UK facing AI-powered attacks on CNI “within two years” warns NCSC

The NCSC’s 29-page report (published under the heading The State of the Cyber Nation) warns that, within the next two years, AI adoption by hostile actors is “highly likely” to increase the scale and efficiency of their operations, including ransomware attacks, social engineering and vulnerability exploitation.

In a speech making the launch of the report, Dr Richard Horne (CEO of the NCSC) noted that the AI revolution must force UK organisations to reckon with the current state of their cyber security as new technologies will expose vulnerabilities, failings and underinvestment at an unprecedented speed and scale in the years ahead.

The head of the UK’s cyber agency also set out how AI represents the critical opportunity to improve the UK’s collective cyber resilience, but that organisations must take urgent action to address foundational investments and weaknesses or otherwise risk adversaries exploiting them instead.

National Cyber Action Plan

The warning comes as the Government is investing in the UK’s defence and resilience capabilities, including greater investment in cyber defence, while in parallel taking action through the introduction of the Cyber Security and Resilience Bill and the forthcoming National Cyber Action Plan in order to strengthen the UK’s defences, deter hostile state aggression, maintain essential services and keep the British people safe.

Alongside calls for organisations to strengthen their resilience, the Chancellor has also announced greater investment in capabilities to help the UK harness AI for cyber defence, including £60 million for developing the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy and a new AI Cyber Security Centre of Excellence (run by the NCSC) in Manchester to develop world-leading AI security expertise within Government.

This year’s report from the NCSC suggests that the UK is at a point of “enormous consequence” for cyber security and that organisations across the nation must make use of the tools, standards and frameworks that already exist (and, indeed, are evidenced) in order to protect themselves from conventional and AI-powered cyber attacks.

The NCSC is imploring organisations across the UK to face up tp what Dr Horne is calling “a moment of choice”.

Unprecedented rise

Dr Richard Horne explained: “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. We must be clear that this isn’t due to AI inventing new ways in which to attack us. Instead, it’s due to the fact that vulnerabilities tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

Dr Horne continued: “For decades now, we have collectively managed the situation by doing ‘tech on the cheap’. We can be a nation where leaders of all organisations actively choose to invest with urgency and where all organisations make security and resilience a fundamental requirement, not an afterthought. The collective result would be a source of enduring national strength for us all.”

Dr Horne has urged all organisations across the country to “take the responsibility now to make different choices”, including addressing the failure to adequately invest in their technology, not having technology unnecessarily connected to the Internet and making Cyber Essentials the starting point for cyber security, not the end goal, with organisations building greater resilience according to their size, complexity and risk.

According to Dr Horne, failing to make these choices will result in leaders “having to look their investors, shareholders, employees, customers and suppliers in the eye and explain themselves when food isn’t on shelves, lights are not on and businesses have gone under.”

Growing in sophistication

Security Minister Dan Jarvis said: “In its tenth year, the NCSC now plays a more important role than ever before, defending our security on the cyber front line. The organisation’s latest ‘State of the Nation’ review shows that cyber threats are growing more sophisticated. We’re using the power of AI to help stay ahead of those who seek to do us harm, with a new national Cyber Shield and an AI Cyber Security Centre of Excellence being brought forward.”

Simon Edwards, CEO of SE Labs, informed Security Matters: “These warnings come as little surprise given the current state of the cyber threat landscape and the constant wave of attacks targeting organisations. Cyber criminals are increasingly exploiting AI and cause significant disruption, often at an unprecedented speed and scale.”

Edwards continued: “Crucially, we also cannot overlook threats not powered by AI and the issue of ‘cyber poverty’. SMEs often lack the financial resources to build strong cyber security capabilities, despite being the backbone of larger organisations’ supply chains. Businesses are being exposed not only to emerging AI-powered attacks, but also to more traditional threats.”

Further, Edwards observed: “Organisations need cyber security regimes that can keep pace with current cyber threats. Traditional approaches are no longer enough. Rigorous and independent testing against real-world attacks is essential for exposing weaknesses before the hackers do so, thereby ensuring businesses are properly protected against these evolving threats.”

Radical transformation

David Ferbrache, managing director of Beyond Blue, noted: “The 10th Annual ‘State of the Nation’ report from the NCSC highlights how the threat landscape is being radically transformed by frontier AI, but with familiar themes around state threats and the growing scale of cyber crime.”

Ferbrache continued: “In the last year, highly capable AI models have become mainstream. This is changing the threat landscape, but as the NCSC’s CEO points out, the vulnerabilities AI is discovering have always been there. AI is just shining a spotlight on them. This means the cyber security fundamentals are still essential as attackers continue to exploit the basic weaknesses they’ve been compromising for the last decade.”

In addition, Ferbrache explained: “The report also sets out a scenario for 2028 where AI-powered malware will be used in a ransomware attack against CNI. This is a situation the operators of CNI must be prepared for, but again defences has to focus on the Best Practice we continue to promote today.”

As far as Ferbrache is concerned, the report is very definitely a ‘Call to Action’. One which demands not only action to address the basics of security, not least in the CNI space, but also to create AI-enabled national cyber defences.

“The Cyber Shield and National Detect Strategy that have been set out hint at the vision for those national defences, but their creation also underlines the challenges of working across a complex and disparate set of commercial providers. There’s strength in community, but also complexity. That risks an inertia that attackers would exploit.”

Technology choices

“Ultimately,” affirmed Ferbrache, “our cyber security will be shaped by the technology choices the largest nations make, as well as by the standards and approaches our allies adopt. While we need to be cautious about UK-only solutions, that must not stop the NCSC leading by example.”

Ferbrache said: “Perhaps the NCSC’s report underplays the link between cyber security and resilience. Of course, it’s vital that we protect our key systems and also detect and respond to any attack in real-time, but we also need to be resilient to cyber attacks, recover quickly and focus on minimising the impact.”

In conclusion, Ferbrache told Security Matters: “Building the bridge between our cyber defenders and our business resilience teams is key. So is helping Boards of Directors and executives to make the hard financial choices around cyber resilience in a world of complex geopolitics, hybrid warfare and AI-enabled everything.”