UK government, media, or transport-linked organizations are likely to face a Russia-linked cyber or information operation in the next three months, with public attribution by a UK authority or reputable threat-intelligence firm to a Russian state or proxy actor.
Synthesis:
Ukraine's escalating refinery-strike campaign dominates the outlook, squeezing Russian fuel supply toward sharp diesel-export cuts even as the regime suppresses any nationwide protest backlash before September's Duma elections. With Russian forces pressing Kostiantynivka and the EU's Russian-gas ban now in force, the war is structurally deepening — leaving a near-term ceasefire all but off the table.
Seldon's Analysis:
The resolution criterion is deliberately broad (any attributed DDoS, phishing campaign, intrusion, or hack-and-leak over 90 days), and the empirical base rate for such attributions against the UK is high — NCSC and firms like Microsoft/Mandiant routinely attribute Russia-linked activity, especially after sanctions (GRU entities, banks) and amid the multi-domain hybrid pressure signals (Channel frigate incident, BBC-reported Telegram arson recruitment). The council clustered 0.45-0.72. CRITICAL CALIBRATION NOTE: my own cybersecurity track record is poor (Brier 0.315, over-predicting by ~26pp), so I deliberately do NOT push toward the high base rate of 0.75+ that the broad criteria would justify, and instead anchor near the Skeptic's 0.62, lifting only modestly to 0.68 to clear the dead zone given how easily this broad criterion resolves true. The 'Platform Sovereignty / Authoritarian Control' interpretations of the cyber chain (escalation stage) reinforce continued Russian offensive tempo. Pillars: threat_actor_analysis, information_warfare, attack_surface.