UK and US to stage “cyber attack war games” involving commercial banks to test critical national infrastructure
Context & Ripple Effects
This 2015 exercise is an early data point in the UK–US playbook of rehearsing attacks on financial infrastructure alongside the private banks that operate it — years before NATO's wargames first added scenarios on widespread cyberattacks against financial systems in 2021.
The drill also foreshadows the direction of UK policy since: the government has steadily widened what counts as protected infrastructure, including giving data centers Critical National Infrastructure designation in 2024, while MI5 has been stepping up joint work with the country's largest companies as economic-damage fears mount.
First-order effects
- Commercial banks in both countries move from passive targets to active participants in national defense planning, exposing their own resilience gaps under simulated attack conditions.
- UK and US security agencies gain a shared, tested picture of how a cross-border attack on banking infrastructure would propagate — and where coordination between the two governments breaks down.
Second-order effects
- Allied institutions follow the bilateral template: once the UK–US format proves out, NATO's later decision to put financial-infrastructure scenarios into its own wargames shows the model scaling from two countries to the alliance.
- Banks that perform poorly in these exercises face pressure from regulators and security services to harden systems, shifting security spending toward the institutions the state now treats as critical infrastructure.
Third-order effects
- If the pattern holds, the line between military cyber defense and private financial operations keeps dissolving — culminating in formal structures like CNI designations and standing government-corporate channels rather than one-off drills.
- Exercise-based testing also becomes a talent pipeline, as seen in the UK's Cyber Security Challenge simulations that companies already use to recruit defenders.
The trend: Critical infrastructure cyber defense is shifting from government-only planning to recurring joint exercises and formal partnerships that pull commercial banks directly into national security operations.