Strength without depth? From Defence Investment to Integrated Readiness

Introduction

Although “sentimentally attached” to the United Kingdom (UK) in particular, the United States (US) has signalled that “enabling Europe to stand on its own feet …, including by taking primary responsibility for its own defence, without being dominated by any adversarial power” comprises its policy priorities for Europe ¹, thus marking a fundamental shift in the transatlantic relationship traditionally led by the US. This shift requires European states to assume greater responsibility for deterrence across the full escalation spectrum, including the conventional-nuclear interface.

The Strategic Defence Review (SDR) 2025² embraced warfighting readiness, integrated force design, industrial renewal, strengthened homeland defence, and greater UK responsibility within the North Atlantic Treaty Organization’s (NATO’s) nuclear mission. Government accepted all 62 recommendations, with the Defence Investment Plan (DIP) 2026³ allocating £298 billion over four years to implementation. The UK has therefore recognised and begun implementing many relevant priorities. The unresolved question is whether these measures will become timely, integrated, sovereign where necessary, and demonstrably capable of preserving the decision corridor.

The ‘decision corridor’ is the political and operational space available for controlled choices to be made; it consists of the time available to verify events, confidence in information and warning, continuity of authoritative communications – and the availability of credible options below strategic nuclear use. The corridor narrows when ambiguity, system disruption, communications failure, or insufficient conventional capacity reduce the conditions for controlled choice.

Preserving this corridor has become more difficult in a multi-domain and alliance-dependent security environment. Cyber systems, space-enabled warning, airspace and missile defence, command and control (C2), and conventional forces increasingly depend upon shared data, infrastructure, and multinational decision-making processes. These connections can widen the corridor by improving warning, resilience, and available response options, but they can also transmit disruption rapidly between domains and introduce dependencies, competing assessments, and alliance-coupling pressures. UK deterrence must therefore be integrated with NATO without becoming dependent upon allied availability for essential national functions. Alliance capability should reinforce the sovereign capacity needed to verify events, maintain political control, protect the homeland, and continue operating if external connectivity or support is delayed or degraded.

The ‘decision corridor’ is the political and operational space available for controlled choices to be made; it consists of the time available to verify events, confidence in information and warning, continuity of authoritative communications – and the availability of credible options below strategic nuclear use.

An announced or acquired capability contributes credibly to deterrence only when trained personnel can operate it, sufficient capacity exists at the required scale, adjacent systems are integrated, and the function can be sustained under attack and translated into political choice. Britain therefore needs a way to test whether investments and programmes across individual domains add up to a coherent deterrence architecture.

This policy brief explores whether recognised priorities and funded programmes produce an integrated deterrence architecture that preserves Britain’s decision corridor before the threat environment overtakes it. We identify a five-domain framework — cyberspace, airspace and missile defence, C2, conventional military, and nuclear posture — that is critical to the UK’s decision corridor and assess whether current programmes will produce integrated readiness in and across them. To do this, we test the capability of each domain against five stages: whether policy has been recognised, resources committed, capability delivered, capacity and readiness established, and strategic effect demonstrated.

This analysis argues that defence investment will not translate into integrated readiness as long as capabilities remain fragmented, externally dependent beyond prudent limits, inadequately staffed, insufficiently assured, or introduced faster than the development of the workforce, doctrine, and institutional experience required to operate them coherently. Under those conditions, Britain risks strength without depth and a decision corridor that remains fragile under pressure.

Five-domain evaluation framework: the decision corridor and layered deterrence

The framework (Figure 1) organises the five domains – cyberspace, airspace and missile defence, C2, conventional military, and nuclear posture – as interconnected layers within the wider deterrence system, shaping how escalation develops and is managed in practice.

The outermost layer of the model is the cyberspace domain, which encompasses networks, computer systems, information infrastructure, and both offensive and defensive capabilities. This domain has become a primary arena for disruption, where attacks can degrade systems, create ambiguity, and affect the functioning of all subsequent layers.

Because cyberspace activity often distorts/disables detection networks, moving inward, the next domain of the model is airspace defence capabilities – specifically air and missile defence, including its space-enabled warning and Intelligence, Surveillance, and Reconnaissance (ISR) dependencies, which play an increasingly critical role in how states detect, track, and respond to threats such as missiles, aircraft, and uncrewed systems. It sits as its own domain because it shapes how a nation perceives incoming threats and how much time is available for response.

C2 forms the hinge of the framework, converting information from sensors, intelligence, and operational systems into coordinated and authorised action. Effective C2 capability is important across all domains because it is the bridge between data, planning, and action, as represented by the orange arrows emanating outwards from the C2 domain in Figure 1. Greater integration may improve awareness and resilience, but it can also increase dependence, attack surfaces, entanglement, and the risk that operational action outpaces political control.

Beyond this, conventional forces provide the principal means through which states conduct and contest military operations below the nuclear threshold. For nuclear-armed states and their allies, they offer defensive and offensive options that can deny objectives, impose costs, reassure allies, and manage escalation without immediate recourse to nuclear signalling. As disruption accumulates across the preceding layers, however, confidence in these options may erode, narrowing the decision corridor and bringing higher-order signalling to the fore. If credible conventional options become inadequate or exhausted, nuclear use may enter consideration.

C2 forms the hinge of the framework, converting information from sensors, intelligence, and operational systems into coordinated and authorised action. Effective C2 capability is important across all domains because it is the bridge between data, planning, and action.

At the core of the model is nuclear use, which is divided into two further sub-layers to demonstrate modern nuclear posture and how it could evolve for the UK. The inner sub-layer represents the UK’s sovereign strategic deterrent through the Continuous At-Sea Deterrent (CASD), which remains the backbone of the UK’s nuclear force and provides the survivable second-strike capability. The outer sub-layer represents air-delivered nuclear options associated with NATO’s Dual-Capable Aircraft mission and the broader question of flexibility below strategic retaliation.

Perception and signalling operate across every layer as they are an important lens through which actions in each domain are interpreted, propagated – and can backfire – and are therefore fundamental to all mediators. A shock may originate in any layer and propagate and interact across several layers simultaneously through technical, perceptual, organisational, or alliance-mediated pathways and produce feedback effects between them. As disruption accumulates, the decision corridor may contract through reduced time, confidence, communications continuity, and non-nuclear options, thus narrowing decision-makers’ perceived choices and increasing pressure toward last resort decisions (i.e. nuclear use). The five-domain evaluation framework maps how cross-domain pressure can generate conditions approaching “extreme circumstances” through decision-corridor contraction, while also identifying where resilience, verification, firebreaks, and credible conventional choices can interrupt propagation. Each layer will be assessed against the following five stages:

1. Policy recognition and commitment: has the policy problem been acknowledged and a response authorised?
2. Resourcing: has funding and institutional ownership been established?
3. Capability: can the resulting system perform the required function?
4. Capacity and readiness: is sufficient capability available at the required scale, duration, integration, and notice?
5. Strategic effect: does it preserve or widen the decision corridor without generating unacceptable consequences?

Layer-by-layer review

The SDR and the Defence Investment Plan (DIP) demonstrate that the UK has recognised many of the deficiencies affecting its deterrence posture and has begun committing resources to address them. The principal question is therefore no longer whether reform has been announced, but whether separate initiatives will produce integrated, trained, sustainable, and timely readiness. The following sections apply the five-stage evaluation framework to each layer, distinguishing policy intent from delivered capability and assessing whether implementation preserves the decision corridor without creating new dependencies or escalation risks.

Cyberspace: sovereign capacity beneath digital ambition

Cyberspace underpins military operations, critical infrastructure, communications, and much of the wider economy. Incidents including Stuxnet*, TRITON^†, WannaCry^‡, and attacks on Ukrainian infrastructure demonstrate that digital compromise can produce physical effects, disrupt essential services, and prepare the environment for kinetic operations. Cyber activity can also remain below the threshold of armed conflict, extracting information, degrading confidence, and establishing access that may be exploited during a later crisis^{4, 5, 6}.

Cyber disruption therefore has the potential to create cascading effects throughout the wider defence architecture. As information integrity declines, communications become fragmented, and coordination is degraded, decision-makers are left with less time and lower confidence in the information available to them. This narrows the decision corridor, increasing uncertainty and raising the likelihood of escalation driven by misinterpretation rather than deliberate intent.

Government now treats the cyberspace domain as the enabling domain connecting the Integrated Force – the SDR’s term for the UK’s armed forces being designed and directed as a single coherent fighting force. The DIP allocates £2.5 billion to cyber and electromagnetic capabilities and supports the Defence Cyber and Electromagnetic Force, established to coordinate defensive cyber operations and electromagnetic activity across Defence⁷. The SDR and DIP clearly imply ambition for advanced national expertise, sought through direct-entry recruitment, the Defence Cyber Academy, reserves, industry secondments, and wider defence-skills initiatives. These are meaningful commitments, but the public plans do not set out a workforce model showing how many specialists are required, which competencies must remain sovereign, how expertise will be retained, or when capacity will be sufficient to assure the rapidly expanding digital architecture.

This matters because technical integration is proceeding across artificial intelligence-supported C2, autonomous platforms, space-enabled ISR, Integrated Air and Missile Defence (IAMD), and the Digital Targeting Web. Training initial cohorts and establishing a command structure do not immediately create mature expertise or competence. Personnel must accumulate operational experience, understand system-specific vulnerabilities, test third-party components, exercise degraded modes, and develop institutional confidence before the architecture can be relied upon during crisis. Without a transparent pathway for developing cyber expertise and sequencing integration, new systems may be connected before UK Defence can fully understand their vulnerabilities, verify their outputs, or recover them following compromise. Rather than widening the decision corridor, digital integration could then spread uncertainty and disruption across the force more quickly.

Cyber disruption therefore has the potential to create cascading effects throughout the wider defence architecture. As information integrity declines, communications become fragmented, and coordination is degraded, decision-makers are left with less time and lower confidence in the information available to them. This narrows the decision corridor.

The 2026 K3 Scout incident as part of Project Beehive illustrates the difference between nominally British procurement and assured sovereign capability. Cameras installed on UK-built Royal Navy uncrewed vessels were found sending heartbeat communications to a Chinese IP address through Chinese-origin components supplied via a third party. The Ministry of Defence found no evidence that systems or sensitive data had been compromised, and the issue was identified through routine vulnerability assessment⁸. Nonetheless, the case demonstrates that prime-contractor nationality and supplier certification do not establish secure component provenance. A system is not sovereign merely because its prime contractor is British or its final assembly takes place in the UK; sovereignty depends upon the state’s ability to understand, assure, control, modify, and sustain the complete capability through life. As the Integrated Force becomes more connected and autonomous, cyber assurance must extend through hardware, software, firmware, subcontractors, cloud services, and through-life updates.

Project Beehive was deliberately designed as a rapid acquisition and experimentation programme using open architecture⁹ and demonstrates that rapid procurement can transfer risk downstream. Innovative small and medium-sized enterprises and scale-ups are central to rapid capability development, but their ability to deliver advanced technology may mature faster than their cyber, supply-chain, and assurance functions. The National Cyber Security Centre’s Cyber Action Toolkit and Cyber Essentials provide valuable routes towards baseline organisational resilience^{10, 11}, while the Ministry of Defence Cyber Security Model requires controls to flow through subcontracting chains¹². However, organisational certification does not by itself establish the provenance or trustworthiness of embedded hardware, firmware, or external service dependencies.

The more integrated the force becomes, the more cyber assurance becomes a prerequisite for integration rather than a parallel workstream. Cyber resilience should therefore be treated as a foundational integration condition. New capabilities should not enter sensitive operational networks merely because the platform is available. They should progress through architecture-level assurance gates demonstrating provenance, segmentation, fallback operation, and resilience under compromised-component scenarios. Cyber resilience preserves the decision corridor only where Defence can trust not merely its prime contractors, but the components, firmware, suppliers, platforms, and external services on which every other layer depends.

Airspace defence capabilities: preserving trusted warning

Integrated Air and Missile Defence (IAMD) functions as a critical escalation layer because it shapes how threats are perceived and how much warning time decision-makers believe they have. Reliable tracking and classification preserve confidence in the threat picture. When systems are degraded, saturated, or produce conflicting indications, uncertainty increases, verification time diminishes, and the decision corridor contracts.

Existing UK capability combines Protector and P-8A Poseidon aircraft with the Royal Navy’s Type 45 destroyers to provide persistent surveillance and maritime strike support, while Typhoon and F-35 aircraft contribute to UK and NATO air defence against aircraft and cruise missiles¹³. The SDR expressly recognises that effective UK IAMD can only be achieved as part of a NATO endeavour, with the RAF leading the UK contribution and integrating national C2 into NATO’s IAMD network¹⁴, alongside further investment in conventional long-range precision strike capability¹⁵.

However, the Strait of Hormuz crisis illustrated the capacity constraint behind this high-end capability. HMS Dragon was reassigned from protecting UK interests around Cyprus to become the Royal Navy’s Type 45 contribution to a future multinational Hormuz mission^{16, 17}. The deployment demonstrated the ship’s high-end air-defence value, but also how a small destroyer fleet, coupled with maintenance, crewing and support constraints, limits the UK’s ability to sustain concurrent homeland, NATO, and deployed commitments¹⁸. Current UK IAMD remains structurally constrained as it relies on a limited number of centralised C2 nodes lacking the scalability required for high-intensity conflict; this creates vulnerability under pressure and limits the system’s ability to adapt to large-scale or multi-axis attacks^{19, 20}. Priority areas for IAMD investment over the next four years include £790 million for homeland IAMD, including £400 million for tactical C2 and sensing, more than £350 million to double Sky Sabre systems, Type 45 ballistic-missile-defence upgrades, and substantial counter-drone and directed-energy investments²¹. These measures constitute genuine progress, but many are upgrades, replacements, or future programmes; they do not yet demonstrate when sufficient trained personnel, geographical coverage, redundancy, interceptor depth, and integrated operating procedures will be available for sustained high-intensity conflict.

IAMD investment measures constitute genuine progress, but many are upgrades, replacements, or future programmes; they do not yet demonstrate when sufficient trained personnel, geographical coverage, redundancy, interceptor depth, and integrated operating procedures will be available for sustained high-intensity conflict.

The effectiveness of UK IAMD is also heavily dependent on intelligence, surveillance and reconnaissance (ISR) and data integration; disruption to sensors or communication networks can rapidly degrade tracking and classification, creating ambiguity. This is compounded during saturation attacks, where large volumes of targets force prioritisation under stress, increasing the likelihood of worst-case assumptions. Wider government-commissioned research²² identifies substantial AI skills challenges across the UK economy, although it does not quantify the defence or IAMD-specific gap. This nevertheless indicates that Defence must recruit, train, and retain specialists in a highly competitive labour market and, with the simultaneous introduction of new sensors, cloud-based C2, AI decision support, and cross-domain architectures, this creates an unavoidable integration and learning burden. Funding and technical availability do not eliminate the time needed to train operators, establish doctrine, test human-machine interaction, validate data, practice operating with systems degraded – jammed, disconnected, or partly disabled – and build institutional confidence.

Additionally, the current ballistic and hypersonic defence landscape creates a significant gap at the upper tier, limiting confidence in early warning and reducing decision time during crisis²³. Planned Type 45 upgrades will provide an initial ballistic-missile-defence capability from 2028, but upper-tier coverage will remain limited and defence against advanced hypersonic systems presents a separate and evolving challenge. The UK-German Deep Precision Strike programme will develop offensive long-range cruise and potentially hypersonic weapons²⁴; although these may strengthen deterrence and response options, they will not provide defence against incoming ballistic or hypersonic weapons.

The UK should retain national fallback capacity sufficient to protect the homeland and preserve authoritative decision-making. The emerging architecture will widen the decision corridor only if it can sustain trusted warning and defensive choice during saturation, cyber disruption, sensor loss, and degraded allied connectivity.

C2: integration without brittleness

Put simply, C2 converts information and capability into authorised action. Traditionally, C2 has relied on centralised and hierarchical structures²⁵. These arrangements provide clarity, discipline, and accountability, particularly in stable operating conditions. However, modern conflict places far greater pressure on this model²⁶.

Today, commanders and political leaders must deal with large volumes of data, rapid operational tempo, contested communications, cyber disruption, electronic warfare, and pressure across several domains at the same time. In that environment, a rigid C2 structure can become slow, overloaded, and too dependent on a small number of key nodes²⁷. C2 preserves the decision corridor by allowing leaders to authenticate information, communicate authoritative decisions, coordinate with allies, and retain political control under disruption. It is the hinge that converts capability into controlled political and military action, and depends on three qualities: continuity, information integrity, and political control. Therefore, C2 is a crisis-management function as much as a communications system to ensure effective decision-making under pressure²⁸.

The SDR treats C2 as a distributed enabling function embedded across various domains, and effectively envisages a shift from predominantly hierarchical, platform-centred C2 towards a more integrated, data-driven, distributed, AI-assisted, cross-domain, NATO-interoperable, adaptive model. A central concept is to connect sensors, deciders, and effectors through a common digital architecture²⁹. The tools to achieve effective C2 include GUARDIAN, the Air Battle Management system fully integrated into the NATO IAMD C2 network, and NEXUS, a cloud-based C2 decision-making solution employing AI³⁰. The DIP allocates approximately £7.5 billion to the Digital Backbone and Digital Targeting Web between 2026/27 and 2029/30³¹ and will be enabled by the latest technology, including AI and quantum³². Funding allocated to other domains will naturally overlap with the C2 domain, for example, IAMD C2. And although the Digital Targeting Web is a major C2 enabler, targeting integration should not be treated as equivalent to the whole command function; political direction, crisis communication, authentication, continuity arrangements, and escalation control require different timescales and safeguards from tactical targeting.

These commitments establish a credible technical direction and are intended to extend existing national and NATO-integrated C2 into a more connected and AI-supported architecture. However, public plans do not specify which dependencies must mature first, when compound-degradation testing will occur, or when operators and commanders will have accumulated sufficient experience to trust the combined architecture for operational reliance. Greater connectivity and delegated action may improve operational tempo and resilience, but C2 must still preserve authority, accountability, information integrity, and political control during cyberattack, sensor loss, communications degradation, and allied disruption. Connectivity and machine speed are therefore inputs, not strategic effects. The decisive test is whether leaders retain trusted information, secure communication, meaningful options, and political control when the network is under maximum pressure.

The SDR provides little public detail on how expanding conventional C2 integration will be separated from nuclear command, control, and communications (NC3). If disruption to conventional networks is mistaken for an attack on NC3, the risk of escalation increases significantly.

The SDR provides little public detail on how expanding conventional C2 integration will be separated from nuclear command, control, and communications (NC3). If disruption to conventional networks is mistaken for an attack on NC3, the risk of escalation increases significantly. A cyber incident that begins in a conventional network could therefore be misread as preparation for blinding, decapitation, or coercive escalation³³. Information integrity is central to C2 resilience³⁴. Strong firebreaks between conventional and nuclear decision chains are required, which could include segmented networks, independent verification routes, protected communications, one-way data controls, and out-of-band authentication. The aim is to ensure that disruption in one part of the system does not automatically contaminate the nuclear decision-making process³⁵.

Distributed C2 can improve resilience when central nodes are disrupted. However, it is also not clear which decisions may be delegated, under what conditions, with what boundaries, and how authority is restored when communications return. NATO integration improves warning coverage and defensive depth but should not substitute for sufficient sovereign resilience. The strategic objective should be alliance integration with credible national fallback capacity, as faster C2 is valuable, but only where speed is matched by verification, resilience, and operational judgement. For this reason, C2 arrangements must be exercised regularly with NATO and key allies, especially under degraded and ambiguous conditions³⁶. But too much centralisation makes the system brittle; too much delegation risks action moving faster than political control can manage³⁷.

For the UK, effective strength-in-depth in the C2 domain is central to preserving escalation control. If C2 can absorb disruption, verify information, maintain political authority, and coordinate with allies, it helps interrupt cross-domain pressure before nuclear-relevant decisions become the only ones available. If it fails, the decision corridor narrows, and extreme options may come to the fore before lower-order responses have been adequately verified, coordinated, or exhausted.

Conventional military: credible options require endurance

Conventional forces widen the decision corridor by giving leaders credible, proportionate, and sustainable alternatives to nuclear signalling, contributing directly to escalation control^{38, 39}. The SDR’s acknowledgement that warfighting capability has been ‘hollowed out’ at the expense of ‘exquisite’ capabilities⁴⁰ is an important change in diagnosis, and the DIP commits real resources to address it. The unresolved question is whether investment will produce sustained conventional capacity rather than nominal capability – and whether the three interdependent foundations of that capacity, industrial infrastructure, munitions sustainment, and reserve depth, will mature together at the pace the threat environment requires.

The £26 billion, ten-year naval base modernisation programme announced in July 2026⁴¹ will transform Clyde, Devonport, and Portsmouth, providing new training, engineering, and accommodation facilities. This is genuine and necessary progress. However, the whole maritime enterprise requires simultaneous recapitalisation⁴², and infrastructure investment alone will not create operational readiness. New and existing vessels must be supported by sufficient crews, maintenance capacity, workforce, digital architecture, and mature operating arrangements. The planned introduction of the Type 26 and Type 31 classes is intended to improve fleet capability, but it is unlikely that operational capacity will increase significantly in the short term given delays to replacement programmes, shrinking sailor numbers, and growing concurrent commitments^43,44. Unless workforce, infrastructure, and platforms are sustainably funded, sequenced, and integrated, the UK may acquire more capable ships without increasing the number it can deploy and sustain. Autonomous systems may eventually reduce some crewing demands, but they also create new requirements for digital specialists, remote operators, maintenance, assurance and human-machine command arrangements.

The unresolved question is whether investment will produce sustained conventional capacity rather than nominal capability – and whether the three interdependent foundations of that capacity, industrial infrastructure, munitions sustainment, and reserve depth, will mature together at the pace the threat environment requires.

The government has also correctly recognised the need to restore sovereign production of energetic materials – the explosives and propellants used in ammunition, rockets, and missiles – and has identified specific materials, factory investment, and weapon programmes⁴⁵. But an always-on munitions pipeline cannot be established by factory construction alone. It requires a quantified demand model, assured precursor and component supply, trained personnel, qualification and test capacity, storage and distribution, minimum-volume contracts, and rehearsed surge arrangements. Announced factories and weapon orders are therefore inputs, not strategic effects. Munitions production preserves the decision corridor only when it gives political leaders confidence that conventional operations can be sustained at the required scale and duration.

Reserve forces – Active and Strategic – provide the third foundation: specialist skills, mobilisation depth, and replacement capacity during prolonged operations. The SDR proposes a 50% increase in RAF Reserves⁴⁶ and the DIP commits to increasing the Regular Army to 76,000 between 2030 and 2035⁴⁷, but neither document specifies how reserve capacity across all three services will be structured, resourced, and sustained to support high-intensity operations. Stronger reserves help prevent the decision corridor from collapsing once physical engagement begins, reducing the likelihood that decision-makers perceive escalation to higher-order signalling or nuclear options as their only remaining course of action. The UK is rebuilding not one capability but an entire ecosystem, and every missing link between raw material, production, workforce, logistics, and operational use delays the point at which investment becomes readiness.

Nuclear use: has greater flexibility produced meaningful choice?

Nuclear posture should function as a credible strategic backstop while preserving political control and avoiding premature increase in the salience of the nuclear response. The DIP reiterates the SDR’s conclusion that a modernised nuclear deterrent is essential for UK defence⁴⁸ and reaffirms that the UK will continue to rely on a minimum, credible, independent UK nuclear deterrent, the only European nation formally assigning its nuclear deterrent to the defence of NATO⁴⁹.

The Continuous At-Sea Deterrent (CASD) is the bedrock of the UK’s defence⁵⁰ and is designed principally to provide assured strategic retaliation. Although Trident may offer some flexibility in warhead loading and yield, it remains the UK’s sole sovereign nuclear delivery system. Any use of a strategic ballistic missile to deliver a limited or sub-strategic nuclear response could be difficult for an adversary to distinguish from the opening of a larger strategic attack. Its signalling flexibility is therefore materially narrower than that offered by a genuinely distinct air-delivered capability.

The US operates a nuclear triad comprising land-based intercontinental ballistic missiles, submarine-launched ballistic missiles, and air-delivered weapons, while France maintains both sea- and air-based delivery systems. These diversified postures provide greater signalling flexibility and a wider range of potentially credible response options. In contrast, the UK’s reliance on a single submarine-based deterrent limits its ability to signal across multiple escalation levels, reinforcing the need to consider whether additional delivery methods could strengthen deterrence credibility while preserving escalation control⁵¹. The UK’s recent decision to procure F-35A aircraft⁵² represents a planned reintroduction of an air-delivered nuclear role for the RAF within NATO, rather than a sovereign second UK delivery system. It may, therefore, broaden NATO’s future nuclear capability, but it does not constitute additional sovereign UK nuclear capacity.

Nuclear posture should function as a credible strategic backstop while preserving political control and avoiding premature increase in the salience of the nuclear response.

The UK deterrent is operationally independent in that the Prime Minister can authorise use without external approval. However, it is not technologically or logistically autonomous, as the programme relies substantially on US-built missiles, shared infrastructure, maintenance, and continuing cooperation⁵³. The UK and France have long recognised that a threat to the vital interests of one would also threaten those of the other. Although France remains outside NATO’s formal nuclear planning structures⁵⁴, the Northwood Declaration now provides an additional layer of bilateral coordination, establishing a UK-France Nuclear Steering Group to coordinate work across nuclear policy, capabilities, and operations while preserving the independence of both countries’ deterrents⁵⁵. NATO nuclear sharing and strengthened UK-France coordination may broaden the European deterrence architecture, but neither necessarily provides the UK with sovereign flexibility at lower levels of escalation. Both introduce distinct dependencies, consultation requirements, signalling effects, and alliance-coupling risks that must be evaluated against the decision corridor.

This reinforces a critical conclusion: the effectiveness of the UK’s nuclear posture is not defined solely by the destructive power of Trident, but by the degree to which it can operate within a layered and integrated system that preserves escalation control. Greater flexibility may widen the decision corridor by adding credible signalling and response options, but only where political control, command arrangements, and messaging prevent those options from being interpreted as making nuclear use more routine or likely. The relevant test is therefore not whether Britain has added another nuclear-capable platform, but whether the new NATO role provides credible and controlled flexibility while keeping nuclear use politically exceptional.

Recommendations for delivery

Below are recommendations for what the Ministry of Defence should be able to demonstrate:

1. Publish an architecture-level delivery roadmap to show how the major programmes depend upon one another, including programme sequencing, workforce requirements, integration milestones, and transition risks.
2. Make assurance a gateway to operational integration, where systems are not connected to sensitive architectures until component provenance, supply-chain control, and through-life security have been demonstrated.
3. Match every capability plan to a workforce plan, identifying the required trained strength, specialist skills, retention measures, reserve contribution, and operational-assimilation period.
4. Exercise and test the warfighting and defence architecture under compound degradation.
5. Report readiness and strategic effect rather than investment expenditure alone.

Conclusions

The present concentration of reform requirements is the cumulative result of long-running force reductions, delayed replacement programmes, fragmented procurement, workforce constraints, dependence on future technology, and the repeated deferral of resilience and capacity in favour of maintaining a smaller number of high-end capabilities. The SDR and DIP are attempting to address inherited weaknesses, but the breadth of simultaneous reform is itself evidence of how far capacity has been allowed to erode.

The UK is attempting to repair several interdependent layers simultaneously, creating a period in which recognised deficiencies persist while replacement capabilities, workforce, doctrine, integration, and institutional confidence remain immature. Decades of underinvestment, delayed programmes, fragmented ownership, workforce erosion, and short-term decision-making have created a modernisation bow wave in which multiple foundational systems must now be replaced or transformed simultaneously. The acknowledgement of these problems and the investment outlined in the SDR and DIP represent major and necessary shifts. However, investment is not readiness, and as such, this simultaneous transformation creates the following risks:

• Transition risk: old systems may decline before replacements become operational.
• Integration risk: new systems may work individually but fail to operate coherently across domains.
• Workforce risk: a limited pool of specialists may be operating current systems, introducing replacements, training others, and supporting transformation.
• Assurance risk: pressure for rapid fielding may outpace testing, validation, security assurance, and doctrinal development.
• Organisational-learning risk: personnel and institutions require experience to understand when to trust automated outputs, how systems behave under degradation, which workarounds are reliable, where decision-making authorities should sit, and how different services and allies interact under stress.

Britain therefore risks a vulnerability gap: the period in which legacy capability declines faster than replacement systems, personnel, doctrine, integration, and confidence mature. Because cyberspace enables every other layer and is the assurance foundation upon which every promised benefit of integrated modernisation depends, cyber maturity must become a prerequisite and gateway for integration. Current investment, recruitment, and institutional reform do not yet demonstrate that Defence has sufficient sovereign expertise or supply-chain assurance to support the pace of simultaneous digital modernisation. The UK is accelerating procurement and integration while the state’s ability to understand, assure, control, and sustain the complete system may not be maturing at the same pace.

The UK’s nuclear posture is only as credible as the layers preventing ‘extreme circumstances’ from being reached. We describe this condition as “stabilising strength-in-depth”: capacity across the layers designed to preserve rather than inadvertently compress the decision corridor.

CASD preserves ultimate deterrent credibility, but it does not necessarily provide sovereign flexibility across lower levels of escalation. Allied arrangements may broaden the available architecture, but they also introduce dependencies and coupling risks. Their value must therefore be judged by whether they preserve controlled political choice without increasing the salience of the nuclear response.

Ultimately, when cyber resilience, warning confidence, communications continuity, and credible conventional options are weak, the state’s decision corridor narrows, making extreme outcomes more plausible and leaving nuclear posture to compensate for failures in preceding domains. The UK’s nuclear posture is only as credible as the layers preventing ‘extreme circumstances’ from being reached. We describe this condition as “stabilising strength-in-depth”: capacity across the layers designed to preserve rather than inadvertently compress the decision corridor.

Britain’s deterrence architecture should be NATO-integrated but not NATO-dependent, in that alliance capability must reinforce, rather than replace, the sovereign capacity needed to preserve national decision-making under pressure. Britain should make a credible NATO contribution while retaining sufficient sovereign capacity to protect the homeland, absorb initial disruption, maintain national decision-making, and continue contributing if allied support is delayed or constrained. Every ally is obligated to assist, but the treaty leaves national governments discretion over the form and extent of that assistance⁵⁶. It is not clear how much sovereign resilience Britain requires to remain an effective ally without becoming dependent on allied decisions and assets for essential national functions. As such, the UK should pursue selective leadership based on comparative advantage, burden-sharing, and explicit limits, rather than assuming open-ended responsibility for compensating for deficiencies elsewhere in NATO.

Britain’s deterrence problem can no longer be described simply as policy neglect. The 2025 Strategic Defence Review and subsequent investment decisions acknowledge many of the capabilities required for a more credible and resilient defence posture. The effectiveness of UK defence policy should therefore be judged not by investment totals or nominal capability alone, but by whether the complete architecture can preserve controlled political choice under pressure. The challenge is now to convert those commitments into an integrated architecture capable of functioning under complex and contested conditions. Programmes in cyberspace, airspace defence, C2, conventional capability, industrial capacity, and nuclear posture will strengthen national and collective security only if they operate together to preserve decision time, information confidence, communications continuity, political control, and credible response options. CASD remains an essential strategic backstop, but it cannot compensate for fragility elsewhere in the defence architecture. Britain will move from strength without depth to stabilising strength-in-depth only when defence investment produces integrated readiness: capabilities that are sufficiently staffed, assured, sustained, interoperable, and tested under compound pressure.

---

Notes

* Stuxnet, discovered in 2010, targeted industrial control systems at Iran’s Natanz uranium-enrichment facility and is widely attributed to a joint US-Israeli operation, although neither state has formally acknowledged responsibility. By manipulating systems controlling the centrifuges, the malware caused physical damage and reportedly destroyed approximately 1,000 centrifuges. (Futter, A., Cyber threats and nuclear weapons: New questions for command and control, security and strategy, RUSI, 2016; Mueller, G. B., et al., Cyber Operations during the Russo-Ukrainian War From Strange Patterns to Alternative Futures, CSIS, 2023; Hurel, L. M. and Mott, G., Emerging Insights: Rethinking Cyber Deterrence in a Multipolar World, RUSI, 2025).

† TRITON was malware designed to manipulate Triconex safety-instrumented-system controllers, which monitor industrial conditions and initiate emergency shutdowns. It was deployed against an industrial facility reportedly located in Saudi Arabia in 2017, but a flaw in the malware inadvertently triggered a shutdown and exposed the attack. (Cheetham, R. and Heon, S., ‘Triton Cyber Attack: Hackers Target the Safety Systems of Industrial Plants’, SCOR, 2018).

‡ The WannaCry ransomware attack of May 2017 disrupted NHS services across England, cancelling thousands of appointments and operations and forcing some patients to travel further for emergency care (Investigation: WannaCry cyber attack and the NHS, National Audit Office, 2017).

---

References

1. National Security Strategy of the United States of America, The White House, 2025.

2. Strategic Defence Review 2025: Making Britain Safer—Secure at Home, Strong Abroad, Ministry of Defence, 2025.

3. The Defence Investment Plan, Ministry of Defence, 2026.

4. Futter, A., Cyber threats and nuclear weapons: New questions for command and control, security and strategy, RUSI, 2016.

5. Mueller, G. B., et al., Cyber Operations during the Russo-Ukrainian War From Strange Patterns to Alternative Futures, CSIS, 2023.

6. Hurel, L. M. and Mott, G., Emerging Insights: Rethinking Cyber Deterrence in a Multipolar World, RUSI, 2025.

7. The Defence Investment Plan, p. 51.

8. Beale, J. and Flynn, R., ‘No Evidence of Data Breach after Chinese-Made Component Found in Navy Drones, MOD Says’, BBC News, 10 August 2026; Tom Sharpe, ‘It turned out our Special Forces’ drone boats were calling home to China. This is serious’, the Telegraph, 10 August 2026.

9. ‘Navy to Buy 20 Uncrewed Boats as Testbeds for Future Operations’, Royal Navy, 11 March 2026.

10. Cyber Action Toolkit, National Cyber Security Centre, 2026.

11. Cyber Essentials Supply Chain Playbook, National Cyber Security Centre, 2026.

12. Cyber Security Model, Ministry of Defence, 6 March 2026.

13. Strategic Defence Review, p. 113.

14. Ibid.

15. Ibid., p. 102.

16. ‘UK to Contribute Drones, Jets and Warship to Multinational Mission to Secure the Strait of Hormuz’, Ministry of Defence, 12 May 2026.

17. ‘HMS Dragon Heads for Potential Strait of Hormuz Mission’, Royal Navy, 11 May 2026.

18. ‘Royal Navy Surface Fleet’, House of Commons Hansard, vol. 789, 6 July 2026.

19. Watling, J., and Kaushal, S., Requirements for the Command and Control of the UK’s Ground-Based Air Defence, RUSI, 2024.

20. Mills, C., UK Defence in 2025: Integrated Air and Missile Defence, House of Commons Library, 2025.

21. The Defence Investment Plan, p. 28.

22. AI Labour Market Survey 2025, Gardiner & Theobald LLP for the Department for Science, Innovation and Technology, 2026.

23. Mills, C., UK Defence in 2025: Integrated Air and Missile Defence.

24. The Defence Investment Plan, p. 52.

25. Lucas, R., et al., Command and Control in the Future: Concept Paper 2 – The Defence C2 Enterprise, RAND Corporation, 2024.

26. Joint Capability Concept Note 1/25: Developing Command and Control – Now and into the Future, Ministry of Defence, 2025.

27. Watling, J. and Kaushal, S., Requirements for the Command and Control of the UK’s Ground-Based Air Defence, RUSI, 2024.

28. Joint Capability Concept Note 1/25: Developing Command and Control – Now and into the Future, Ministry of Defence, 2025.

29. Strategic Defence Review, p. 49.

30. Ibid., p. 113.

31. The Defence Investment Plan, p. 32.

32. Ibid., p. 31.

33. Artificial Intelligence and Nuclear Command, Control, and Communications: Current Status and Future Risk, Federation of American Scientists, 2025.

34. Ibid.

35. Ibid.

36. Watling, J. and Kaushal, S., Requirements for the Command and Control of the UK’s Ground-Based Air Defence.

37. Joint Capability Concept Note 1/25.

38. Bajema, N. E. and Gower, J., Nuclear decision‑making and risk reduction in an era of technological complexity, Council on Strategic Risks, 2022.

39. Raju, N. and Wan, W., Escalation Risks at the Space–Nuclear Nexus, Stockholm International Peace Research Institute, 2024.

40. Strategic Defence Review, p. 34.

41. ‘Record £26 Billion Investment to Transform UK Naval Bases’ Docking Facilities and Waterfront Infrastructure’, Ministry of Defence, 14 July 2026.

42. Defence Industrial Strategy 2025: Making Defence an Engine for Growth, Ministry of Defence, 2025.

43. Brooke-Holland, L., UK Defence in 2025: Warships and the Surface Fleet, House of Commons Library, 2025.

44. Slapakova, L., et al., Meeting the Needs of the Royal Navy and Royal Marines Community, RAND Corporation, 2026.

45. ‘New Energetics Factories for the UK’, Ministry of Defence, 20 November 2025.

46. Strategic Defence Review, p. 113.

47. The Defence Investment Plan, p. 62.

48. Ibid., p. 29.

49. Strategic Defence Review, p. 98.

50. Ibid., p. 104.

51. Futter, A., Cyber Threats and Nuclear Weapons: New Questions for Command and Control, Security and Strategy.

52. Strategic Defence Review, p. 115.

53. Messmer, M., and O’Sullivan, O., ‘The UK’s Nuclear Deterrent Relies on US Support – but There Are No Other Easy Alternatives’, Chatham House, 16 April 2025.

54. Strategic Defence Review, 2025, p. 99.

55. ‘Northwood Declaration: UK–France Joint Nuclear Statement’, Prime Minister’s Office, 10 July 2025.

56. ‘Collective Defence and Article 5’, North Atlantic Treaty Organization, 12 November 2025.