The Grey Zone

A patient’s death linked to a cyberattack on a hospital supplier. Supermarket shelves emptied. A carmaker’s factories silent for five weeks, at an estimated cost to the UK economy of £1.9 billion. A power station on British soil shut down for four days. A NATO ally’s electricity grid brought close to a midwinter blackout. These are not scenarios. They have already happened. Britain and Europe are operating in the grey zone: the contested space between peace and war, where hostile states and criminal gangs apply pressure through cyberattacks, sabotage and disruption that stay just below the threshold of armed conflict. The UK’s National Cyber Security Centre now links around three-quarters of the incidents affecting Britain’s critical infrastructure to hostile states. Yet most organisations, and much of government, still plan as though the systems they depend on will always be there. In The Grey Zone, Richard Stephenson draws on public evidence, parliamentary testimony, official reports and four decades of experience in crisis-exposed industries to show how fragile the connected world has become, and what leaders can do about it. The book explains: - How state-linked groups have pre-positioned inside the networks that run power, water and telecommunications, and what the attacks on Ukraine and Poland reveal about Russia’s playbook. - What the attacks on Marks & Spencer, the Co-op, Jaguar Land Rover, Synnovis and Collins Aerospace reveal, and why switching systems off to stop an attacker can itself become the crisis. - Why, as M&S’s own chairman told Parliament, organisations should assume attackers can get in, and why defence alone is not enough. - How artificial intelligence is compressing the time between intrusion and impact. - How failures cascade across power, water, health, finance and food, and why the organisation that fails is often not the one that was attacked. - What boards, executives and government must do to keep critical services running when their systems cannot be trusted, with practical frameworks, a dependency-mapping template and a board-level test. This is not a book about better firewalls. It is about what happens after the breach, and the decisions that must be made before it. Written for board directors, chief executives, risk and resilience professionals, policymakers and anyone responsible for keeping an organisation or a public service running, The Grey Zone is evidence-led and deliberately free of hype. It separates what is documented from what is assessed and what is genuinely unknown, and it argues that the case for resilience does not depend on predicting the next attack. It depends on being able to survive it. 'To read this book and fail to act would be a conscious acceptance of avoidable risk.' - Dr Michael C. McDonagh, former Commander, Counter Terrorism Protective Security Command, Metropolitan Police Richard Stephenson is Chief Executive of YUDU, whose crisis communications platform, YUDU Sentinel, won the Business Continuity Institute’s 2025 European award for Continuity and Resilience Provider. He has led, advised and chaired businesses across the Middle East, Europe, South East Asia and North America for more than forty years.