The way in
The four routes attackers use, and how AI sharpens them
At large organisations, four initial access routes accounted for most of the incidents in the NCSC's data. None of them is new, and all of them are things you can check this week.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
The routes
Four ways in
Public-facing applications
Anything reachable from the internet is a candidate. AI-assisted flaw discovery adds to the pressure on these systems, which is why the NCSC puts external exposure first in its patch wave advice [4].
Phishing
AI helps attackers write convincing social engineering messages [7]. Believable wording is cheaper to produce, so training that relies on spotting poor spelling is weaker than it was.
Valid accounts
External remote services
Remote access that is poorly protected is one of the four routes [7]. Review who can reach it, from where and with what.
Checks
What to look at this week
These checks map directly to the four routes:
- A current list of internet-facing applications and who owns each.
- Multi-factor authentication or passkeys on every remote access service and administrator account.
- Accounts that have not been used recently and access that was granted for convenience.
- How staff report a suspicious message, and how quickly someone acts on a report.
Aside
A limit on the claim
The 88% figure applies to large organisations covered by the NCSC's incident data [7]. Smaller organisations may see a different mix, so use it as a guide to priorities, not a promise. Continue with what to do.
Keep reading
Read next
Shadow AI
Unapproved AI services can expose company data, and agentic AI adds access risk. What the NCSC says organisations should do about both.
Read the guide
Cyber Essentials
The NCSC chief calls Cyber Essentials the starting point against AI-assisted attacks. What that means and the 75% first-certificate discount.
Read the guide
Funding
Cyber Shield, the NERV Centre, a National Agentic Security Unit and an AI Cyber Security Centre: what was announced alongside the NCSC warning.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.