TL;DR
The National Cyber Security Centre’s State of the Cyber Nation report, published on 3 November, judges it “highly likely” that AI-powered malware will feature in ransomware aimed at UK critical national infrastructure by 2028. Its chief executive, Dr Richard Horne, argues that the cause is old weaknesses rather than new attacks. Ministers paired the warning with a 75% discount on Cyber Essentials for smaller firms.
The agency, part of GCHQ, launched the report alongside its Annual Review. In remarks released ahead of his speech, Horne was due to warn of a real prospect of “an unprecedented rise in the number of cyber incidents” in the coming months. His explanation is pointed: AI has not invented new ways in, but vulnerabilities “tolerated for far too long” can now be found and used at scale. “For decades, we have collectively got away with doing tech on the cheap,” he was due to say.
What the assessment actually says
The Annual Review’s AI chapter adds important qualifications. It expects AI to speed up existing tactics rather than create fresh attack routes, and it says adoption among attackers remains uneven. People, it judges, will highly likely still be needed to direct and check the work, with skilled operators gaining most.
Three judgements matter for UK boards. China is named as highly likely to have both the intent and the best position to use AI against critical infrastructure. Staff moving company data to personal devices to use unapproved tools leaves firms blind to where that data goes. And the agency is almost certain that a gap will open between organisations able to use AI defensively and those that cannot, with the latter becoming more attractive targets.
What firms are being told to do
Horne’s asks are basic: invest in technology properly, take systems off the internet where they do not need to be there, and treat Cyber Essentials as a floor. Leaders who ignore this, he was due to say, may have to explain to investors and staff why shelves are empty, lights are off and “businesses have gone under”.
On the same day, the government cut the price of Cyber Essentials for micro, small and mid-sized firms to between £80 and £125 plus VAT. Over 230 companies in the Cyber Resilience Pledge can also refer suppliers for free certification. The agency’s release points to Budget measures too, including £60 million for a national Cyber Shield and £70 million for a vulnerability centre.
Looking Forward
The next tests are the promised National Cyber Action Plan and the Cyber Security and Resilience Bill. In our view, the framing is the useful part for UK leaders: this is presented as an investment failure that AI will expose, not as a problem AI created. That makes it a board-level spending question.