Britain faces the “real prospect of an unprecedented rise in the number of cyber incidents” in the coming months, the head of the country’s National Cyber Security Centre (NCSC) will warn Tuesday.
Launching the agency’s annual report, NCSC Chief Executive Richard Horne will warn that the risk is “not because AI has invented new ways to attack us,” but “because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
The warning follows an alert issued in June by the Five Eyes intelligence alliance, which said AI would fundamentally transform both offensive and defensive cyber capabilities. “The timeline is not years, it is months,” it said at the time.
Officials point to the surging levels of vulnerabilities being uncovered by vendors as evidence this transformation is underway. They warn the change is accelerating, even if experts have not yet observed a corresponding rise in exploitation.
“Major technology providers are now fixing hundreds of vulnerabilities in a single update … and the Linux kernel project alone patched more than a thousand vulnerabilities last month,” Horne will say, adding that AI “is enabling vulnerabilities to be found and fixed faster than ever.”
The risk from attackers deploying the technology remains significant. The NCSC will say it was “highly likely” that AI-powered malware would be used in a ransomware attack on Britain’s critical infrastructure by 2028, and warned that China and Russia will “routinely” be using AI in their cyber operations by that date.
The annual report stresses that AI “did not create these cybersecurity weaknesses,” but is instead exposing “years of technical debt and the failure to implement even basic cyber protections.”
The NCSC will say even hacks linked to state-sponsored actors were often conducted through internet-facing applications and by exploiting “vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion.”
Speaking in the wake of the British government’s official budget, which revealed plans to consult on whether to hold technology companies liable for cyber breaches caused by insecure products, Horne will take aim at how existing business practices have led to the current status of widespread vulnerability.
“For decades, we have collectively got away with doing tech on the cheap,” he will say, referencing organizations keeping end-of-life systems running as part of their operations and delaying upgrades for “cost efficiency” reasons.
He will warn that executives who fail to act will end up having to “look their investors, shareholders, employees, customers, suppliers, in the eye and explain … when food isn’t on shelves, lights aren’t on, businesses have gone under.”
The NCSC had called publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled. Its chief technology officer, Ollie Whitehouse, wrote last year that “the reality is that in 2025, we know how to build secure products and services” but “the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient.”
AI vs AI
The threat posed by AI can be countered, Horne will say, explaining how the British government — including NCSC, a part of the cyber and signals intelligence agency GCHQ — is planning to deploy it for security purposes.
“AI has the potential to be one of the greatest opportunities in cyber defence,” he is expected to say. The report reveals the government has already begun testing frontier AI systems to identify weaknesses in its own networks.
One such initiative, titled Project DROMOS, was initially planned to be a four-week pilot before being expanded into live government environments where it found “hundreds of potential security issues, including critical vulnerabilities.”
The agency plans next to look beyond government systems with a new £70 million ($93 million) NERV Centre — the National Exposure and Real-Time Vulnerability Centre. This is intended to use AI to build on some of NCSC’s existing projects to “identify vulnerabilities across our critical infrastructure and economy.”
A further £60 million ($80 million) has been allocated to the first phase of Cyber Shield, a national network of AI agents first previewed in July that Horne is expected to say “will embed cutting-edge agentic AI into machine speed cyber defence at a national scale.”
Under the plan, the NCSC will provide the platform and threat intelligence, while security companies and open-source developers will build AI agents to operate within organizations across the country. The initial phase will focus on detecting and blocking attacks, the report will say.
In the new report, the NCSC will say it believes the “structural advantage will remain with defenders” as AI transforms cybersecurity. It is defenders who “own or operate the environment, can instrument it, can change it and can define acceptable behaviour.”
“But,” it warned, “this advantage is not a given and realising it requires clear direction, investment and disciplined adoption.”
