Britain faces the prospect of an unprecedented rise in cyber incidents in the coming months as AI makes longstanding weaknesses easier to find and exploit, NCSC chief executive Richard Horne is expected to warn on November 3. The Record reports that his annual review address will put delayed security fixes and ageing systems at the centre of the risk to organizations and essential services.
The National Cyber Security Centre’s own announcement calls for urgent investment in resilience, warning that years of “tech on the cheap” have left UK organizations exposed. Critical infrastructure operators face a specific forecast: the agency assesses it as “highly likely” that AI-powered malware will feature in a ransomware attack on Britain’s critical infrastructure by 2028.
That is a forecast of malicious software using AI, rather than a report of such an attack already occurring. The NCSC also expects China and Russia to use AI routinely in their cyber operations by that date, The Record reports.
Old weaknesses, faster discovery
Horne’s central argument is that AI is accelerating the discovery and exploitation of existing security flaws. The annual review attributes those weaknesses to accumulated technical debt—the security burden left by deferred maintenance—and failures to implement basic protections.
Officials point to growing numbers of vulnerabilities found by technology vendors as evidence that the shift is underway, although experts have not yet observed a corresponding increase in exploitation. Horne is expected to say that major providers now fix hundreds of vulnerabilities in individual updates and that the Linux kernel project patched more than 1,000 last month.
The warning follows a June alert from the Five Eyes intelligence alliance, which said AI would fundamentally transform offensive and defensive cyber capabilities within months.
For organizations, the exposure is familiar. The review says even attacks linked to state-sponsored actors often enter through internet-facing applications—software reachable from outside an organization—and exploit flaws for which fixes already exist but have not been installed promptly.
Horne is expected to criticize the continued use of end-of-life systems and upgrades deferred to save money. He will warn executives that the consequences can reach beyond their own networks to disrupted food supplies, electricity and business operations.
The speech follows government budget plans to consult on whether technology companies should be liable for breaches caused by insecure products. That remains a proposed consultation. The NCSC called for a strategic policy agenda last year; its chief technology officer, Ollie Whitehouse, argued in 2025 that organizations knew how to build secure products and services, but commercial incentives were insufficient to sustain their adoption.
Government expands AI defence projects
The government is also testing whether AI can help defenders find weaknesses sooner. The Record says the annual review describes trials of frontier AI systems, meaning leading-edge models, on government networks.
Project DROMOS began as a planned four-week pilot before expanding into live government environments. The review says it found hundreds of potential security issues, including critical vulnerabilities.
The next planned expansion is the £70 million ($93 million) National Exposure and Real-Time Vulnerability Centre, or NERV Centre. It is intended to use AI to extend existing NCSC work identifying vulnerabilities across critical infrastructure and the wider economy.
A further £60 million ($80 million) has been allocated to the first phase of Cyber Shield, a national network of AI agents first previewed in July. These are systems designed to carry out tasks with a degree of autonomy. Under the plan, the NCSC will supply the platform and threat intelligence, while security companies and open-source developers build agents to operate within organizations. The initial phase will focus on detecting and blocking attacks.
The NCSC, part of intelligence agency GCHQ, argues that defenders can retain a structural advantage because they control their environments, can monitor and change them, and can define acceptable behaviour. Its review says realizing that advantage requires direction, investment and disciplined adoption.
For executives and security teams, the agency’s immediate call is to invest in resilience, address delayed upgrades and install available security fixes promptly. The NCSC’s accompanying guidance also urges organizations to prepare now for a wave of patches addressing decades of accumulated technical debt.
