Your questions answered

On 3 November 2026 the NCSC said AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure between now and 2028[9]. Its chief executive said the UK will likely face AI-enabled attacks on critical infrastructure by 2028[6].

The NCSC's warning is a forecast, not confirmation that such an incident has happened[7]. Responders have seen attackers use AI tools, but none of the observed uses enabled a new class of attack[7].

The strongest warning concerns critical infrastructure, but the advice is for all organisations, scaled to size, complexity and risk[9]. The four access routes behind 88% of incidents at large organisations are common to many sectors[7].

None of the sources we read announces a new legal duty or deadline[1]. The NCSC's guidance asks for action now, with board-level engagement[5].

It is the NCSC's term for a surge of software fixes expected as AI speeds up the discovery of flaws[4]. It advises shrinking your external attack surface first and patching external systems before critical security systems[4].

Public-facing applications, phishing, valid accounts and external remote services[7]. They accounted for 88% of incidents across the large organisations in the NCSC's data[7].

Infosecurity Magazine reported £80 to £125 plus VAT after the 75% discount for micro, small and medium-sized businesses applying for a first certificate[8]. Confirm current terms with the certification body before applying.

The NCSC advises understanding why staff use unapproved tools, rather than only banning them[5]. Unapproved services can expose sensitive information and leave you unable to track how data is handled[7].

The NCSC believes AI will ultimately be a net positive for cyber security and advises adopting it carefully[5]. Automated defensive actions need clear limits and human oversight[7].

List what faces the internet and decide what needs to be there[4]. Then make sure you can patch it quickly, starting with external systems[4].