Key takeaways
- The NCSC’s State of the Cyber Nation report, published on 3 November 2026, expects AI-powered malware to be used in a ransomware attack on UK critical infrastructure by 2028.
- The NCSC says AI is not creating new attacks but exposing old, unfixed weaknesses faster, and it addresses the warning to small and medium-sized organisations too.
- There is no new deadline, but reviewing what is connected to the internet, how quickly updates are applied and whether you meet Cyber Essentials are sensible first steps.
What the NCSC report says
On 3 November 2026 the National Cyber Security Centre, part of GCHQ, published its State of the Cyber Nation report (NCSC). It judges it highly likely that, over the next two years, hostile groups using AI will run ransomware, social engineering and attacks on software flaws at greater scale and efficiency. It also expects AI-powered malware to be used in a ransomware attack on the UK’s critical national infrastructure by 2028.
The NCSC’s chief executive, Dr Richard Horne, launched the report with a speech. His argument, as the NCSC sets it out, is that AI is not inventing new kinds of attack. It lets attackers find and exploit weaknesses that organisations have tolerated for years, far faster than before. “For decades, we have collectively got away with doing tech on the cheap,” he was expected to say.
The NCSC also points to government measures: the Cyber Security and Resilience Bill, a forthcoming National Cyber Action Plan, and funding the Chancellor announced the previous week, including £60 million for the first phase of a national Cyber Shield and £70 million for a new centre to identify vulnerabilities across critical infrastructure and the economy.
Which businesses this concerns
The headline warning is about critical infrastructure, but the NCSC addresses the report to small and medium-sized organisations as well as large ones and the public sector. If your business runs older software, systems that have fallen behind on updates, or tools that sit on the internet without needing to, those are exactly the weaknesses the report says AI will make quicker to find.
The report itself does not create a new legal duty or a deadline. The source does not say which businesses the Cyber Security and Resilience Bill will cover, so do not draw conclusions either way from this announcement.
What to check with your developers
Nothing has to be done by a set date, but the NCSC’s advice is specific enough to act on now:
- List the systems, admin panels and servers your business has connected to the internet, and ask whether each one needs to be.
- Ask who applies security updates to your website, online store and software, and how quickly they do it.
- Identify any software that no longer receives updates, and plan to replace or isolate it.
- If you hold Cyber Essentials, treat it as a starting point; the NCSC says organisations should build further according to their size, complexity and risk. If you do not hold it, start there.
- Budget for security and maintenance as a fixed cost rather than an optional extra.
The NCSC’s May 2026 guidance on preparing for a wave of security patches is worth reading alongside the report.
If you need someone to keep your software updated and monitored after launch, Cognivise offers ongoing support and ownership.
Source
Written by Cognivise from the source above with the help of AI, and checked against that source before it was published.