Organised Criminal Groups: A New Challenge for CNI Operators
Organised Criminal Groups: A New Challenge for CNI Operators,
By Frank Doherty, Managing Director
The scale of serious and organised crime in the UK is significant, with the Government's Integrated Security Fund Annual Report 2024–25 estimating that it costs around £40 billion every year.
These numbers represent more than financial loss. It represents disruption to public services, and an increasingly direct threat to the infrastructure in which the UK depends on every single day.
For many Critical National Infrastructure (CNI), organised criminal groups (OCGs) remain a secondary concern, sitting behind state actors and cyber threats in the security risk register. The National Crime Agency ‘s National Strategic Assessment 2026 suggests that position needs to be reconsidered.
Understanding the Threat: What Organised Criminal Groups Actually Look Like in 2026
Organised criminal groups (OCGs) are structured networks that collaborate to commit serious crimes for financial or strategic gain. Unlike opportunistic offenders, they are increasingly sophisticated in how they operate and exploit vulnerabilities.
The NCA’s National Strategic Assessment 2026 marks a significant shift in how the threat is framed. For the first time, the assessment moves away from individual crime types to examine five domains in which serious and organised crime operates. These domains include UK communities, borders, transnational networks, online environments, and finance.
Two major findings from the 2026 assessment which are specifically relevant for CNI operators are:
- Transnational Reach: Organised crime groups from China and the Western Balkans are identified as among the most significant and persistent threats to the UK. These are not loosely affiliated networks. They are structured, well-resourced organisations with the capability and reach to target sensitive and critical environments.
- State-criminal convergence: The line between organised criminal activity and state-sponsored threats is becoming increasingly difficult to distinguish. Parliamentary evidence submitted to the Home Affairs Committee notes that organised crime groups should now be considered as capable threat actors particularly where they are acting in a proxy capacity on behalf of hostile states.
For CNI operators, this convergence between criminal networks and state-linked actors represents a fundamental change in the risk profile that security frameworks are being asked to defend against.
How Organised Criminal Groups Are Exploiting Physical CNI Vulnerabilities
The conversation around organised crime and CNI has been dominated by the digital dimension. Ransomware, data breaches, and network intrusions are the real and significant threats but not the whole picture.
The assessment highlights a trend that deserves far greater attention from physical security professionals. Criminals are increasingly targeting valuable metals from renewable energy sites, causing substantial losses, disrupting green energy production and hindering progress towards the UK’s climate goals. These are not merely incidences, but evidence of a deliberate, coordinated targeting of physical CNI assets by organised criminal groups.
The insider threat adds another dimension. Corrupt personnels at ports, and critical sites are actively facilitating criminal access by exploiting their positions to bypass physical security control. The NCA is explicit on this point that organised crime groups actively seek individuals willing to facilitate crime from within.
What CNI Operators Must Address Now
The evidence clearly suggests that organised criminal groups represent a credible, capable and growing physical security threat to the UK infrastructure. The rising annual cost of organised crime to the UK economy reflects it. And the increasing convergence between criminal networks and state-sponsored actors makes it more urgent than ever.
Yet the physical security frameworks at the sites do not address the threat of environment they are being asked to defend. Perimeter design, access control architecture, surveillance coverage, and insider threat protocols were built around assumptions that the current evolving threat picture no longer supports.
Three areas which demand immediate attention from CNI includes:
- Threat and vulnerability assessment: Security risk assessments must explicitly account for OCGs as a primary threat actor. Their methodology, capability, and targeting behaviour must inform the assessment from the outset.
- Physical security design: Perimeter security, access control, and surveillance systems must be designed and reviewed against the actual capability of modern organised criminal groups.
- Insider threat protocols: The NCA is unambiguous that corrupt insiders are actively recruited and exploited by OCGs to bypass physical security controls. Robust vetting and behavioural monitoring should not be optional at CNI sites.
The question for every CNI is a straightforward one. When was your physical security design last assessed against the environment threats that actually exist today?
The Road Ahead for CNI Physical Security
Organised criminal groups are no longer a peripheral concern for CNI operators. The 2026 threat picture documented by the NCA, evidenced in parliamentary submissions, confirms that they have become a primary threat actor against which CNI physical security must be designed and tested.
The legislative and law enforcement response is strengthening. The merger of the NCA and Counter Terrorism Policing into a new National Police Service reflects a recognition that as criminality becomes more interconnected, so must the response to it.
But legislation and law enforcement alone do not secure a perimeter. They do not redesign an access control system. They do not close the physical vulnerability that an organised criminal group has already identified and is already planning to exploit.
The physical security frameworks protecting the UK’s most critical assets must reflect the threat environment that exists in 2026.
