NCSC chief warns of 'unprecedented rise' in UK cyber incidents

Britain faces the "real prospect of an unprecedented rise in the number of cyber incidents" in the coming months, the head of the National Cyber Security Centre will warn on Tuesday, launching the agency's annual report.

Richard Horne's argument is narrower than the headline. The risk, he says, is "not because AI has invented new ways to attack us," but because vulnerabilities "tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

The evidence the NCSC offers is on the finding side, not the exploitation side. Officials point to vendors fixing hundreds of vulnerabilities in a single update and the Linux kernel project patching more than a thousand last month. The report itself concedes that experts haven't yet seen a matching rise in exploitation. The warning follows a June Five Eyes alert saying AI would change offensive and defensive capability on a timeline of months, not years.

The report also says it's "highly likely" AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028, and that China and Russia will "routinely" use AI in cyber operations by then.

On defence, the government has been testing frontier AI against its own networks. Project DROMOS began as a four-week pilot and was expanded into live government environments, where it found "hundreds of potential security issues, including critical vulnerabilities." A new £70 million NERV Centre is meant to extend that to critical infrastructure, with £60 million for the first phase of Cyber Shield, a national network of AI agents.

For defenders, the practical point is the one the report keeps returning to: state-linked intrusions often ran through internet-facing applications and flaws "for which patches are available but have not been deployed in a sufficiently timely fashion." Patch latency is the thing to measure.

We'd treat the exploitation gap with some suspicion in both directions. Vendor fix counts are a proxy for attention, not for attacks, and the report doesn't give incident figures to back the forecast.