Britain is facing a potential surge in cyber incidents, with the National Cyber Security Centre (NCSC) warning of an “unprecedented rise” in attacks in the coming months. Richard Horne, the NCSC Chief Executive, is set to deliver this stark message during the agency’s annual report launch, emphasizing that the threat stems not from new AI-driven attack methods but from long-standing vulnerabilities that are now more easily exploitable.
This warning follows a June alert from the Five Eyes intelligence alliance, which indicated that AI would significantly alter both offensive and defensive cyber capabilities, with a timeline for these changes measured in months rather than years. Officials have noted a dramatic increase in vulnerabilities being identified by technology vendors, suggesting that the landscape is shifting rapidly, even if exploitation rates have not yet caught up.
Vulnerabilities and AI’s Role
Horne will highlight that major technology providers are now addressing hundreds of vulnerabilities in single updates, with the Linux kernel project alone patching over a thousand vulnerabilities last month. He noted that while AI is facilitating faster identification and remediation of these weaknesses, the risk of AI-powered malware being deployed in ransomware attacks against critical infrastructure is “highly likely” by 2028. Furthermore, he warned that nations like China and Russia are expected to routinely leverage AI in their cyber operations by that time.
The NCSC’s report underscores that AI has not created these cybersecurity weaknesses but is instead revealing years of technical debt and inadequate basic cyber protections. Even state-sponsored attacks often exploit vulnerabilities for which patches are available but have not been applied in a timely manner.
Accountability and Future Initiatives
In light of the British government’s recent budget proposals, which include consultations on holding technology companies accountable for breaches stemming from insecure products, Horne criticized the prevailing business practices that have led to widespread vulnerabilities. He stated, “For decades, we have collectively got away with doing tech on the cheap,” referring to organizations that continue to operate outdated systems for cost-saving reasons.
Horne cautioned that executives who neglect to address these vulnerabilities will face serious consequences, particularly if critical services are disrupted. The NCSC has previously called for a strategic policy agenda to tackle insecure technology, emphasizing that while secure products and services can be built, the incentives for their adoption are insufficient.
Leveraging AI for Cyber Defense
Despite the threats posed by AI, Horne will also discuss the potential for AI to enhance cybersecurity defenses. The NCSC is actively exploring AI applications for security, including Project DROMOS, which has already identified numerous vulnerabilities in government networks. The agency plans to expand its efforts with the establishment of the National Exposure and Real-Time Vulnerability Centre, aimed at identifying vulnerabilities across critical infrastructure and the economy.
Additionally, a £60 million investment has been allocated for the Cyber Shield initiative, which will integrate AI agents into national cyber defense strategies. This initiative aims to enhance the detection and blocking of cyber attacks, reinforcing the belief that defenders can maintain a structural advantage in cybersecurity if they invest wisely and adopt disciplined practices.
As the NCSC prepares to navigate this evolving threat landscape, the emphasis remains on the need for proactive measures and accountability in addressing the vulnerabilities that have long been tolerated.
For further insights, see the report from The Record.
For more global cybersecurity coverage, visit CWME’s Global section.
