- The NCSC says any surge in incidents would come from old weaknesses found faster, not from AI inventing new attack methods.
- The NCSC says AI can let hostile actors find and exploit long-tolerated weaknesses at scale. It rates a wider rise in their activity within two years as "highly likely".
- Leaders should audit what is needlessly internet-facing, test their patching speed, and treat Cyber Essentials as a starting point.
The bill for cheap technology
The UK's national cyber agency is pointing at old neglect, not a new kind of attack. NCSC chief executive Dr Richard Horne puts it this way: "For decades, we have collectively got away with doing tech on the cheap." The agency argues that AI puts that habit at risk.
What the NCSC said
The NCSC is part of GCHQ, the UK's signals intelligence agency. It published its State of the Cyber Nation report on 3 November. The report gives a date to watch: 2028. By then, it says, critical national infrastructure should be ready for a ransomware attack that uses AI-powered malware.
The report also looks two years ahead. It rates it "highly likely" that hostile actors who adopt AI will run bigger and more efficient operations. It names ransomware, social engineering and vulnerability exploitation. Ransomware locks systems until a victim pays. Social engineering tricks people into handing over access.
The NCSC does not say AI brings nothing new to attacks. It does warn of AI-powered malware. It also tells organisations to defend against both conventional and AI-powered attacks.
How it works: tolerated flaws, found faster
Horne's launch speech is careful on one point. He warns of a "real prospect" of an unprecedented rise in incidents. He says AI has not invented new ways to attack. His point is about weaknesses that organisations have put up with for far too long. AI means attackers can now discover and use them on a scale that Horne calls once unimaginable.
The source does not detail the tools involved. In general terms, automated software can probe very large numbers of systems and check each one for known weaknesses. A system that is unpatched or needlessly exposed to the internet is an easy target for that kind of sweep. A vulnerability is simply a flaw an attacker can use.
This is the author's reading, not the NCSC's wording. For years, many organisations may have been protected partly because attackers had limited time and attention. A flaw that nobody looked for was a flaw nobody felt pressed to fix. If AI makes looking cheaper, that quiet cover could fade.
The NCSC's launch material also urges organisations to prepare for a "vulnerability patch wave". It describes this as fixes for decades of technical debt. Technical debt means the shortcuts and ageing parts in a system that pile up repair work over time. The material we reviewed gives the headline of that guidance, not its detail.
What the NCSC asks leaders to change
Horne names three choices. First, address the failure to invest adequately in technology. Second, stop connecting technology to the internet when it does not need to be. Third, treat Cyber Essentials as the starting point for security, not the end goal. Cyber Essentials is the UK's baseline security scheme. Organisations should build further according to their size, complexity and risk.
The report points to existing, evidenced tools, standards and frameworks. The NCSC is not asking for a new product. It is asking organisations to finish the basics.
Horne also describes the stakes in human terms. He says leaders who skip these choices may have to explain to investors, shareholders, employees, customers and suppliers "when food isn't on shelves, lights aren't on, businesses have gone under."
What the government is funding
The government has also announced new money, which the Chancellor revealed the week before the report. It includes £60 million for the first phase of a national Cyber Shield. It also includes £70 million for the NERV Centre, short for National Exposure and Real-Time Vulnerability. The centre is meant to identify vulnerabilities across critical infrastructure and the economy.
The NCSC will run a new AI Cyber Security Centre of Excellence in Manchester, aimed at building AI security expertise within government. The government also points to the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan. These funds and laws build national capability. The material we reviewed does not describe money for an individual organisation's own systems.
Questions to put to your team
The NCSC's message is aimed at leaders, so the questions belong in a leadership meeting.
Which of our systems face the internet, and does each one need to? Someone should own the answer for every system on that list.
How long does a patch take to reach our oldest systems? If a large batch arrived at once, could we absorb it?
Are we certified to Cyber Essentials, and what is the plan for going beyond it? The NCSC calls it a starting point.
Which underfunded systems would we struggle to explain to customers after an outage? Those are the places to spend first.
The NCSC's point is about the cause of a possible rise, not about AI in general. In its account, the debt is old, and AI makes it cheap to collect.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: UK NCSC.
