Questions UK leaders are asking

The NCSC puts it as highly likely at some point before 2028[2]. That is a forecast and not a confirmed incident, and the agency describes its scenarios as plausible medium-term possibilities rather than predictions[2].

Not so far, according to the NCSC's responders, who saw attackers using AI tools without any of it enabling a new class of attack[7]. Its chief executive said the same thing differently: long-tolerated flaws can now be exploited at much larger scale[4].

The forecast is about essential services, yet the advice is meant for all organisations, sized to their scale, complexity and risk[1]. Suppliers to critical services and anyone with exposed systems should act as well[3].

Exposed applications, phishing, valid accounts and remote access services from outside[7]. Between them they featured in 88% of the incidents the NCSC recorded at large organisations[7].

It is the NCSC's label for a surge of software updates expected as AI assists flaw discovery, tied to older technical debt[3]. Its advice is to deploy fixes faster and more often, including through suppliers[3].

A first certificate for a smaller business was reported at £80 to £125 plus VAT once the 75% reduction applies[6]. Smaller here means micro, small and medium-sized firms. Check current terms with the certification body first.

The sources we read announce no new legal duty or compliance deadline. The NCSC mentions the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan as the wider backdrop[1].

The review cautions that unapproved AI services can leak sensitive information and leave employers unable to follow where it goes[7]. An approved list, plus rules on what data may be entered, tackles that risk directly.

Yes. The review says it can help spot weaknesses, sift alerts and speed response, provided automated actions have clear limits and human oversight[7]. The NCSC also conceded that many organisations are not yet comfortable with automated defence[5].

Find what can be reached from the internet and patch it first. The NCSC's order is the external attack surface, then critical security systems[3].