Skip to content

How Threats Changed in 2025 title.

At the individual threat level, drugs, organised immigration crime, and illicit finance are all assessed to have increased in 2025. These are high-volume crimes that generate significant harm across the UK. As a result, changes within these areas have a disproportionate impact on the overall SOC landscape.

These threats also act as drivers of wider criminality: drugs underpin much serious violence, including firearms offending; organised immigration crime sustains illegal and grey economies; and illicit finance both enables and profits from other criminal activity. Harm from cybercrime has likely increased despite no overall significant change in threat: whilst the majority of ransomware attacks have been no more serious than in 2024, changes in the methods of criminals caused very serious harms in 2025.

Threat Table

Child Sexual Abuse

There is no substantial change in the child sexual abuse threat in 2025, with trends continuing to evidence high harm offending following an increase in the threat in 2024. While the volume of offences reported to police in England and Wales continues to grow (104,266 in the year to September 2025, 3% higher than the 101,184 the previous year) it is highly likely that factors driving offending, such as sexual gratification, financial gain, and the desire to cause harm to others remains broadly unchanged.

The complexity and severity of the threat continues at high levels resulting in physical and psychological harm to victims. Offenders will continue to identify and target vulnerable individuals both offline, such as in contact group-based child sexual exploitation, and through the exploitation of online environments. Offenders continue to develop their capability to target and harm multiple victims, as well as exploiting children to produce increasingly more indecent and depraved imagery.

Cybercrime 

The threat from serious and organised cybercrime to the UK did not increase in 2025, despite the increase in harm from a small number of impactful events; however, the threat remains very high. The intent of cybercriminals impacting the UK remains consistent; while there has been a small number of attacks from UK-based individuals whose motivation includes notoriety, the vast majority of attacks are conducted by criminals based in other jurisdictions, for financial gain. Some criminals had greater effect than previously seen from deploying social engineering techniques, but the overall capabilities of offenders did not increase in 2025. Data theft and/or encryption remains the most common attack methodology. The opportunity for cybercriminals to conduct malicious activity that affects the UK continues to increase, due to increasing online dependence across society.

Drugs

The drugs market continues to evolve with a diversification of products. Significant increases in the volumes of ketamine (from 769kg in the year ending March 2024 to 1,092kg in the year ending March 2025) and cannabis (from 74.2 tonnes to 127 tonnes over the same period) seized at the UK border, along with more detections of domestic drug laboratories and changes in drug distribution models, all indicate an upward trend in the threat in 2025.

The threat from cocaine remains high, with seizures in the UK having increased by more than 440% in the last ten years (from 3.4 tonnes in 2015 to 18.5 tonnes in 2025). The range of substances that are currently popular among users is increasing, creating new markets, while the harm from illicit drugs has also increased. 

Drug-misuse deaths in England and Wales continued to increase in 2024, rising by 3% from 3,618 in 2023 to 3,736 in 2024, and more than doubled since 2012 (1,496). Although this was a smaller increase than the previous year when there was a 16% increase, deaths related to cocaine abuse in England and Wales increased by 14% to 1,279 in 2024, 11 times higher than in 2011 (112). Though the synthetic opioid market continues to evolve, there was a 17% decrease in the number of recorded nitazene-related deaths in the UK in 2025 to 359 deaths, a reduction from 435 in 2024, with recorded nitazene-related deaths now close to 1,000 in total since June 2023. The figure for 2025 is expected to increase as additional test results are finalised.

The drugs threat further increased as organised crime groups, using the container shipping mode to smuggle illicit drugs, demonstrated their ability to diversify their methodology. This includes using alternative European ports, enhanced concealments, and at-sea-drop-offs, in response to high volumes of seizures in recent years.

Firearms 

Firearm use in the UK remains low and offences decreased by 9% in England and Wales in the year ending September 2025 (from 5,356 to 4,851 offences). However, criminal intent and capability to source and use firearms is unlikely to have changed significantly. Discharges with converted blank-firers are decreasing due to reduced availability, following action taken by the NCA and partners. Conversely, although not available to most criminals, there has been an increase in counterfeit firearms that are of better quality and can use more powerful ammunition. Firearm ownership remains aspirational for many criminals who do not have the requisite contacts or funds, and threats to use a firearm, even where none exists, remains the most common criminal use.

Fraud

There is no evidence of a substantial change in the overall threat to the UK from fraud; however, harms have increased. The Crime Survey for England and Wales estimated fraud had risen by only 7.6% (295,000) over the year ending September 2025, compared to the same period the previous year, which was not a statistically significant increase. However, it is likely the threat from both investment and card not present fraud has continued to increase. According to UK Finance, losses from investment fraud during the first six months of 2025 rose 55% to £97.7 million (from £63.0 million) compared to the same period in 2024. Similarly, reports of card not present fraud have continued to rise, likely driven in part by a growing capability to socially engineer victims into revealing one-time passcodes.

Illicit Finance

It is likely that organised crime networks’ capabilities and opportunities to conduct illicit finance impacting the UK have increased in 2025, although the overall level of harm likely remains unchanged. Professional enablers (based in the UK and overseas), in addition to technological enablers, continue to innovate to avoid detection of illicit finance activity and maximise SOC profits. The rate of growth has been limited by law enforcement action, including against some Russian-speaking money laundering networks, highly likely disrupting their criminal business infrastructure, reputation, and relationships during 2025. It is likely that opportunities, and demand, for money laundering have increased due to rising predicate threats like drugs and organised immigration crime.

Modern Slavery and Human Trafficking

There is no evidence of substantial change in the overall threat from modern slavery and human trafficking in 2025 compared to 2024, with the number of potential victims exploited in the UK broadly stable. Although the level of harm from modern slavery and human trafficking remains high, it is highly likely that offender intent, capability, and opportunity have remained largely unchanged, with factors such as profitability, consumer demand, offender organisation, and sophistication continuing to underpin offending. Modern slavery and human trafficking remains a highly gendered crime, with women and girls accounting for the majority of victims of sexual exploitation and domestic servitude, and men and boys most often exploited for labour and in criminal activity.

Organised Acquisitive Crime

It is unlikely that the overall threat from organised acquisitive crime has substantially changed in 2025. The level of organised acquisitive crime offending has remained broadly stable, despite indications of a reduction in acquisitive crime more generally in 2025, driven by decreases in organised retail crime, personal robbery, residential burglary, and vehicle crime offences. Law enforcement activity and partnership work with industry are highly likely to have contributed to this reduction. Increased awareness of criminal organisation, improved security measures, and target hardening by businesses have also likely played a role.

Offenders continue to diversify both their methods and the enablers used to facilitate organised acquisitive crime activity. Online platforms remain a key tool for identifying victims, communicating with associates, identifying commodities in demand, and disposing of stolen goods. Targeting of renewable energy infrastructure was a notable trend in 2025, with wind turbines and electric vehicle charging cables increasingly targeted due to the high value of associated materials. Offenders have also continued to exploit a range of criminal tools and techniques, and organised crime groups remain agile in adapting their operating models to maximise opportunities across the organised acquisitive crime landscape.

Organised Immigration Crime

It is highly likely that an increase in organised crime group capability (through more organised launch tactics, such as the taxi boat method) and opportunity (through increased demand from Horn of Africa migrants) within the small boats threat drove an overall increase in the organised immigration crime threat to the UK in 2025 compared with 2024. There were 41,472 small boat arrivals to the UK in 2025, a 13% increase on 2024 (36,816). Despite a 3% decrease in UK small boat events in 2025 (672) compared with 2024 (695), organised crime groups increased the number of migrants per boat to enable more arrivals. The average number of migrants per boat arriving in the UK was 62 in 2025, a 17% increase on 53 in 2024.

2025 saw fewer migrant fatalities in the English Channel (27) than 2024 (78), highly likely due to intervention by rescue craft and fewer incidents of non-paying passengers opportunistically storming boats in the water.