THE CRUNCH
Britain faces a "real prospect of an unprecedented rise in the number of cyber incidents" in the coming months, according to a warning from Richard Horne, chief executive of the National Cyber Security Centre (NCSC), launching the agency's annual report. The warning follows a June alert from the Five Eyes intelligence alliance, which said AI would transform offensive and defensive cyber capabilities and that "the timeline is not years, it is months."
Notably, Horne does not blame AI for inventing new kinds of attack. Instead, he argues that vulnerabilities "tolerated for far too long" can now be discovered and exploited at a previously unimaginable scale, exposing years of technical debt and missing basic protections. As evidence, he points to vendors fixing hundreds of flaws in a single update and the Linux kernel project patching more than a thousand vulnerabilities last month.
The NCSC says it is "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028, and that China and Russia will by then routinely use AI in cyber operations. Even state-linked hacks, the agency says, often exploit flaws in internet-facing applications where patches exist but have not been applied quickly enough.
The government is also turning AI to defence. A pilot called Project DROMOS, expanded from a four-week trial into live government environments, found "hundreds of potential security issues, including critical vulnerabilities." Next come a £70 million NERV Centre to spot vulnerabilities across critical infrastructure, and £60 million for the first phase of Cyber Shield, a national network of AI agents built by security companies on an NCSC platform, initially focused on detecting and blocking attacks. The NCSC believes the "structural advantage will remain with defenders."