Access routes
The four routes in that AI does not change
AI helps attackers work faster, yet the NCSC's incident data shows the same four doors. Closing them is the most direct resilience work available.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The data
What the review found
The four doors
What each means for you
Public-facing applications
Websites, portals and gateways reachable from the internet. Patch them first and remove any that do not need to be exposed [3].
Phishing
AI helps attackers write convincing messages [7]. Training that relies on spotting bad spelling will fail, so pair it with technical controls and an easy way to report suspicious mail.
Valid accounts
External remote services
Gateways and tools that let people connect from outside. Make a list, narrow down who may use them, and monitor their use [7].
Priorities
What to check this week
Work through these questions with your IT team:
- Which public-facing applications do we run, and who patches them?
- Which accounts can log in remotely, and do they all need to?
- Where could passkeys replace passwords first?
- How would we notice a valid account behaving oddly?
Why it holds
Basics beat novelty
It is tempting to chase the newest threat. The agency's figures point the other way: four routes cover nearly nine in ten incidents at large organisations [7]. Spending on them lowers risk from AI-assisted and conventional attackers alike. A board that asks for evidence on each route, such as exposed services removed or accounts moved to passkeys, gets a measure it can follow quarter by quarter.
Keep reading
Read next
Staff AI use
The NCSC's review warns that unapproved AI services can leak company data. How to set rules for staff without blocking useful tools.
Read the guide
Cyber Essentials
The NCSC calls Cyber Essentials the starting point for AI-era resilience. What the 75% discount covers and what to do beyond certification.
Read the guide
Is AI-powered ransomware already hitting UK organisations?
The NCSC's AI ransomware warning is a forecast to 2028. What responders have seen so far, and what has not been confirmed.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.