The UK’s National Cyber Security Centre (NCSC) has warned that hostile actors are likely to use AI to increase the scale and sophistication of cyber attacks on critical national infrastructure within the next two years.
In its latest report, the cyber agency said AI adoption by attackers is “highly likely” to accelerate ransomware campaigns, social engineering attacks and the exploitation of software vulnerabilities.
The report warns that AI-powered malware could feature in a ransomware attack targeting the UK’s critical national infrastructure by 2028.
NCSC chief executive Dr Richard Horne said organisations need to address longstanding weaknesses in their cyber defences before AI allows attackers to exploit them at a much greater scale.
Commenting on the launch of the report, Horne said: “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.
“For decades, we have collectively got away with doing tech on the cheap.”
The report calls on organisations to strengthen their cyber resilience by investing in secure technology, reducing unnecessary internet exposure and using the NCSC’s Cyber Essentials programme.
The warning comes as the government increases investment in AI-enabled cyber security. Last week, the Chancellor announced £60 million for the first phase of a national Cyber Shield, £70 million for the National Exposure and Real-Time Vulnerability Centre, and funding for a new AI Cyber Security Centre of Excellence in Manchester, which the NCSC will run.
Security minister Dan Jarvis said: “The NCSC’s latest annual report shows cyber threats are growing more sophisticated. We’re using the power of AI to help stay ahead of those who seek to do us harm, with a new national Cyber Shield and an AI Cyber Security Centre of Excellence.”
Horne urged organisations to treat cyber security as a business priority rather than an afterthought, warning that failing to invest could leave leaders having to explain to customers and stakeholders “when food isn’t on shelves, lights aren’t on, businesses have gone under.”
