What to do
How to prepare for AI-assisted attacks
Start with what faces the internet, then speed up patching, then protect access and recovery. The NCSC's message is that fundamentals remain the best defence.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
The principle
Fundamentals first
The NCSC's frontier AI guidance says good cyber security fundamentals remain the best protection, whether or not an attack is AI-assisted, and asks for board-level engagement now [5]. The cards below give the order; each links to a page with more detail.
In order
A sensible sequence
Work through these in sequence, stopping at the point where your organisation has a gap.
-
1
List what is exposed to the internet and remove what does not need to be there, as set out in preparing for a patch wave [4]. -
2
Make sure you can deploy fixes quickly and often, including from suppliers [4]. -
3
Review accounts and remote access using the four routes attackers use [7]. -
4
Check backups and rehearse your response to ransomware [7]. -
5
Plan the replacement of anything out of support, see end-of-life systems [4].
Often missed
Two things people skip
Prose in a plan is easy to agree with and hard to act on, so two items are worth naming.
First, AI tools themselves. The NCSC asks organisations to understand how agentic AI tools are used and what access they hold, and to use safeguards, sandboxing and active oversight [5]. Our page on unapproved AI use covers it.
Second, the baseline. Dr Horne called Cyber Essentials the starting point [9], and Cyber Essentials and AI-assisted attacks explains where it helps and where you will need more.
Do not rely on insurance alone
Reporting of the NCSC's advice says organisations should not rely on insurance to cover the consequences of an attack on essential services [8].
What to do
Eight steps, in order
-
Step 1
Shrink what faces the internet[4]
List every internet-facing system and decide whether each needs to be exposed. Start with perimeter technology, then cloud and on-premises systems.
Who: IT and security teams
-
Step 2
Prepare for a patch wave[4]
Be able to deploy fixes quickly and often, including from suppliers. Patch external systems first, then critical security systems, and turn on automatic updates where you can.
Who: IT operations
-
Step 3
Tighten accounts and remote access[7]
Valid accounts and external remote services are two of the four routes behind 88% of incidents. Limit administrator access to what is needed and look at passkeys, which the review supports.
Who: Identity and infrastructure teams
-
Step 4
Protect backups and rehearse your response[7]
Keep backups protected from the accounts an attacker would use, and rehearse incident response so the first run is not a real incident.
Who: IT leads and incident owners
-
Step 5
Replace or re-support end-of-life systems[4]
Plan and budget to replace unsupported technology, or bring it back into support, starting with anything reachable from outside.
Who: Technology owners and finance
-
Step 6
Know which AI tools your staff and systems use[5]
Find out what agentic and other AI tools are in use and what access they hold, and find out why staff turn to unapproved ones.
Who: Security and data protection leads
-
Step 7
Make Cyber Essentials your baseline[9]
The NCSC chief called Cyber Essentials the starting point, to be built on in line with your size, complexity and risk. Smaller businesses can get 75% off a first certificate.
Who: Directors and compliance leads
-
Step 8
Put it on the board agenda[5]
The NCSC's frontier AI guidance asks for board-level engagement now. Ask for a plain report on exposure, patching speed and recovery.
Who: Boards and executives
Keep reading
Read next
AI ransomware
What the NCSC says about AI-powered malware in ransomware attacks on UK critical infrastructure, what is a forecast and what has been observed.
Read the guide
The assessment
The NCSC's four key judgements and three scenarios for AI and cyber intrusion to 2028, summarised for UK security and risk leads.
Read the guide
Patch wave
The NCSC expects AI to uncover a wave of software flaws and fixes. Its advice on patch priorities, exposure and automatic updates, explained.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.