Summary Title

The SOC Threat in 2026

SOC is one of the UK’s most persistent and harmful threats. In 2025, the threat continued to become more diverse, with criminal groups exploiting fast-moving technologies, working in looser alliances, and using specialist facilitators to cause more harm at greater scale. 

In 2026, four cross-cutting trends define and drive the SOC threat to the UK:

  • Technological transformation is reshaping SOC, as rapid digital change increases scale, automation, and routes into offending.
  • Criminal markets are converging and expanding as global criminal groups increasingly diversify and collaborate.
  • Global instability is driving developments in SOC, as conflict and geopolitical pressures create new criminal opportunities.
  • Harms from SOC are being felt more intensely across society, with growing impacts on individuals, communities, and national resilience.

These trends have almost certainly expanded the reach and impact of SOC, with rapid technological change acting as the primary driver of this evolution. The overall threat is highly likely to continue increasing over the next 18 months, challenging not just law enforcement but society as a whole, including government, industry, and communities.

How SOC is Evolving | Drivers and Enablers

Technological Transformation

Technological change is no longer simply an enabler of SOC; it is almost certainly reshaping it at scale. Digital tools are transforming how criminal groups operate, increasing their reach, sophistication, and resilience. For example, social media platforms allow offenders to identify and target victims, recruit technical specialists, expand their operations, and operate across jurisdictions with vastly greater scale and ease.

The increased functionality, scale, and development of artificial intelligence tools and their adoption by offenders will enhance and enable SOC activity. Increasingly accessible artificial intelligence tools and large language models are lowering barriers to entry by providing individuals with limited technical expertise with the capability or tools needed to offend. Artificial intelligence use has been most visible in the production of increasingly realistic child sexual abuse material and in improving the effectiveness of fraud activity, but is also enabling cybercrime, money laundering, and organised immigration crime activity.

Younger, digitally native offenders are the first generation to have grown up within integrated online and offline environments and are almost certainly more attuned to their exploitation for criminal gain. 

Social media and communication platforms, including Discord, Facebook, Instagram, Snapchat, Telegram, TikTok, and X, are attractive due to their audience reach, interconnectivity, and the perceived anonymity they grant users.

Online spaces that offer support, community, and connection for vulnerable children are highly likely targeted by offenders. The proportion of children reporting upsetting online experiences rose to 25% in 2025, from 10% in 2024. Popular gaming platforms such as Roblox and Minecraft continue to be used to target children.

An estimated 80% of migrants facilitated to the UK via small boats used social media to locate or communicate with an agent working as part of an organised crime group at some stage in their journey, with TikTok highly likely the primary platform used to promote the services of organised immigration crime groups.

Organised crime groups are increasingly using individuals with chemical or scientific expertise to produce and extract drugs within the UK. The use of chemically concealed cocaine is becoming more sophisticated, requiring specialist knowledge to extract the drug on arrival. Illicit laboratories present significant risks, including exposure to harmful substances and the potential for explosions. Equipment and precursor materials are often sourced online, with little regard for safety standards.

Organised crime groups and prisoners are highly likely increasingly using drone experts providing services across multiple groups. Custom-built drones enable larger payloads, more frequent use, and remote ‘beyond line of sight’ operation. SOC use of drones is likely to expand in the next few years. 

The Diversification, Expansion, and Convergence of Criminal Activity

There has been a long-term trend in SOC offenders broadening the range of criminal activities, commodities, and methodologies they engage in; however, in recent years opportunities presented by new and evolving technologies, alongside the growing as-a-service marketplace mean that it is almost certainly easier than ever for offenders to diversify and grow their influence and profitability. 

Human enablers, including complicit and unwitting professional enablers, corrupt individuals, and sometimes members of the community, play a critical role in ensuring that SOC activity remains hidden.

Online platforms make it easier for criminals to access specialist services, allowing groups to outsource key functions rather than retain them internally. This has contributed to more fragmented and networked operating models. For example, organised crime groups frequently outsource money laundering to specialist networks. Russian-speaking money laundering networks, in particular, service a wide range of clients. This includes transnational organised crime groups and, in some cases, state-linked actors, enabling the movement and concealment of criminal proceeds.

Foreign states use criminals as proxies for illegal activity in the UK, offering plausible deniability and ease of employment. In 2025, state-linked interests were connected to cybercrime, drug and firearms trafficking, fraud, money laundering, and violent crime.

Exploitation of Global Instability and Geopolitics

It is likely that most SOC impacting the UK has direct or indirect overseas links. Technology enables organised crime groups to exploit global instability, conflict, weak governance, corruption, and differences in international law and enforcement. For example, fraud compounds, first detected in South East Asia, have expanded their operations and are spreading globally, with SOC groups exploiting areas affected by conflict and weakened governance.

Powerful and accessible new technology enables offenders to bypass state infrastructure and to operate remotely, allowing criminals to target the UK from around the world. For example, the use of Starlink communications networks by fraudsters in 2025 made it possible for them to continue operating for a time when other internet services had denied them.

Transnational organised crime groups from China and the Western Balkans remain persistent threats. Organised crime groups from China are highly likely among the most significant threats to the UK, with roles in fraud compounds, drug precursor supply, synthetic opioids, and underground banking. Western Balkan organised crime groups highly likely retain the highest level of control over the end-to-end supply of cocaine into the UK.

SOC remains a persistent and embedded threat to the UK’s national security. Its impact undermines border security, weakens governance, and erodes public trust in institutions. The cumulative harms experienced by large numbers of individuals can create heightened public fear and community tensions.

SOC also imposes substantial economic harm. It distorts legitimate markets and undermines the confidence that underpins investment and growth. These economic impacts are compounded by links to state threats and by offenders’ exploitation of global vulnerabilities, making SOC not only a law enforcement challenge but a wider threat to the UK’s economic security and long‑term resilience.

Impact on Communities

Illicit drug markets remain the main driver of SOC in UK communities and are continuing to grow in scale and harm. Firearms are often used to protect drug businesses; modern slavery victims are used in drug production; and the billions of pounds generated annually from the UK illegal drug trade are laundered in the UK and overseas, fuelling further criminality. Violence, including firearms offences, knife crime, kidnap, and extortion, is frequently associated with the drug trade. The threat to the UK from illicit drugs remains high and likely increased in 2025.

Levels of SOC-related violence are highly likely to have remained broadly stable, with drug supply continuing to drive most firearm use. There is unlikely to have been a significant change in criminals’ overall ability to source and use firearms in 2025. However, the criminal use of counterfeit firearms is highly likely increasing, partly driven by reduced availability of original lethal-purpose and converted blank-firing weapons. Counterfeit firearms are of better quality, and can use more powerful ammunition, than the converted top-venting blank-firers most prevalent in firearms criminality in 2023 to 2024.

A small number of UK-based criminals use children and individuals outside their core networks to carry out violence-as-a-service, including firearms offences. The UK has not experienced this at the scale observed in parts of northern and nearby European countries in 2025, where organised crime groups have increasingly outsourced serious violence to third parties.

Many SOC-linked crimes within communities (including extortion, kidnap, intellectual property theft, organised prostitution, protection rackets, waste crime, and wildlife crime) are almost certainly under-reported, but generate substantial profits used to support further criminality.

Impact on Governance and the Border

Organised crime groups looking to transport illicit commodities or facilitate people into the UK must find ways to evade border controls. It is likely that the overall SOC risk to the UK posed by organised crime groups at the border has increased in 2025. 

The threat from organised immigration crime likely increased in 2025, primarily driven by adaptations to small boats facilitation models, including higher numbers of migrants per vessel. These crossings continue to pose significant risks to life and safety, with fatalities and injuries occurring in dangerous maritime conditions. Beyond the immediate human harm, increased irregular arrivals add sustained operational and financial pressures to UK border and asylum systems, while the visible demonstration of criminality can amplify community tensions.

Corruption is almost certainly a key enabler of SOC. Whilst it can occur within international supply chains, it is also a domestic threat and is likely to be significantly under-reported. In the UK, local government and construction are assessed as among the sectors most exposed to bribery and corruption risks. High levels of procurement activity and subcontracting arrangements in these sectors create vulnerabilities that can be exploited.

Impact on the UK Economy

SOC imposes substantial economic costs, which can undermine growth and resilience. The Jaguar Land Rover ransomware incident was very costly, to the extent that it affected gross domestic product. In October 2025, the Cyber Monitoring Centre, a non-profit organisation, assessed this to be the most economically damaging cyber event to hit the UK, with an estimated cost to the UK economy of £1.9 billion. Fraud cost England and Wales an estimated £14 billion in 2023 to 2024 and remains the most prevalent headline crime, estimated to be 45% of all crime.

Organised acquisitive crime continues to cause losses and infrastructure disruption. Criminals are increasingly targeting valuable metals from renewable energy sites, causing substantial losses and disrupting green energy production and hindering progress towards the UK’s climate goals.

SOC offenders use high street businesses, including barber shops, minimarkets, nail bars, and vape shops, to support criminality, distribute illicit goods, engage in illegal working, or launder funds. These practices undermine legitimate businesses, damage consumer confidence, and harm local investment.