AI-powered malware is “highly likely” to be used in ransomware attacks on Britain’s critical national infrastructure within the next two years.
The head of GCHQ’s National Cyber Security Centre, Dr. Richard Horne, warned that abuse of AI technologies is making it much easier for attackers to rapidly expose and exploit long-neglected security weaknesses.
Dr. Horne argued that underinvestment in technology and security have left organisations carrying a technical debt that leave them wide open to attack.
AI adoption by hostile actors is “highly likely” to increase the scale and efficiency of their operations, including ransomware attacks, social engineering, and vulnerability exploitation, the latest edition of the NCSC’s State of the Cyber Nation annual report warns. The issue is more that AI will allow attackers to exploit overlooked vulnerabilities rather than forge exotic new attacks.
The report identifies state-linked threat groups, particularly China and Russia, as the UK’s primary cyber antagonists. For example, in July 2026 the NCSC warned that Russian groups were systematically exploiting vulnerable routers and globally targeting networks maintained by critical national infrastructure providers, including energy grids and telecommunications networks.
In August 2026 the NCSC warned about increased targeting of operational technology systems across multiple sectors globally, including in the UK.
“AI will continue to be integrated into threat actors’ cyber operations, increasing the speed, scale and efficiency of existing attack methodologies rather than autonomously conducting end-to-end attacks,” the NCSC report predicts.
The NCSC reports that up to 88% of all attacks originate from just four vectors: phishing, exploiting public-facing applications, misuse of valid accounts, and exploiting external remote services.
Variations on a theme
“None of these vectors are radical or new,” said Oliver Spence, CEO of security operations tools vendor CybaVerse. “In fact, they represent the same failures cybercriminals have successfully exploited for decades.”
Spence added: “Threat actors rarely depend on the most complex, technical means for launching attacks; more often than not, they search for the most easily exploitable holes in organisations’ systems, like misconfigured VPNs and vulnerabilities in third-party vendor software platforms, and on tried-and-true social engineering techniques.”
AI doesn’t represent a sea-change in attackers’ strategies but rather a force multiplier.
“Threat actors may be able to leverage AI to launch more sophisticated attacks, but the real danger is in the automated exploitation of existing weaknesses and organisational failures,” Spence concluded.
Countermeasures
AI offers a means to improve the UK’s collective cyber resilience, but it will only be effective if organisations deal with years of underinvestment and foundational weaknesses before building from a more solid foundation, according to Dr. Horne.
The UK government’s Cyber Essentials scheme should become the starting point or baseline for enterprise cyber security, not the end goal, for building improved cyber resilience.
Last week the UK government pledged £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre, which will be task to identify vulnerabilities across critical infrastructure and the economy, and a new AI Cyber Security Centre of Excellence, run by the NCSC.
No Responses