The NCSC says AI-powered cyber attacks are coming for UK firms – but they still need to sharpen up on basic security practices

The National Cyber Security Centre (NCSC) has warned UK infrastructure is likely to fall victim to repeated AI-powered cyber attacks in the next two years, probably from Russia, China, and other hostile nation states.

The agency's latest State of the Cyber Nation report claims the use of AI within critical national infrastructure has left military networks, airports, hospitals, power stations, and businesses with an increased attack surface for adversaries to exploit.

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," said NCSC CEO Richard Horne.

"But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

The NCSC specifically highlighted growing threats posed by ransomware, social engineering, and vulnerability exploitation – all of which are areas the agency can offer support with.

Indeed, the NCSC said organizations across the UK should make better use of the tools, standards, and frameworks that already exist and have been shown to work against both conventional and AI-powered cyber attacks.

Cyber Essentials should be the starting point for cybersecurity, not the end goal, he said, with organizations building greater resilience according to their size, complexity, and risk.

A large part of the problem is that organizations are simply not spending enough, according to Horne.

"For decades, we have collectively got away with doing tech on the cheap," he said.

“We can be a nation where leaders of all organizations actively choose to invest with urgency, and where all organizations make security and resilience a fundamental requirement, not an afterthought. The collective result would be a source of enduring national strength for us all."

State-sponsored threats are rising

State-sponsored actors such as China and Russia, for example, are highly likely to remain the greatest threat, according to the NCSC. China, while its home-grown chips lag behind in quality, has made significant strides in AI capabilities.

Observation also shows Russian cyber actors have been taking advantage of open source AI models, with hackers adapting and retraining them to suit their intelligence requirement needs, rather than developing in-house capabilities from scratch.

"We need every organization in the UK to take action now. Not only to protect their customers, services and livelihoods, but because cyber security is now part of the frontline defence of our nation," said Anne Keast-Butler, director of GCHQ.

"That means modernising technology and building resilience at the pace demanded by a rapidly changing world. It means moving from understanding cyber risk to reducing it. And it means preparing for disruption, ensuring essential services can be maintained, recovery can happen quickly, and organizations can operate with confidence during periods of heightened threat."

NCSC hails increased investment

The government has been doing its bit to help, according to the NCSC. In recent months, Downing Street has announced a series of investments aimed at bolstering cyber resilience across the country.

This includes £60 million to develop the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy.

Elsewhere, a new AI Cyber Security Centre of Excellence in Manchester will help develop world-leading AI security expertise within government.

Trevor Dearing, senior director of critical infrastructure at Illumio, said the NCSC paints a concerning picture of the scale of threats facing UK organizations.

“Recent attacks on water systems, telecoms and even supermarket refrigeration shouldn’t be seen as isolated incidents. Each shows attackers where systems are weak and how operators respond, which a patient adversary could use to plan something far harder to recover from," he commented.

Dearing added that given most attacks still rely on stolen credentials and lateral movement, the NCSC is "right to get organizations to focus on fixing the basics".

"All organizations, not just CNI operators, need to strengthen the human layer against AI-enhanced social engineering, close off unnecessary internet exposure, and invest in detecting and containing lateral movement," he said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.