UK cyber chief warns of sharp rise in AI-driven attacks

Who is affected

The warning comes from the UK National Cyber Security Centre (NCSC), part of GCHQ, and is aimed at organisations across the UK. The NCSC says the risk is highest for businesses and infrastructure that rely on outdated or poorly maintained technology. Sectors running "end-of-life" systems or delaying security updates for cost reasons are especially vulnerable, according to NCSC chief Richard Horne. The warning applies to both public and private sector organisations.

How the attack worked

The NCSC does not claim that AI has invented new attack methods. Instead, it says AI makes it much easier and faster for attackers to find and exploit existing vulnerabilities, weaknesses in software or systems that have not been fixed. Horne points out that "vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." The agency notes that attackers, including state-backed groups from countries such as China and Russia, are expected to use AI routinely by 2028. The main risk is that attackers will use AI to automate the search for known flaws in internet-facing applications, especially when patches (fixes) are available but have not been applied quickly enough. The NCSC says even sophisticated attacks often start with these basic weaknesses.

The response

The UK government is responding by investing in AI-powered defences. The NCSC has already tested "frontier AI systems" to find weaknesses in its own networks. One pilot, Project DROMOS, found hundreds of potential security issues, including critical vulnerabilities, in live government environments. The government is now expanding its efforts with a new £70 million National Exposure and Real-Time Vulnerability (NERV) Centre, which will use AI to scan for vulnerabilities across critical infrastructure and the wider economy. Another £60 million is going to Cyber Shield, a national network of AI agents designed to detect and block attacks at machine speed. The NCSC says defenders still have an advantage, as they control their own systems, but warns this edge could be lost without investment and discipline.

What you should do

The NCSC's message is clear: organisations must stop delaying security updates and upgrades. Many attacks succeed because patches for known vulnerabilities are not applied in time. The agency urges executives to prioritise basic cyber hygiene, such as keeping systems up to date and replacing unsupported software. The NCSC also calls for a "strategic policy agenda" to encourage secure technology by design, rather than relying on last-minute fixes. The government is considering making technology companies liable for breaches caused by insecure products, but no decision has been made yet.

Recorded Future News↗ (opens in a new tab) | The Times↗ (opens in a new tab)