Preparation
Preparing for AI-enabled attacks, in order
Begin with what faces the internet and who can log in. The NCSC's message is that proven controls still work, so apply them faster and more consistently.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The principle
Proven controls, applied faster
The NCSC asks organisations to lean on existing tools, standards and frameworks already shown to protect against conventional and AI-enabled attacks [1]. It also advises against connecting technology to the internet unless necessary [1]. None of this needs new technology, but it does need a decision and an owner.
In order
A working sequence
Work through these in turn. The cards below set out each action with who should own it.
-
1
Find everything reachable from the internet and remove what need not be. -
2
Patch what remains, external systems first. -
3
Review remote access and valid accounts. -
4
Check backups and rehearse your response. -
5
Work towards Cyber Essentials and your sector's framework.
The judgement calls
Where teams get stuck
Patching everything is not possible
Nobody owns it
Dr Horne asked leaders to make security and resilience a core requirement, not an afterthought [1]. Name a board-level owner.
A check you can do this week
Ask your team for a list of every externally reachable service and who is responsible for it. Gaps in that list are your first finding.
What to do
Six steps, in order
-
Step 1
Patch and reduce what faces the internet[3]
List every externally exposed system, remove what does not need to be reachable, and patch the rest first. If you cannot update everything, the NCSC says to patch the external attack surface, then critical security systems.
Who: IT and security teams
-
Step 2
Tighten accounts and remote access[7]
Public-facing applications, phishing, valid accounts and external remote services were behind 88% of incidents at large organisations. Review who has remote access, remove access granted for convenience, and move towards passkeys.
Who: IT teams and identity owners
-
Step 3
Protect backups and rehearse your response[7]
Check that backups are protected from the accounts an intruder would hold, and run an exercise of your incident response plan so the board and technical staff know their roles.
Who: IT leads and the board
-
Step 4
Use Cyber Essentials as your starting point[5]
The NCSC chief executive called it the starting point, with resilience scaled to size, complexity and risk. Smaller organisations applying for a first certificate can use the announced discount.
Who: Directors and compliance leads
-
Step 5
Replace or re-support legacy technology[3]
Patching cannot fix systems that no longer receive updates. Identify end-of-life or unsupported systems, especially exposed ones, and plan their replacement or return to support.
Who: IT and operations leads
-
Step 6
Set a position on staff use of AI services[7]
Decide which AI services staff may use, what data may go into them, and how that is monitored, so sensitive information is not passed to services you cannot track.
Who: Security leads and HR
Keep reading
Read next
Patch wave
The NCSC expects a surge of software fixes as AI speeds up flaw discovery. Its priorities for exposed systems, legacy kit and update policy.
Read the guide
Legacy systems
End-of-life and underfunded technology is the weakness the NCSC says AI will expose. How to find it, rank it and plan its replacement.
Read the guide
Access routes
The NCSC's incident data shows four initial access routes behind 88% of incidents at large organisations. What each is and how to reduce it.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.