powered malware is strongly expected to feature in ransomware attacks on the UK’s critical national infrastructure by 2028, the country’s National Cyber Security Centre (NCSC) has warned
The country faces “a real prospect of an unprecedented rise in the number of cyber incidents,” NCSC CEO Richard Horne said during the launch event for the agency’s annual State of the Cyber Nation report in London, on November 3.
Horne said this heightened threat is supercharged by the use of AI, whose impact “will be felt by us all, whether you and your organization choose to harness it or not.”
The report warned that AI-powered malicious software is “highly likely” to be used in cyber-attacks conducted by financially motivated hackers against the UK’s power stations, airports and hospitals by 2028.
It also warned that nation states including Russia and China will routinely use AI in their cyber activity to achieve their geopolitical goals.
Yet, Horne emphasized that AI-based threats have not fundamentally revealed anything new.
The risk that looms is “not because AI has invented new ways to attack us,” he argued, but “because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
He pointed to “far too many organizations” relying on “tech on the cheap.”
“End-of-life systems kept running for just one more year, well-needed upgrades pushed back, as a ‘cost efficiency’ and technology providers failing to invest in security by design and default,” Horne outlined.
“We have installed technology then failed to invest in it throughout its lifecycle. Granted access where it was convenient rather than where it was necessary. Procured services based solely on their price without asking whether the technologies and operations underpinning them was resilient or secure. And failed to put in place the monitoring needed to detect when things go wrong,” he added.
UK Government Announces New Cybersecurity Investments
The best recent example, Horne said, is the threat of the PHP2Shell vulnerabilities. He noted that his agency has issued 110,000 proactive notifications and Early Warning alerts to UK organizations in response to the PHP vulnerabilities.
He also welcomed recent news that the British government has invested £60m ($80.4m) into developing the first phase of a national Cyber Shield, including a £25m ($33.5m) Challenge Fund supporting UK AI and cyber security innovators, and £70m ($93.8m) for a new National Exposure and Real-Time Vulnerability (NERV) Centre.
These <a href="https://www.gov.uk/government/news/chancellor-unveils-britains-ambitious-<a href="https://bitcomme.com/hmrc-by-salesforce-tax-office-explains-4-4b-crm-plan-2/” title=”"HMRC™ by Salesforce"? Tax office explains £4.4B CRM plan”>plan-for-ai” rel=”nofollow noopener” target=”_blank”>announcements, made on October 24, come alongside an additional £120m ($160.8m) investment in the AI Security Institute (AISI) and the establishment of new AI Cyber Security Centre of Excellence, ran by the NCSC in Manchester to provide world leading AI security expertise within government.
The government has also committed £40m ($53.6m) to establishing a National Agentic Security Unit to monitor and respond to uncontrolled AI bots, alongside a further £24m ($32.1m) to strengthen public-sector cyber defenses using advanced AI technology.
Alongside these investments, Cyber Security Minister, Baroness Lloyd, announced in a speech at the NCSC Annual Review event that the UK government is offering a 75% discount on Cyber Essentials certification for micro, small and medium-sized businesses, bringing the cost down to between £80 ($107) and £125 ($168), plus VAT.
More than 230 businesses have also signed up to the government’s Cyber Resilience Pledge, which will allow participating organizations to refer SMEs in their supply chains for free Cyber Essentials certification, with selected businesses also receiving support from a free cyber security advisor.
The government also announced 14 new Software Security Ambassadors, including Fortinet, Thales, Capgemini and Zscaler, which will work with the government to promote secure software development and encourage wider adoption of its Software Security Code of Practice.
A “Moment of Choice” for UK Organizations
Horne said UK organizations and at “a moment of choice” and urged them to “reckon with the current state of their cybersecurity” as new technologies like AI will expose vulnerabilities, failings and underinvestment at an unprecedented speed and scale in the years ahead.
The NCSC report also suggested that the UK is at a point of “enormous consequence” for cybersecurity and that organizations must make use of the tools, standards and frameworks that already exist and are evidenced to protect them from conventional and AI-powered cyber-attacks.
“We can be a nation where leaders of all organizations actively choose to invest with urgency and where all organizations make security and resilience a fundamental requirement, not an afterthought. The collective result would be a speech
He added that failing to make these choices will result in leaders “having to look their investors, shareholders, employees, customers, suppliers, in the eye and explain, when food isn’t on shelves, lights aren’t on, businesses have gone under.”
Commenting on the report, Anthony Young, CEO at UK-based critical infrastructure security provider Bridewell, stressed that the NCSC’s two-year warning “feels generous.”
“AI is already helping attackers, and vulnerability discovery is accelerating faster than many organizations can test and deploy patches. There is no time to wait when so many of the weaknesses attackers can exploit are already there, highlighting the recent attacks on supermarket refrigeration systems are a good example of this and “an extension of the problems we have seen for years with internet-connected CCTV and heating or ventilation systems.”
“Organizations cannot assume that insurance will resolve the consequences of an attack when essential services are disrupted. Cyber Essentials matters because so many attacks still exploit basic weaknesses, and leaving those weaknesses in place makes life too easy for everyone from amateur hackers to nation-state attackers. We’ve spent 25 years telling organisations to get the basics right. AI is making it harder for them to get away with ignoring that advice,” Young added.
The warnings come as the UK government is taking action through the introduction of the Cyber Security and Resilience Bill and the forthcoming National Cyber Action Plan to strengthen the UK’s defenses.
