Question
What does the NCSC mean by 'highly likely'?
It is a defined probability term, not a casual phrase. The NCSC uses a fixed scale, so each word in its AI assessment carries a specific level of confidence.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
Short answer
A fixed scale
The NCSC's assessment uses the PHIA probability yardstick throughout, with terms such as almost certain, highly likely, likely and realistic possibility [2]. The numeric ranges sit in an image on the page, so we do not restate them here. Read the NCSC page itself if you need them.
In this assessment
Where each term appears
| Judgement | Term used |
|---|---|
| Ransomware against essential UK services using malware built with AI, by 2028 | Highly likely [2] |
| States such as Russia and China routinely using AI cyber capabilities | Highly likely [2] |
| Many systems staying vulnerable to AI tools that find and exploit weaknesses | Almost certain [2] |
| Attackers targeting legacy technology in critical infrastructure | Likely [2] |
Scenarios
Possibilities, not predictions
Drivers
What could change the outcome
The assessment lists the factors that shape where 2028 lands: geopolitical tensions, UK critical infrastructure cyber defence, the pace of AI development, the availability of AI cyber capability and a workforce literate in AI and cyber security [2]. Several of these are partly within an organisation's control, particularly defence and skills.
For your planning
Do not wait for certainty
The practical reading is that a risk the NCSC rates highly likely is one to plan for now, using the preparation page.
Keep reading
Read next
Does the NCSC's AI warning affect a small business?
The forecast targets critical infrastructure, but the NCSC's advice and the Cyber Essentials discount reach smaller UK businesses. What to do.
Read the guide
Questions
Short, sourced answers on the NCSC's AI ransomware warning: what it means, who is exposed, and what a UK organisation should do first.
Read the guide
Who is affected
The forecast targets UK critical national infrastructure, but the NCSC's advice reaches every organisation. How to tell where you sit.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.