News

AI Will Make Old Security Weaknesses More Expensive to Ignore, UK Cyber Agency Warns

• By John K. Waters
• 11/04/2026

Britain’s National Cyber Security Centre warned November 3 that AI is likely to increase the scale and speed of cyberattacks, putting greater pressure on organizations to address security weaknesses they have allowed to persist.

The agency, part of GCHQ, assessed in its Artificial Intelligence and Cyber Intrusion report that AI-powered malware is highly likely to be used in a ransomware attack against UK critical national infrastructure between now and 2028.

For enterprise leaders, the warning concerns a change in the economics of exploitation. If attackers can find and use weaknesses more efficiently, an unresolved vulnerability can become more consequential without the underlying flaw changing.

A Maintenance Problem at Greater Speed
In his annual-review launch speech, NCSC chief executive Richard Horne criticized organizations for postponing upgrades and keeping end-of-life systems running. He also pointed to excessive access permissions and inadequate monitoring.

“For decades we have collectively got away with tech on the cheap,” Horne said.

His argument places responsibility on management decisions as well as security tooling. Maintaining systems throughout their lifecycle and funding resilience are organizational choices, rather than tasks a newly purchased AI product can automatically resolve.

Horne also connected the warning to technology controlling physical processes, including electricity switching and water facilities. Disruption in those environments can affect essential services, extending the consequences beyond unavailable business applications.

Separating Judgments from Scenarios
The NCSC assessment anticipates routine use of AI-enabled cyber capabilities by states including Russia and China by 2028. It also judges that many systems will remain vulnerable to tools that can identify and exploit weaknesses.

The report explores baseline, pessimistic, and optimistic scenarios. It explicitly describes these as plausible possibilities intended to inform preparation, rather than predictions. Its more severe hypothetical developments should therefore not be presented as attacks the agency has already observed.

That distinction is important when translating the report into a business response. Organizations do not need to assume that every worst-case scenario will occur to examine whether their existing controls can withstand faster attack activity.

The agency’s announcement also identifies AI as an opportunity for improving defense. It calls for organizations to use established security practices while investing in their ability to respond to changing threats.

Recovery Remains Part of the Defense
The NCSC’s existing ransomware guidance recommends layered defenses and preparation for the possibility that malware will get through. It emphasizes identifying critical assets and exercising incident-management plans.

The guidance also calls for regular backups and testing that restoration works. Recovery planning needs to account for situations in which ordinary systems, including online backup infrastructure, are unavailable.

Those requirements matter independently of whether an attacker uses AI. Faster exploitation increases the urgency of preparation; it does not replace the need to know which business services must be restored first and what they depend on.

For organizations adopting AI internally, the same reasoning applies to systems agents can access. Adding automation to a poorly maintained environment does not remove the weaknesses underneath it.

The NCSC’s warning is a reason to reassess how quickly known problems are resolved and how convincingly recovery has been tested. The central business question is whether the organization can keep operating when prevention fails.