The head of the UK's National Cyber Security Centre has warned that Britain faces a real prospect of an "unprecedented rise" in cyber incidents over the coming months. He is not pointing to some new class of attack. His concern is the backlog of old, unfixed weaknesses, which attackers can now find far faster with AI.

Richard Horne, the NCSC's chief executive, made the warning on Nov. 3 as the agency launched its Annual Review 2026. In prepared remarks reported by The Record, Horne said the risk exists "because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

His foreword is blunt: "The UK's cyber resilience is not yet where it should be." According to Horne, the threat has increased faster than the capability to defend against it.

The numbers: more reports, fewer serious incidents

The review covers 1 September 2025 to 31 August 2026. The NCSC's incident management chapter gives these figures for the period:

  • 1,831 reports of cyber attacks received
  • 337 incidents that needed support from NCSC teams
  • 80 incidents classed as nationally significant
  • 8,500 organisations told of a suspected compromise through the NCSC's Early Warning service

The year-on-year comparison, set out by Insurance Business, appears to cut against the headline warning. Total reports rose to 1,831 from 1,727 the year before. But hands-on support cases fell to 337 from 429, and nationally significant incidents dropped sharply, to 80 from 204.

The NCSC does not treat that drop as good news. It says incident reporting "does not follow a simple year-on-year trend," and that past peaks have often been tied to a small number of particularly significant incidents. One quieter year for major incidents does not mean the risk is shrinking, and the review's forward-looking judgments explain why.

Why AI changes the maths

The central argument of Horne's foreword is easy to miss. AI, he writes, "did not create these cyber security weaknesses; it revealed them." The foreword says it exposed "years of technical debt and the failure to implement even basic cyber protections," with technology and security investment too often deferred. (Technical debt is the cost of quick fixes and deferred maintenance that piles up until someone has to pay it.)

For years, the effort needed to find and weaponise those flaws acted as a rough form of protection. A vulnerable server might go unnoticed simply because nobody had time to look. If AI tools let attackers search for flaws much faster and in much greater volume, that protection disappears. The weaknesses are the same; what has changed is how quickly someone can find them. The foreword says AI "makes cyber attacks easier, faster and cheaper to execute, and at greater scale."

The Record reports Horne citing one sign of the scale of the patching problem: the Linux kernel project alone patched more than a thousand vulnerabilities last month. Horne also said AI "is enabling vulnerabilities to be found and fixed faster than ever." Every one of those fixes still has to reach production systems before it protects anyone. The Record notes that experts have not yet observed a corresponding rise in exploitation.

Horne put the underlying problem bluntly. "For decades, we have collectively got away with doing tech on the cheap," he said, according to The Record, referring to organisations keeping end-of-life systems running and delaying upgrades for cost reasons.

The 2028 ransomware judgment

The review's most striking forward-looking claim concerns critical national infrastructure. The NCSC judges it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028, The Record reports.

"Highly likely" is a calibrated term in UK intelligence assessments, not a casual phrase. It signals a strong degree of confidence. Operators of energy, water, transport, health and similar systems should treat the judgment as a planning assumption, not a distant possibility.

Policy: liability for insecure products

The warning also comes with a change in policy. The Record reports that the UK government's budget revealed plans to consult on whether to hold technology companies liable for cyber breaches caused by insecure products. The budget item amounts only to a plan to consult, and the sources give no detail on scope, timing or what liability might look like.

The direction still matters. For years the burden of insecure software has fallen mostly on the organisations that buy and run it. Horne's foreword calls on organisations to "build proper full-life maintenance regimes" as they refresh their technology for AI, and describes the present as a "moment of choice": "If we act now, cyber security can become a source of national strength," while if "we delay, cyber attacks will become more frequent, more severe and more costly." The sources do not say how the liability plan and the foreword fit together, but the budget plan points toward more accountability for the companies that build the products.

For federal contractors in the US working through CMMC, none of this changes their obligations directly. It is, though, one more sign of governments asking harder questions about supplier security.

What It Means for Defenders

The useful thing about the NCSC's findings is how ordinary the attack methods are. According to the incident management chapter, most successful compromises still rely on familiar methods, and the NCSC names three:

  • Known vulnerabilities in internet-facing systems. The chapter says that even state-linked actors frequently gain access through vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion. If AI makes finding these flaws cheap, the time defenders have to patch is likely to shrink. Keep an up-to-date inventory of everything exposed to the internet, patch internet-facing systems first, and retire anything that no longer gets security updates. That last step is the "full-life maintenance" problem Horne describes.
  • Stolen credentials. The NCSC specifically recommends wider adoption of passkeys in place of passwords. Passkeys are a phishing-resistant replacement for passwords, built on cryptographic key pairs tied to a device, so there is no reusable secret to steal or type into a fake login page. Where passkeys aren't supported yet, cut down on password-only access to exposed services and rotate credentials that may have been exposed.
  • Social engineering. The NCSC lists it as a main route into networks, alongside the other two. Passkeys can help here too, because a convincing fake page can't capture a credential the user never types.

Other practical points from the review:

  • Act on notifications. The NCSC's Early Warning service told 8,500 organisations of a suspected compromise during the year. A warning like that should go straight to incident response, not into an inbox queue.
  • Budget for technical debt. Horne says AI "revealed" existing weaknesses. That suggests the systems most at risk are the old ones you already know about. A list of known-vulnerable or end-of-life systems is effectively an attacker's to-do list.
  • Critical infrastructure operators should plan for AI-enabled ransomware. The NCSC's "highly likely by 2028" judgment is a reason to test recovery, segmentation and offline backups now.
  • Watch the liability consultation. Vendors and buyers alike should follow the UK consultation on tech-company liability as it develops. It could change what buyers can demand from suppliers.

The incident management chapter does not name specific products, CVEs or fixed versions. Its message is broader and harder to act on: the known problems were never fully dealt with, and AI is making them much easier to find.

Sources