Latest
Annual Review and AI assessment published[1]
The NCSC published its Annual Review 2026 and an assessment of AI and cyber intrusion to 2028, alongside a speech by its chief executive.
NCSC warning, November 2026
Is your organisation ready for AI-enabled attacks?
Britain's national cyber agency expects criminals to use AI-built malware in a ransomware strike on essential services before 2028. No brand-new attack technique has been observed yet, so resilience begins with repairing known weak points.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
At a glance
- 2028
- Horizon for the NCSC's judgement on AI-powered ransomware against UK critical infrastructure[2]
- 88%
- Of incidents at large organisations that used one of four initial access routes[7]
- 80
- Nationally significant incidents handled by the NCSC in its review year[7]
- 75%
- Announced discount on a first Cyber Essentials certificate for smaller businesses[6]
The latest
AI Cyber Resilience: what has happened so far
Newest first. Each entry links to its source.
Coverage of the review and its incident figures[7]
Reporting set out the review's incident counts, the four access routes behind most incidents and the funding announcements.
Government funding announced[6]
Infosecurity Magazine reported £60m for the first phase of a national Cyber Shield and £70m for a National Exposure and Real-Time Vulnerability Centre, among other measures.
The warning
What was announced
The government's cyber authority, the NCSC, released its Annual Review 2026 on 3 November, with a standalone assessment titled "Artificial intelligence and cyber intrusion" [1]. One of the assessment's headline judgements concerns ransomware: the agency rates as highly likely that malware powered by AI will be used against UK critical national infrastructure before 2028 [2].
Read that as a forecast and not a report of something that has occurred. Incident responders at the agency have watched attackers pick up AI tools, yet nothing they observed amounted to a new category of attack [7]. The difference is pace. Weaknesses that organisations have tolerated for years can now be located and abused much quicker [1].
A phrase worth repeating to your board
The NCSC chief executive said the country has been doing "tech on the cheap" for decades, according to The Register [5].
Your position
Does this reach you
Critical infrastructure is where the forecast points. The practical advice is broader: leaders everywhere are asked to treat security and resilience as a basic requirement, sized to the organisation's scale, complexity and risk [1]. Read who this applies to to place yourself, then follow the preparation steps.
The numbers
Why basics still matter
Across the review year the agency dealt with 80 nationally significant incidents, drawn from 337 that needed support from its Incident Management Team [7]. For large organisations, 88% of incidents began with one of four routes: exposed applications, phishing, genuine logins or remote access services [7]. None of those doors is new, and each can be narrowed this quarter.
Where next
Choose a page
Key points
- Key dates covers what was published and when.
- What to do gives the ordered steps.
- Preparing for a patch wave suits teams with exposed systems.
- Questions holds short answers.
What to do
Four things to do first
-
1
Patch and reduce what faces the internet
IT and security teams
-
2
Tighten accounts and remote access
IT teams and identity owners
-
3
Protect backups and rehearse your response
IT leads and the board
-
4
Use Cyber Essentials as your starting point
Directors and compliance leads
There are six steps in all, with who does each one. See every step
Quick answers
Questions people ask
When will AI-powered ransomware hit UK critical infrastructure?
The NCSC puts it as highly likely at some point before 2028[2]. That is a forecast and not a confirmed incident, and the agency describes its scenarios as plausible medium-term possibilities rather than predictions[2].
Has AI created a new kind of cyber attack?
Not so far, according to the NCSC's responders, who saw attackers using AI tools without any of it enabling a new class of attack[7]. Its chief executive said the same thing differently: long-tolerated flaws can now be exploited at much larger scale[4].
About this site
Primary sources, dated
The CyPro Consulting Ltd team maintains this site. Every version, date and figure comes from 5 named sources, including NCSC, SecurityWeek, The Register, and links to the one it came from. Last checked 4 November 2026.
Who we are and how pages are kept currentStart here
The guides, in the order to read them
Who is affected
The forecast targets UK critical national infrastructure, but the NCSC's advice reaches every organisation. How to tell where you sit.
Read the guide
Key dates
The dates behind the NCSC's AI ransomware warning: the patch wave blog, the 3 November 2026 review and the 2028 horizon, each sourced.
Read the guide
What to do
Practical, ordered steps for UK organisations after the NCSC's AI warning: exposure, access, backups, Cyber Essentials, legacy kit and AI use.
Read the guide
Questions
Short, sourced answers on the NCSC's AI ransomware warning: what it means, who is exposed, and what a UK organisation should do first.
Read the guideGo deeper
In depth Patch wave 
In depth Legacy systems 
In depth Access routes 
In depth Staff AI use 
In depth Cyber Essentials 
Question Is AI-powered ransomware already hitting UK organisations? 
Question What does the NCSC mean by 'highly likely'? 
Question Does the NCSC's AI warning affect a small business? How CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.