Intelligence agencies cannot protect society alone. Governments, businesses, schools, universities, the media and ordinary citizens must learn to recognise threats and act together.

On 13 October 2026, Sir Ken McCallum, Director General of MI5, delivered his annual threat update, warning that the United Kingdom was entering a new era of national security challenges. One of the most important messages in his speech was that national security is no longer a matter for intelligence agencies and governments alone. It increasingly and regularly affects individuals, businesses and communities.

Well, I am not going to lie. This message extends far beyond the United Kingdom. It is relevant to every country facing an increasingly interconnected world, where threats can travel across digital networks, disrupt businesses, exploit social divisions and reach people who may never have considered themselves part of a national security problem.

I think it is time to think about collective responsibility for national security. 

When I say collective responsibility for national security, I do not mean that every citizen should become an intelligence officer or governments can transfer their responsibilities to the public and sit in the back. I mean a new phase of national security threats requires society to do more than ever. It requires people and institutions to understand the threats around them, take responsibility for their own vulnerabilities and cooperate with others.

Let me clarify this more. One person’s vulnerability can become everyone’s problem.

Imagine a family of five. One member clicks on a malicious link, loses control of their phone or has their online account compromised. The consequences may not stop with that individual. Their contacts might receive fraudulent messages, relatives might be tricked into transferring money, and personal information shared within the family could become exposed.

Now imagine the same situation in a workplace. An employee falls victim to a phishing attack, allowing an attacker to access company systems or confidential information. The consequences can spread across departments, affect customers and potentially disrupt essential services.

These examples illustrate a broader reality that our security is increasingly interconnected and vulnerabilities do not remain exclusively our own.

It is also good to keep in mind that not every online manipulation campaign is a national security threat and not every cyber incident is an act of hostile state activity. However, every single malicious exploitation and its consequences is able to extend beyond the individual.

This is why national security must become a shared concern. When people, organisations and essential services are connected, protecting one part of the system can help protect the whole.

A culture of responsibility

When I was listening to McCallum's speech, he outlined a “team of teams” effort to respond to the threats in bringing together the government, the private sector and wider society.

Governments and intelligence agencies have specialised knowledge and capabilities that ordinary citizens do not. But with technology evolving so rapidly, particularly with AI, they cannot identify and prevent every threat before it reaches society. Nor can they personally teach every employee to recognise a scam or every student to question suspicious content. This is where the rest of society must step in.

We have businesses, schools and universities, media and so on. Every one of them is able to play a crucial role in reducing vulnerabilities. 

Collective responsibility requires a change in this mentality. A business should not see security merely as a technical obligation. A school should not treat digital awareness as a one-off lesson. A media organisation should not limit its contribution to reporting incidents after they happen. And citizens should not assume that their individual actions have no consequences for others.

Cooperation must become part of how society approaches security rather than something that happens only after a crisis.

The rapid development of AI makes it easier to produce convincing fraudulent messages, imitate familiar communication styles, generate misleading material and personalise attempts to influence people.  

The problem is not just that AI can produce false information. It can make a fake message from someone you trust look convincing enough to act on. 

And this is not only for the younger or older generation. Unfortunately, no single generation is immune to deception.

Intelligence agencies can analyse new emerging threats and their findings must also inform public preparedness. Otherwise, society risks developing sophisticated threat assessments without ensuring that the people most likely to encounter those threats know what to do.

So how can we develop this Collective Responsibility for National Security mindset?

First, we should implement regular security awareness programmes in schools and universities. Students should learn how to recognise scams, protect personal information, evaluate suspicious online content and understand the ways digital platforms can be exploited for manipulation. And this programme should be up-to-date and offer new solutions as well as teach students new emerging threats that they have never encountered. We also should never forget to simulate different scenarios to make students adapt the mindset in a practical way, not theoretically. 

Second, businesses and institutions should provide regular and practical training and simulations covering phishing, compromised accounts, suspicious communications, data protection and so on. Employees should know not only how to avoid common risks but also what to do when something goes wrong.

Third, mass media as well as digital platforms must play a vital role to communicate security risks to the public. We cannot expect people actively searching for information for public awareness. We should make sure that regular programmes, interviews, explainers and public service campaigns can help translate complex security issues into practical guidance. I highly recommend that mass media and digital platforms have to provide information in very basic language that everyone can understand. And, of course, communication should be accessible, credible and relevant to everyday life.

Finally, we should invest in research and knowledge-sharing. Threats do not remain the same. They evolve, and our education and preparedness must evolve with them. We cannot eliminate every risk but we can become better at recognising new threats and responding to them. Public education must evolve with them. Research centres, universities, think tanks, businesses and relevant public institutions can study emerging risks, examine how people respond to manipulation and evaluate which awareness programmes actually work. Their findings should inform better training and public policy.

It is also better to understand that these measures would not eliminate threats and no training programme can guarantee that nobody will be deceived, hacked or manipulated. However, we sure know that better-informed people and better-prepared institutions can reduce the likelihood that one incident will spread unchecked.

Collective responsibility must not become an excuse for blaming victims. People will make mistakes, and even well-trained individuals can be targeted successfully. Collective Responsibility should mean building resilience together, not expecting everyone to protect themselves without assistance.

National security begins before a crisis. This is not about turning society into a permanent state of alarm. It is about making preparedness an ordinary part of modern life.

We have spent years thinking about national security as something handled behind closed doors by intelligence agencies and governments. That world has not disappeared. But it is no longer enough.

National security is still the government's responsibility. But resilience is something we must build together.

The question is whether we are ready to act like it.