Scope
Who the NCSC's AI warning applies to
The strongest language is aimed at critical national infrastructure, but the advice is written for every organisation, scaled to size, complexity and risk.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
Three groups
Where you sit
The NCSC's forecast names critical national infrastructure, but its guidance reaches much further.
Critical national infrastructure
This is the sector the ransomware forecast is about. The assessment says AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure before 2028 [9]. It also judges it likely that attackers will go after known vulnerabilities in older systems in this sector and at new attack surfaces created by AI deployment [2].
Organisations with a typical attack surface
At large organisations, four routes accounted for 88% of incidents: public-facing applications, phishing, valid accounts and external remote services [7]. If you run any of those, the warning applies to you whatever your sector.
How to tell
Questions to ask yourself
If you cannot tell whether you are in scope, the NCSC's own diagnosis of common failings is a useful test. Reporting of Dr Horne's speech listed running end-of-life systems for another year, granting access for convenience rather than need, and buying services on price alone without checking resilience [8].
Check these as well:
- Do you run internet-facing systems that nobody has reviewed recently?
- Do you have unsupported software or devices that are reachable from outside?
- Do staff use AI services that your security team has not approved?
- Do your suppliers patch quickly, and would you know if they did not?
Read next
Your next step
For the order of work, see what to do. For the data behind that figure, see the four routes attackers use.
Who it applies to
The organisations the rules cover
Operators of UK critical national infrastructure[9]
The NCSC judges it highly likely that AI-powered malware will feature in a ransomware attack on this sector between now and 2028.
Organisations running legacy or unsupported technology[2]
The NCSC expects attackers to target known vulnerabilities in legacy critical infrastructure and says patching alone may not fix end-of-life systems.
Organisations with exposed software, weak accounts or open remote access[7]
At large organisations, public-facing applications, phishing, valid accounts and external remote services accounted for 88% of incidents.
Businesses whose staff use unapproved AI services[7]
The review warns that sensitive company information can be exposed and the employer cannot track how it is handled.
Software suppliers and their customers[4]
The NCSC asks organisations to be able to deploy fixes quickly, frequently and across their supply chain.
Micro, small and medium-sized businesses[9]
Eligible for a 75% discount on a first Cyber Essentials certificate, the NCSC's suggested starting point.
Keep reading
Read next
Key dates
The dates that matter in the NCSC's AI warning, from the May patch wave advice to the 3 November review and the 2028 horizon.
Read the guide
What to do
A practical order of work for UK organisations preparing for AI-assisted ransomware, based on the NCSC's advice. Start with what you expose.
Read the guide
AI ransomware
What the NCSC says about AI-powered malware in ransomware attacks on UK critical infrastructure, what is a forecast and what has been observed.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.