouane, and Youssef Zaghba used a van to run over pedestrians on London Bridge, before continuing their attack on foot in the nearby Borough Market. Eight people were killed in the attack with many more injured.
• June 19: Darren Osborne drove a vehicle into a group of people near an Islamic center in Finsbury Park in north London. One person was killed and ten sustained serious injuries.
• September 15: Ahmed Hassan left an improvised explosive device (IED) on a London Underground train. The device partially exploded after the train arrived at a station: 23 people sustained burn injuries as a result of the partial explosion whilst 28 people suffered crush injuries.

 

Terrorist weapon attack modes in the U.K.

During the years of the IRA campaign, the IRA expressed a focus on the destruction of symbolic targets over the indiscriminate killing of civilians, exemplified in cases like the attack on the Arndale shopping center in Manchester in June 1996, when a 1,500-kilogram truck bomb devastated the center but due to a prior IRA bomb warning, no fatalities were caused.

The Al-Qaeda attacks placed some significance on both the destruction of symbolic targets and mass casualties, opting for a focus on macro attacks in the style of 9/11 or the London Transport attacks on July 7, 2005.

The majority of attacks in the U.K. during 2017 involved vehicle ramming, with the others involving small portable IEDs. These attacks significantly impacted human lives rather than caused property damage with all the attacks perpetrated by few or individual attackers.

A basic principle of terrorist modus operandi, which underlies Moody’s RMS terrorism risk modeling, is that terrorists follow the path of least resistance. Concerning the choice of attack weapon, this was graphically expressed by the radical Imam of the Finsbury Park Mosque in north London, Abu Hamza:
 

 “You can't do it by nuclear weapon, you have to do it by the kitchen knife. You can't do it by chemical weapons, you have to do it by mice poison."
 

Compared with the use of kinetic energy in vehicle ramming, using chemical energy such as an attack with a vehicle-borne IED (VBIED) is considerably more difficult because of the tight restrictions in the U.K. on the acquisition of explosive material, together with the time and human resources required, and the higher risk of plot interdiction.

As the threat landscape has shifted over time toward violent acts by radicalized individuals, the favorability of smaller-scale attacks like vehicle ramming or portable IEDs has increased, and as a consequence, the relative likelihood of VBIEDs has decreased.

In the past, VBIED attacks were easier to perpetrate with a few attackers, but have since increased in difficulty with intensive counter-terrorism surveillance.

However, while the relative likelihood of VBIED attacks has decreased, they do remain plausible and the most likely macro attack type.

It is worth remembering that two of the 2017 attacks, including the Manchester Arena bombing, did involve the deployment of explosives. While amassing a larger amount—suitable for a VBIED—significantly increases the risk of interdiction, these attacks are possible with a relatively small team, and if the impact of smaller attacks becomes less than desirable, a return to attacks with relative simplicity and larger scope may again become more favorable.

Indeed, though the capacity for large attacks by more centralized terrorist groups has diminished, interest still exists for macro attack types, and larger events, including the use of chemical, biological, radiological, and nuclear (CBRN) weapons, remain possible. The U.K. government continues to invest heavily in safeguarding the country against such attacks through the use of counterterrorism and intelligence services.
 

Terrorist targeting in the U.K.

While the favored methods of attack have shifted over time, along with the active threat groups seeking to commit violent acts, the basic principle that terrorism is the language of being noticed has remained consistent, particularly regarding target selection.

Four of the five serious attacks in 2017 took place in London, while the fifth attack took place at the Manchester Arena hosting an Ariana Grande concert. More recently around the world, vehicle ramming attacks were perpetrated at a popular Christmas market in Magdeburg, Germany on December 20, 2024, and on Bourbon Street in New Orleans, during New Year’s celebrations.

These attacks targeted cities or locations that maximize the visibility and impact of the attack, given their cultural or political significance, highlighting a need to consider targets with heightened relative risk when evaluating the terrorism threat landscape.
 

Geopolitical instability since 2018

In 2019-20, COVID-19 struck the U.K., and around the globe. Amid the isolation of lockdowns, uneven application of public health intervention globally—leading to mixed results, and the worldwide financial toll of post-COVID inflation, the impact of the pandemic extended even beyond immediate or lingering health impacts.

The 2020s have seen a marked rise in anti-government sentiment, racist or xenophobic activity, and widespread dissatisfaction with economic conditions tied to popular perceptions or viral conspiracy theories related to the fallout from COVID-19.

As COVID-19 was waning, on February 24, 2022, Russia’s President Putin instigated his special military operation in Ukraine. This act of war against a country seeking closer ties with Western Europe raised concern over a spillover of Russian hostility and terrorism from countries such as the U.K. that had provided military support for Ukraine. Vladimir Putin had form dating back to his days stationed in Dresden, East Germany, as a mid-level KGB officer, facilitating terrorist operations against West Germany.

While Russia continues military operations in Ukraine, the October 7, 2023, Hamas attack and subsequent military action from Israel has exposed a major political divide globally, spawning widespread and ongoing protests. Conflict between Israel and Palestine has long been used as justification for violence, and given the global visibility of the current conflict, violence may reach countries outside of the region that are perceived to have some level of involvement.

These events over more than half a decade have made their impact through differing means, but share a throughline that also connects them to geopolitical events that precede them: the influence of the Internet.

The Internet of the 2010s and 2020s has proven to be a major vector for radicalization. In the 2010s, major terrorist groups like Al-Qaeda and Islamic State (IS) initiated online propaganda campaigns designed to radicalize individuals globally, inviting them to join the cause.

Much of this material remains available, continuing to radicalize after the original strategy is abandoned after the fracturing of well-resourced terrorist groups. During the same timeframe, groups formed without explicit terrorist intent, like ‘incel’ groups still use the abundant resources available on the Internet for individuals to radicalize toward violence.

Going into the mid-2020s, misinformation and disinformation is ubiquitous online, and has instigated or aggravated multiple violent incidents globally.

In the summer of 2024, three young girls were killed at a dance group during a knife attack in Southport, U.K. Itself seemingly an example of violence enacted following self-radicalization, this event then began several days of violent activity in many towns and cities across the U.K. fueled by online misinformation, racism, and xenophobia.

Incidents like these highlight the wide range of fragmented potential sources of radicalization available online. In 2025 and beyond, individuals or small groups may be inspired to violence by a variety of groups or causes online, not necessarily aligned with more commonly known terrorist organizations, and are likely to continue a longer-term shift toward smaller attacks which are easier for small groups to accomplish and avoid interdiction.
 

Moody’s 2025 terrorism model update for the U.K.

The U.K. terrorism threat level is substantial, and according to the U.K. National Protective Security Agency (NPSA), there have been 39 interdicted terrorist plots in the U.K. since 2017. 

While the overall tempo of terrorist plotting remains high with considerable threat to human life, the risk of major property damage has significantly decreased, as previously mentioned in this shift toward smaller-scale attacks that prioritize civilians over the destruction of symbolic targets.

To support the industry in capturing the impacts of this evolving threat landscape, an update to the U.K. in Moody’s Terrorism HD Model will be released early in 2025. This update will introduce an expanded model domain to include Manchester and Birmingham.

The overall frequency of terrorist attacks in the Terrorism HD Model remains similar for London but has increased with the addition of explicitly modeled scenarios in Manchester and Birmingham. The update also thoroughly assesses the relative frequency of alternative terrorist attack modes.

Due to varying regional and political dynamics, the changes to the U.K. in the model may not extend identically to other modeled regions. Moody’s anticipates updating the other supported countries after the U.K. update.

Register for our webinar with Dr. Gordon Woo and Reynir Winnan entitled "Capturing the Shifting Threat: Updating Moody's RMS Terrorism High-Definition Model for Great Britain" on February 18, 2025, (7 a.m. PST | 10 a.m. EST | 3 p.m. GMT) here.

[1] Intelligence and Security Committee of Parliament (2018) The 2017 attacks: What needs to change?