UK Terrorism Threat Levels and What They Mean for You

The UK uses five national terrorism threat levels to give a broad indication of how likely a terrorist attack is. They are set by the Joint Terrorism Analysis Centre (JTAC), they cover the whole of the UK as a single level, and they have been in place since 2006¹. The levels have no expiry date and can change at any time as new intelligence comes in².

At the time this page was last checked, the government's Prepare campaign stated the UK terrorism threat level was SEVERE, meaning an attack is highly likely, as of 12 October 2026³, and a London preparedness update from 25 October 2026 also reported the threat from international terrorism as Severe⁴. The threat levels have no expiry dates and can change at any time as and when new information and intelligence becomes available, so always check the current level on the UK Government website rather than relying on a cached news story⁵.

For an ordinary household, the threat level is background information, not an instruction. The chance of being caught up in a terrorist incident remains low³, and the practical steps that matter are the ones that apply whatever the level: know how to report suspicious activity, know the RUN HIDE TELL advice, and be aware of your surroundings in crowded places.

The five threat levels and what each one means

There are five UK national threat levels⁷. Each one is a statement about the likelihood of a terrorist attack in the UK, nothing more and nothing less: it is not a prediction of where, when or how an attack might happen, and it does not trigger any specific action from the public.

The levels are designed to give an indication of the likelihood of a terrorist attack¹. That wording matters. A higher level tells you that the security services' judgement of the likelihood has changed; it does not tell you that a specific attack is planned, that a specific place is at risk, or that you should change your plans. The police and security services act on far more detailed assessments than the single published level.

What each level does change, in practice, is the security response at sites and venues, which is described separately below. At Substantial and Moderate, routine security measures are in place, with low and moderate measures appropriate to the businesses concerned. At Severe, additional significant security measures are put in place, with specific enhanced measures for businesses and areas of vulnerability. At Critical, maximum security is put in place².

For context on how the level has moved over time: a Lincolnshire resilience plan published in 2026 notes that the level has not dropped below Substantial, meaning an attack is likely, in the last five years⁹. Attacks of this kind remain very rare in the UK, as Counter Terrorism Policing's own public guidance states¹⁰.

Checking the current level

You can check the current threat level to the UK on the UK Government website⁵. That is the authoritative source, and it is the one to trust when news reports or social media posts disagree. Local resilience forums and preparedness sites republish the level, but they can lag behind a change.

A few points worth knowing when you check:

• The level can move up or down at any time, with no announcement schedule².
• A change is sometimes reported in the news before you see it reflected elsewhere; the Government website is the place to confirm it⁵.
• The published level is national. There is no published level for London, Manchester, Birmingham or any other city².

If you want to go deeper than the headline level, the National Risk Register sets out the government's wider assessment of risks facing the UK, including malicious attacks, and local resilience forums publish community risk registers that cover their own areas¹¹. For households, the practical companion to the threat level is knowing what to do in an attack, which is covered in our guide to Run, Hide, Tell.

What a higher threat level means for your day-to-day life

For most people, the honest answer is: very little changes in your daily routine. The threat level is a tool for the police, security services, businesses and venue operators, not a signal for the public to stay home. The government's own advice is that although the chance of being caught up in a terrorist incident remains low, it is important to be prepared and know how to respond³.

What you may notice at a higher level is more visible security. At Severe, additional significant security measures are put in place, and specific enhanced security measures are applied to businesses and areas of vulnerability². In practice that can mean more bag checks, more police patrols, longer entry queues at events, or barriers and checks at transport hubs. These are the visible parts of the response, and they are the ones the public is meant to see.

What the level does not mean:

• It is not an instruction to avoid crowded places, events or public transport.
• It does not identify a target, a method or a timescale.
• It does not require any action from you beyond ordinary awareness.

The sensible household response to any level is the same set of habits: know the RUN HIDE TELL advice, know how to report suspicious activity, be aware of exits and your surroundings in crowded places, and talk as a family about what you would each do if something happened while you were apart. Surrey's emergency planning guidance puts it simply: if you do find yourself in danger, follow the police advice to Run, Hide, Tell¹².

Who sets the threat level: the Joint Terrorism Analysis Centre

The Joint Terrorism Analysis Centre (JTAC) is responsible for setting the national threat level for the UK from terrorism¹. JTAC also sets the threat level from Northern Ireland-related terrorism in Northern Ireland¹.

JTAC is part of the UK's security apparatus, working alongside the Security Service (MI5). The National Risk Register records that households are encouraged to read the latest updates to the Joint Terrorism Analysis Centre and Security Service (MI5) terrorism threat levels as part of being informed about hazards¹¹. In other words, the government treats the published level as public information that anyone can and should be able to find.

The reason a single specialist body sets the level is consistency. One centre looks at all the intelligence, from every source, and makes one judgement for the whole country. That judgement is then used by police forces, venue operators, transport providers and local resilience forums across the UK to decide what security to apply, without each of them making their own separate call on the overall likelihood of an attack.

How the level is decided

When setting the threat level, JTAC considers a defined set of factors²:

• Available intelligence: what the security services actually know at that moment.
• Terrorist capability: what attack methods plotters are able to carry out.
• Terrorist intentions: what they are trying to achieve.
• Timescale: how soon any planned activity might happen².

These factors are weighed together to reach a judgement on the appropriate threat level¹. The judgement is about likelihood, not certainty, and it is only as good as the intelligence behind it, which is one reason the level can move suddenly when new information comes in.

It is worth understanding the range of threats that feed into this judgement. Threat levels consider the threat from all forms of terrorism, including Islamist terrorism, extreme right-wing terrorism, Left Wing, Anarchist and Single-Issue Terrorism (LASIT), and Northern Ireland terrorism¹. The methods terrorists may use within the UK are similarly broad, ranging from marauding attacks and vehicle attacks to improvised explosive devices, fire, chemical, biological or radiological attacks, and other attack types such as cyber attacks or drones¹³. Our guide to the terrorism threat in the UK covers these attack types in more detail.

One level for the whole UK, with a separate level in Northern Ireland

The threat levels are for the UK as a whole and do not vary or change for any individual areas². There is no published threat level for your town, city or county, and no mechanism for one region to be at Severe while another is at Substantial. If the police judge that a specific location or event faces a specific risk, they respond with targeted operations and site security rather than by changing the national level.

The one exception is Northern Ireland. The national threat level covers all forms of terrorism aside from Northern Ireland-related terrorism within Northern Ireland, which is set separately by the security services². So there are effectively two published levels to be aware of:

There is also a third, related level that gets less attention: the threat from Northern Ireland-related terrorism to Great Britain. A London preparedness update of 25 October 2026 reported that this remains at Moderate, meaning an attack is possible but not likely⁴. The National Risk Register for 2025 recorded the threat level for Northern Ireland-related terrorism in Northern Ireland as substantial, meaning an attack is likely¹⁴. As with the national level, check the UK Government website for the current position⁵.

Threat levels have no expiry date

Threat levels do not have any set expiry date, but they are regularly subject to review to ensure that they remain current¹. They can change at any time as and when new information and intelligence becomes available².

This has two practical consequences for households. First, any figure you read about "how long the level has been at X" is a snapshot, not a rule: the Lincolnshire plan's observation that the level has not dropped below Substantial in the last five years⁹ describes history, not a guarantee about the future. Second, there is no point in the year, month or week when a change is more likely, so there is nothing to plan around. A change can come after an incident, after an intelligence development the public never hears about, or as a routine reassessment.

The system itself has been running a long time. The levels have been in place since 2006, put in place to warn of the likelihood of terrorist activity². ProtectUK, the central hub for counter terrorism and security advice that now publishes much of the public-facing guidance, was launched in 2022¹⁵.

Response levels: the security you see at venues and sites

Threat levels and response levels are two different things, and the difference matters if you are trying to work out what a change actually means on the ground.

Response levels tend to apply to sites. They give a general indication of the protective security measures that need to be applied at a given time, depending on the current UK national threat level and any specific assessments of vulnerability and risk at that site⁷. So while the threat level is one national judgement, the response level is a local decision: a stadium, a shopping centre, a power station and a school can each be at different response levels on the same day, even though the national threat level is the same for all of them.

The response levels themselves are straightforward in outline:

What is deliberately not published is the detail. As the official guidance states:

ProtectUK, official guidance on threat and response levels⁷

This is why you will not find a public checklist of exactly what each venue must do at each response level. The bag check you see at a concert is the visible tip of a set of measures whose full extent is kept private on purpose. Venue operators can find the detailed guidance through ProtectUK; as a visitor, the practical point is simply that security may visibly increase when the national level rises, and that cooperating with checks is the fastest way through.

Since 3 April 2025, Martyn's Law has placed further duties on public premises and events to strengthen their security, which is covered in our guide to Martyn's Law and what it changes at venues you visit.

If you see something suspicious

The single most useful thing any household can do at any threat level is report what does not look right. Official guidance is consistent on this: always report anyone acting suspiciously, because your information may be vital, and if you come across anything that might be linked with terrorist activity, tell the police⁵.

The numbers to know:

• In an emergency, always dial 999. Use this if you are caught in an incident, or if what you are seeing is an immediate threat⁵.
• Anti-terrorist hotline: 0800 789 321. A confidential line for reporting suspicious activity or behaviour when it is not an emergency¹⁶.
• Online reporting: you can use the secure online form at gov.uk/ACT⁵.
• 101: the police non-emergency number, which some forces also list for reporting concerns⁵.

North Tyneside Council's guidance captures the spirit of the advice: report any suspicious activity or behaviour to the confidential Anti-Terrorist Hotline on 0800 789 321, and in an emergency call 999¹⁷. Sussex resilience guidance adds further routes: the ACT Early Support Line on 0800 011 3764 for concerns about radicalisation, open daily 9am to 5pm, and Victim Support's free 24/7 line on 0800 168 9111¹⁷. If you are worried someone you know is being drawn towards extremism, our guide on radicalisation concerns sets out the signs and where to get help.

You do not need to be sure, and you do not need evidence. Lancashire's preparedness guidance is typical of the official message: when reporting suspicious activity, in an emergency always dial 999¹⁸. Trained officers assess every report; the one thing that helps no one is assuming someone else has already rung.

RUN HIDE TELL: the advice that applies at every level

Whatever the threat level is on any given day, the personal advice in an actual terrorist attack is the same, and it is short: RUN, HIDE, TELL. Counter Terrorism Policing's guidance, published on ProtectUK, sets out what each step means¹⁹.

1. RUN to safety if there is a safe route. Running is always the best option if there is a safe way to do so²⁰.
2. HIDE if you cannot run. Find cover that can withstand threats such as a knife attack or gunfire. If you can see the attacker, they may be able to see you, so cover from view does not mean you are safe. Hide even behind a locked door, lock and barricade it, move away from the door, be aware of exits and try not to get trapped. Be quiet: silence your phone and turn off vibrate¹⁹.
3. TELL the police by calling 999, but only when it is safe to do so³.

Two reassurances sit alongside this advice. First, as the RUN HIDE TELL leaflet states, attacks of this nature are still very rare in the UK¹⁰. Second, these steps can help save lives and prevent casualties in the event of an attack, which is why the guidance is taught in schools as well as published for adults²¹. A lesson plan produced for key stage 4, with an accompanying key stage 3 lesson, teaches the procedure for gun or knife attacks²⁰, and ProtectUK's teaching guide describes it as vital learning material for schools and educational institutions²¹.

Caption: The three steps of RUN HIDE TELL, as taught by Counter Terrorism Policing.

If you want the full detail, including where to hide and what to do when armed police arrive, read our guides to Run, Hide, Tell, where to hide during a gun or knife attack, what to do when armed police arrive, and what young people should do in a terror attack. For unattended bags and packages, the separate HOT protocol and safe distances are covered in our guide to suspicious items.

Where this fits in your household preparations

The threat level system is one small piece of the wider picture of household preparedness. The government's Prepare campaign treats terrorism alongside the other hazards households should be informed about, from flooding to power cuts³, and the National Risk Register encourages households to read the latest threat level updates as part of staying informed¹¹.

The practical takeaways for an ordinary household are few and simple:

• Know the current level, checked on the UK Government website, and treat it as background rather than instruction⁵.
• Know the two numbers: 999 in an emergency, 0800 789 321 for the anti-terrorist hotline¹⁶.
• Know RUN HIDE TELL well enough to act on it without thinking¹⁹.
• Report anything suspicious without waiting to be certain⁵.
• Expect visible security to increase at venues when the level rises, and allow a little more time when you go out².

Beyond that, the same general preparedness that carries a household through any emergency, a grab bag, a plan for staying informed, and an agreed family plan, serves just as well here. Our major incidents guide brings together the terrorism pages with chemical, radiation and other incident advice in one place.