After a serious mistake, caused by a colleague but blamed on him, during a live training exercise at Stansted Airport, MI5 agent River Cartwright is demoted to dead-end work at Slough House in lieu of being fired. He is assigned by his superior Jackson Lamb to carry out surveillance on Robert Hobden, a journalist associated with far-right politicians Peter Judd and Roger Simmonds. His colleague Sidonie "Sid" Baker has also been assigned to Hobden, discreetly copying the contents of his USB flash drive in a café. River is then instructed to deliver the drive to the service's headquarters at Regent's Park, much to his surprise.

Hassan's kidnappers – Moe, Larry, Curly and Zeppo – hold him hostage in a London terrace basement, with it transpiring that Simmonds is behind the kidnapping. River, having copied the contents of Hobden's USB drive before delivering it to Regent's Park, realises it contains no information and manipulates a rival, James "Spider" Webb, into confirming the same. Standish begins having flashbacks to the death of a former colleague of hers and Lamb's, Charles Partner. Slough House's cyber expert, Roddy Ho, discovers he cannot hack Hobden's laptop as it is air gapped, furthering everybody's suspicions.

Sid, alive but in critical condition, is taken to hospital by MI5 security operatives who detain River. Lamb breaks him out, and the two deduce Moody was the gunman sent to kill Hobden. Moody returns to Slough House and attacks Min and Louisa when they re-enter, but is killed when he breaks his neck falling down the stairs in a scuffle. Lamb thinks that Slough House is going to be blamed for whatever operation Regent's Park is running and be disowned if it fails.

Taverner meets with Lamb and reveals Ahmed is the nephew of the second-in-command of Pakistani Military Intelligence. His kidnapping and intended rescue is an unsanctioned false-flag operation masterminded by Taverner herself to potentially increase cooperation with Pakistan as well as neutralise and intimidate the far-right. She claims to have an operative embedded with the Sons of Albion who organised the kidnapping but will also facilitate the rescue. It is also revealed that Standish narrowly escaped a treason charge through her links with Partner and his death.

It is revealed that Moe (real name Alan Black) was Taverner's mole but was found out and murdered by Curly, who then fled with Zeppo, Larry and Hassan. Driving out of London, Zeppo and Larry reveal that they never intended to go through with killing Ahmed and entertain the idea of releasing him, becoming increasingly concerned with Curly's erratic behaviour and rhetoric.

Lamb and his team flee the property before the "Dogs" (MI5 security personnel) arrive, knowing that since the operation has not gone to plan that Slough House will be blamed. River is able to rescue Roddy before he can be taken into custody, but Min and Louisa are unable to stop their colleague Struan Loy from being taken from his home by operatives. Taverner calls Standish several times to flip her allegiance, alleging that Lamb was involved with Partner's death, but Standish remains loyal to Lamb when he comes to extract her. Leaving her house the two are apprehended by James Webb and head of security Nick Duffy, who force them into a car after searching Lamb. En route to Regent's Park, Standish is able to free herself and Lamb after pulling a Glock 17 from her handbag, the weapon having been taken from Moody and placed there by Lamb.

When the team reconvenes, River recalls taking a photo of Taverner covertly meeting with Black whilst carrying out surveillance training. Lamb "returns" Duffy's car to Regent's Park and demands to speak with Taverner, who offers him a way out that will result in him being fired but not charged. She also threatens Standish and says that Sid has died in hospital. Lamb informs her there is a bomb in the car he returned, which allows River to sneak in whilst Duffy's security team investigates.

River confronts Webb, alleging Taverner had him purposefully feed him incorrect intel during the Stansted exercise so he would fail and be demoted, as he had the photograph of her meeting with Black. After locating the photo and evading security, he and Lamb threaten to reveal Taverner's operation to the Director General of MI5 and the press.

Taverner confronts Judd at his home, revealing that calls he made to his far-right contacts after Hobden's visit resulted in Black's death and the mission being compromised. Tearney returns from the US, ordering all loose ends be tied up after Taverner further lies to her about the operation. Curly forces Larry and Hassan to a secluded woodland at gunpoint to carry out the beheading. Larry frees Ahmed and attacks Curly with an axe but flees, which enables an injured Curly to recapture Hassan. Larry arrives at a seaport in Harwich but is shot dead by the "Dogs" on the orders of Tearney, who plant a weapon on his corpse to justify the killing.

Curly prepares to kill Hassan outside what he believes is a Norman castle, which Ahmed points out is actually a folly. Lamb, River, Min and Louisa, with assistance from Roddy, are able to track them to the location. Curly and River engage in a brief shoot-out, before the former is knocked out by Hassan with a rock. The Dogs arrive but the group prevent them from killing Curly.

Former field agent Richard Bough, aka Dickie Bow, recognizes and follows a man who tortured him during the Cold War, only to die on a rail replacement bus from an apparent heart attack. Jackson Lamb investigates, finding Bough's hidden phone under the seat with the message "cicada", and gets the team at Slough House to look deeper.

River speaks with his grandfather about Bough's death. David discusses the "cicada" theory of Russian sleeper agents embedded in British society, which MI5 dismissed as a hoax after no sleepers were found and discovered that the programme's alleged mastermind, Alexander Popov, did not exist. He tells River that Bough went AWOL in East Berlin and was assumed to have defected, but returned drunk. Bough claimed to have been kidnapped and tortured by Popov, who force-fed him brandy, but was fired. David dismisses River's theory that Bough's death was the work of the FSB or related to a conspiracy, but warns River to be careful.

Lamb meets with Nikolai Katinsky, an ex-KGB agent and defector. He alleges when stationed in East Berlin that he overheard Popov demanding the cicada program remain funded after the fall of the Soviet Union. His description of the man Popov was speaking to, Andrei Chernitsky, matches Bough's killer. River bribes a taxi driver in Stroud, who reveals he drove Chernitsky to an airfield and flying club in Upshott, but was instructed to lie about it and call a number should people come looking. Ho traces the number, which places the phone in Estonia. Lamb meets with Taverner and convinces her to fund a fake ID and cover package for River, who he then meets and instructs to investigate the airfield and its owner, Duncan Tropper. Taverner is dealing with now-Home Secretary Peter Judd regarding a large upcoming anti-capitalist protest in London.

The gun threat is a joke, and Piotr invites Min to drink vodka with him and Kyril. The Russians cut the session short when a friend visits, and afterwards Min is killed when supposedly struck accidentally by a car as he is cycling home drunk. Believing he was targeted also, Lamb investigates the driver, Rebecca, and discovers she previously lived in Vladivostok. He confronts her, and she confesses she was paid off. Min wasn't killed by her car, and she was not driving.

Judd is delivering a speech in the City of London on the day of the anti-capitalist protest. For added security, he is to be accompanied by Nick Duffy, leader of the "Dogs", a tactical and security unit, but he demands that Taverner join him instead. Newcomer Marcus Longridge replaces Min on the Pashkin assignment and confesses to Louisa he has a gambling addiction.

Rebecca recounts that Min was attacked and run over by Piotr and Kyril, and finished off by Chernitsky before his death was staged. Lamb discovers Katinsky's involvement as a triple agent; he agreed to assist the Russians and distract Lamb in exchange for facing no repercussions for his defection decades earlier. Standish speaks with Victor Krymov, the intermediary who set up the meet between Paskhin and Webb. Lamb suggests that Krymov lied about Pashkin being Nevsky's representative, with the younger Russian likely being his competitor.

After Alex takes off, Katinsky tells River they plan to fly the plane into The Glasshouse. Duncan and Kelly find and untie River, and he is able to convince them of Alex's true identity. River calls in a "Code September", prompting Taverner to evacuate Judd from his speech at The Royal Exchange and the immediate area around The Glasshouse. Lamb blackmails Duffy to get him into the records department at Regent's Park. He deduces Katinsky is the spymaster behind the cicada program (passing himself off as a junior bureaucrat when defecting to avoid suspicion) and was the handler of a traitor in the service. Standish beats Krymov in a game of chess and he reveals it was Katinsky, not Pashkin, who he met with to set up the Webb meeting. Katinsky specifically requested Lamb's team to be involved.

Louisa interrogates a dying Kyril and learns that Pashkin and his associates were meant to drain Nevsky's accounts from the Glasshouse while it was evacuated. River discovers the bomb left at the airfield and realizes the attack was a hoax, calling Taverner to have the Code September retracted. Alex diverts her course, defusing the situation once the Glasshouse has been closed long enough for the heist to take place. Ho notifies River that Chernitsky's destination is Tunbridge Wells, where his grandfather lives.

Chernitsky ambushes Ho on the train but, after Dander boards the train and helps fight him, escapes. Lamb calls Katinsky, deducing that he is the supposedly fictional Russian spymaster "Alexander Popov". Katinsky reveals that outside of his part in the Glasshouse plot, he also intended to kill Lamb in retribution for Charles Partner, his mole at MI5. Lamb, already aware of this, had notified David that he was another potential target due to his complicity in Partner's death. By the time River arrives at Tunbridge Wells by plane with Kelly, David has already ambushed and killed Chernitsky with a shotgun. Louisa and Longridge kill Pashkin when he attempts to escape the Glasshouse, having betrayed and killed Piotr along the way. Realizing he has been outmaneuvered, Katinsky goads Lamb to kill him. Lamb instead leaves Katinsky with one bullet left in his revolver, and Katinsky kills himself.