The Terrorism Threat in the UK: Attack Types and What Households Should Know

The UK's terrorism threat level is an assessment of how likely an attack is somewhere in the country, not how likely you are to be caught up in one. The current UK threat level is SEVERE, which means a terrorist attack in the UK is highly likely¹. At the same time, official guidance is equally clear that the chance of being caught up in a terrorist incident remains low, and that knowing what to do is the sensible response¹.

For a household, that means three practical things. First, know the Run, Hide, Tell advice, which Counter Terrorism Policing says can be used in many situations and places². Second, know the numbers: call 999 in an emergency, or the police anti-terrorist hotline on 0800 789 321 to report an immediate terrorist threat³. Third, know how to report anything suspicious in confidence at gov.uk/ACT⁴.

This page explains the threat level system, the kinds of attack the UK has faced, what to do in the moment, and where official help and guidance live.

What the threat level says, and what it does not

Terrorism threat levels are designed to provide a broad indication of the likelihood of a terrorist attack⁵. There are five UK national threat levels⁵, and each carries a plain meaning:

The level that matters most to the public is the gap between the headline and the personal risk. The current level is SEVERE¹, and it has not dropped below SUBSTANTIAL in the last five years, which means an attack is likely⁸. Yet the same official guidance that publishes the level also states that the chance of being caught up in a terrorist incident remains low¹. Both statements are true: the level describes the likelihood of an attack happening somewhere in the UK, while your own odds of being present at one stay low.

That is why the practical advice for households is not to change how you live, but to be prepared and know how to respond¹. The threat level mainly drives what the authorities and businesses do. At SEVERE, additional significant security measures are put in place, with specific enhanced measures for businesses and areas of vulnerability⁷. At SUBSTANTIAL and MODERATE, routine security measures are in place⁷. You may notice more visible policing or security at stations, venues and events when the level is high, and that is the system working as intended.

How the level is set and where to check it

The national threat level for the UK from all forms of terrorism is set by the Joint Terrorism Analysis Centre (JTAC)⁶. JTAC is responsible for setting the level, and it also sets the threat level from Northern Ireland Related Terrorism in Northern Ireland⁶. The levels have been in place since 2006 and were introduced to warn of the likelihood of terrorist activity⁷.

JTAC considers a defined set of factors when setting the level⁷:

• Available intelligence
• Terrorist capability
• Terrorist intentions
• Timescale

The levels have no expiry dates and can change at any time as new information and intelligence becomes available⁷. A level can move up or down without warning, so checking it occasionally is more useful than assuming it stays where you last saw it. You can check the current threat level to the UK on the UK Government website⁹, and ProtectUK publishes the same information with the reasoning behind the system⁶.

The threat levels consider the threat from all forms of terrorism, including Islamist terrorism, Extreme right-wing terrorism, Left Wing, Anarchist and Single-Issue Terrorism (LASIT), and Northern Ireland terrorism⁶. The national level covers all of these except Northern Ireland-related terrorism within Northern Ireland, which is assessed separately⁶. For more detail on each level and how it is announced, see UK Terrorism Threat Levels and What They Mean for You.

Northern Ireland's separate assessment

The threat level for Northern Ireland in Northern Ireland is set separately by the security services⁷. The National Risk Register 2025 records the current threat level for Northern Ireland related terrorism in Northern Ireland as substantial, meaning an attack is likely¹⁰. The threat from Northern Ireland-related terrorism to Great Britain is lower: it remains at Moderate, meaning an attack is possible but not likely¹¹. The reasonable worst-case scenario for this risk, as set out in risk planning, is a targeted terrorist attack in a public area in Northern Ireland, with the intended target a site viewed by dissident republicans as symbolic of the British state¹².

The kinds of attack the UK faces

The attacks the UK has experienced in recent years share a pattern. There has been an increase in the frequency of terrorist attacks in the UK from 2017, and nearly all attacks have occurred in publicly accessible locations¹³. In the UK, terrorists are assessed as more likely to use knives, vehicles or improvised explosive devices, although chemical, biological, radiological and nuclear (CBRN) attack methods cannot be ruled out¹⁰.

That assessment matters for households because it shapes the advice. A marauding attack with a knife, vehicle or firearm in a public place is the scenario the public-facing guidance is built around, and firearms and weapons attacks are rare in the UK¹⁴. The Run, Hide, Tell advice covers it directly. Vehicle and bomb attacks at venues are addressed through venue security, including Martyn's Law, covered below. CBRN methods are considered less likely but not impossible, and separate official guidance exists for chemical, biological and radiological attacks and for sheltering from a chemical or radiation release.

Planning documents also note the wider effects of an attack beyond direct casualties: an attack may temporarily impact utility supply, transport services and put pressure on emergency services¹². Households affected by cordons, transport shutdowns or disrupted utilities may find the general emergency kit and staying informed guidance useful in the hours that follow.

If you are caught in an attack: Run, Hide, Tell

The police advice for a firearms or weapons attack is to remember three words: Run, Hide, Tell¹⁵. Counter Terrorism Policing states that this advice can be used in many situations and places, not only in a terror attack². The National Risk Register records the Run, Hide and Tell campaign as the way people stay safe in the event of a marauding terrorist attack¹⁰.

Run. Run to a place of safety. Official guidance is blunt that this is a far better option than to surrender or negotiate¹. If there is a safe route out, take it, and insist that others leave with you if they will come. Leave belongings behind.

Hide. If you cannot run, hide. The ProtectUK guidance, published 21 May 2026, sets out what good hiding looks like¹⁶:

• Find cover that can withstand threats such as a knife attack or gunfire, for example substantial brickwork or heavy reinforced walls
• Remember that if you can see the attacker, they may be able to see you; cover from view does not mean you are safe
• Hide even behind a locked door
• Be aware of your exits and try not to get trapped
• Lock and barricade yourself in, and move away from the door
• Be quiet: silence your phone and turn off vibrate

Tell. When you can, call 999 and give the police information about the incident¹⁵. Armed police will respond to a weapons attack. When they arrive, follow their instructions exactly, keep your hands visible and empty, and avoid sudden movements; the detailed advice is on what to do when armed police arrive. For more on choosing a place of safety, see where to hide during a gun or knife attack, and for the full walkthrough, see Run, Hide, Tell: what to do in a weapons or terror attack.

Organisations are advised to assess the risk of a marauding terrorist attack and have a plan for immediate action, considering internal and external threats, evacuation, invacuation or lockdown, public warnings and staff training¹⁴. As a member of the public you may hear lockdown announcements or be directed by staff in venues: follow them.

Calling 999, and reporting what you have seen

In an emergency, always dial 999⁹. That applies whether you are caught in an incident, can see one happening, or are concerned about your safety or the safety of others⁹. If you witness an attack and get out safely, call 999 and pass on what you saw: locations, descriptions, the direction the attacker moved¹⁵.

For anything that is not an emergency, there are two routes. Dial 101 for non-urgent police matters, or the anti-terrorist hotline on 0800 789 321⁹. The gov.uk contact page gives the same split: call 999 or the police anti-terrorist hotline on 0800 789 321 to report an immediate terrorist threat³. If your information does not relate to an imminent threat, you can contact MI5 directly⁶.

Always report anyone acting suspiciously; your information may be vital⁹. Counter Terrorism Policing's standing message is to trust your instincts and report anything that could potentially be related to terrorism¹⁷. The sorts of behaviour the ACT campaign asks the public to flag include¹⁷:

• Someone who travels but is vague about where they are going
• Someone with multiple passports in different names
• Someone who looks at extremist material, or shares or creates content that glorifies terrorism
• Somebody promoting hateful ideas or extremist views

You can report online and in confidence at gov.uk/ACT⁴. The secure online form is the route most households will find easiest for non-urgent concerns⁹. For the full detail, see how to report suspicious activity or terrorism concerns.

Unusual purchases, deliveries and vehicle hire

Some of the most valuable reports come from everyday transactions. Counter Terrorism Policing asks whether a sale or rental has seemed unusual if you work in commercial vehicle hire or sales, and asks retailers to note anything suspicious about equipment purchases⁹. The public is asked to report¹⁸:

• Someone receiving deliveries for unusual items
• Unusual commercial vehicle hire or sales
• Buying large amounts of chemicals, fertilisers or gas cylinders for no reason
• Acquiring illegal firearms or other weapons

These reports go to gov.uk/ACT or the hotline, 0800 789 321¹⁸. None of this asks you to investigate anyone: report what you saw and let the police assess it.

Online content and scam messages

You can help stop the online presence of terrorists and extremists by reporting content such as speeches or essays calling for racial or religious violence, videos of violence praising terrorists, postings inciting terrorism, messages stirring up hatred against religious or ethnic groups, bomb-making instructions, and advice on obtaining or making weapons¹⁸. Separately, the PSNI's Protect Yourself booklet advises that in the UK you can forward scam text messages to Ofcom on 7726, free of charge, and forward suspicious emails to report@phishing.gov.uk¹⁵. For the detail on reporting extremist material, see how to report terrorist content online.

Bomb threats

Any bomb threat communication is a crime and should be reported to the police by dialling 999¹⁹. If you receive a threat call, if practical, keep the caller talking and alert a colleague to dial 999¹⁹. There is a separate checklist for what to do and record if you get a bomb threat call, and for unattended items, see the HOT protocol and safe distances.

First aid after an attack and Public Access Trauma kits

The Department of Health and Social Care and the National Counter Terrorism Security Office recommend the adoption of Public Access Trauma (PAcT) First Aid Kits²⁰. A PAcT First Aid Kit supports the treatment of immediate, life threatening injuries such as major bleeding and people who are not breathing on their own²⁰. The kits are for use by any person, regardless of their level of training²¹, which is the point of them: in a mass casualty event, bystanders treat the injured before emergency services can reach everyone.

The kits will significantly enhance an organisation's existing first aid preparedness, increase first aid resilience amongst the general public and ultimately improve the survivability of a person with life threatening injuries²¹. PAcT First Aid Kits must be located in publicly accessible locations and areas to which people can easily access²⁰, and ProtectUK advises they are easily identifiable in a coloured, sealed pack or container, clearly labelled 'Public Access Trauma First Aid Kit' with a clearly visible white cross on the front²¹.

What this means for you as a visitor is simple: look for these kits where you go. Organisations are advised to ensure all individuals within the premises are aware of the kit's location, use and contents²¹. If you are caught in or near an incident and someone is bleeding heavily, a PAcT kit is designed so you can use it without training²¹. For bleeding control and other basics, see first aid at home, and for chemical or corrosive injuries, acid or corrosive attack: how to help straight away.

Police exercises in public places

Counter Terrorism Policing prepares to respond to attacks and reduce their impact, responding as quickly and efficiently as possible if the worst happens²². To help prepare, it regularly tests response methods by holding exercises in partnership with other emergency services, local and national government departments and the military²². Many exercises are held in public buildings to make them as realistic as possible²².

So you may one day come across armed police, cordons or announcements in a station, shopping centre or stadium that turn out to be an exercise. This is planned and routine. Locally, the same pattern holds: police, national agencies and local authorities work together continuously to ensure regions are prepared for and protected from malicious attacks⁹. If you are unsure whether something is an exercise or a real incident, follow any instructions being given and move to a place of safety; official channels will confirm what is happening.

Martyn's Law and venue security

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025¹. The Government announced the Protect Duty, to be known as Martyn's Law, in tribute of Martyn Hett, who was killed alongside 21 others in the Manchester Arena terrorist attack in 2017²³.

The draft legislation behind it was published earlier, and would require certain premises and events to take forward reasonably practicable mitigations²⁴. In practice, you can expect venues such as arenas, stadiums, festivals and larger pubs and shops to have thought through evacuation, lockdown, staff training and first aid provision, including PAcT kits. The government provides free advice, guidance and training through ProtectUK for marauding terrorist attacks¹². For what changes at the places you visit, see Martyn's Law: what it changes at venues you visit.

Terrorism in the wider picture of national security

Terrorism is one of several threats the government tracks. The main threats to national security within the UK are terrorism, espionage, cyber-attacks and the proliferation of weapons of mass destruction⁷. These can impact the UK's national infrastructure⁶.

For a household, the practical overlap is with cyber-attacks, which can take out payments, communications and online services; the cyber attacks guidance covers that. The National Risk Register also records the public campaigns that go with these risks: Run, Hide and Tell for marauding terrorist attacks, WeatherReady for severe weather, and Cyber Aware for online security¹⁰. Households can read official advice on what to do in a marauding terrorist attack, how to report suspicious packages or behaviour, how to stay secure online, and the latest MI5 and JTAC terrorism threat levels¹².

Where to get help and official guidance

ProtectUK provides counter terrorism security information including training materials, protective guidance and campaign toolkits for business owners, security workers and the public². Whether you are a business owner, work in security, or are a member of the public, ProtectUK is the central official resource⁴. Free ACT Awareness e-Learning is available; see ACT Awareness training.

After an incident, the Victims of Terrorism website provides information on how to get help and advice following a terrorist attack, and signposts to official helplines and support services available to victims, survivors, witnesses, family members and all those affected²³. See also support for victims and families after a terror attack. Businesses and local communities can contact Counter Terrorism Security Advisers through their police force; in Lancashire, for example, enquiries go to CTSA@lancashire.police.uk²³.

If you are worried someone you know is being drawn into extremism, see worried a family member is being radicalised. For the full range of terror, chemical and radiation emergencies, start at major incidents: a household guide, and for general household readiness, getting started.