Ransomware

The UK's National Cyber Security Centre (NCSC) published its tenth annual review on November 3, 2026, under the title State of the Cyber Nation. Its headline judgement is that AI-powered malware is "highly likely" to feature in a ransomware attack on UK critical national infrastructure (CNI) by 2028. That is a forecast. The report does not say such an attack has happened yet, and "highly likely" is the language UK intelligence uses for an assessment, not a confirmed event.

If you run IT for an energy, water, transport, health or manufacturing operator, or for one of their suppliers, this is aimed at you. The review's other findings matter just as much to everyone else: across the 337 incidents the NCSC handled, most successful compromises started with known flaws in internet-facing systems, stolen credentials and social engineering. NCSC chief executive Richard Horne said AI has not invented new ways in, but that vulnerabilities "tolerated for far too long" can now be found and exploited at scale.

What the numbers say

The review covers September 1, 2025 to August 31, 2026. In that year the NCSC received 1,831 reports of cyber attacks, up from 1,727 the year before. After triage, 337 needed support from its Incident Management team, down from 429, and 80 of those were classed as nationally significant, down from 204. Its Early Warning service, which tells subscribers when NCSC feeds see signs of compromise on their networks, alerted about 8,500 organisations.

The NCSC itself warns against reading the fall from 204 to 80 as a trend. It says incident numbers rarely move in a straight line and that past peaks were often driven by a small number of severe events. The 80 are also only the incidents the NCSC handled, not every serious attack in the UK. Horne used the launch to warn of "an unprecedented rise in the number of cyber incidents" in the months ahead, which is a second forecast to weigh against the lower count.

The government puts the cost of malicious cyber activity to UK organisations at about £14.7 billion a year.

How AI changes the attack, according to the NCSC

The review's AI judgements are more measured than the headline. The NCSC assesses that within two years, attacker use of AI is highly likely to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. It expects AI to speed up existing techniques rather than create new categories of attack, and it judges that human operators will still direct and check AI-assisted operations.

In practice that means three things get faster. Reconnaissance: finding which of your systems are exposed and what they run. Vulnerability discovery and exploit development: turning a new advisory, or a flaw nobody has reported yet, into working attack code. And phishing: writing convincing, tailored lures at volume. None of these needs a novel technique. They shrink the time between a weakness existing and someone using it.

The NCSC CTO, Ollie Whitehouse, set out the defender's side of this in May 2026, when he told organisations to prepare for a "vulnerability patch wave": a surge of updates as AI tools find previously unknown flaws across open source, commercial and SaaS software. His advice was to secure internet-facing perimeter systems first, then cloud and on-premises systems, and to accept that patching alone cannot protect legacy or end-of-life products.

Who the report names

The review calls China the most sophisticated and sustained cyber challenge to the UK and judges it highly likely to have both the intent and the best position to use AI against critical infrastructure. It also judges that China, Russia and other states will highly likely be using AI routinely in operations against the UK by 2028.

As evidence that CNI attacks are already real without AI, Horne pointed to the December 2025 attack on Poland's energy grid, which the UK and EU attributed to Russia's FSB. Had it succeeded, around 500,000 people could have lost power in winter.

The review also flags "shadow AI": staff copying company data into unapproved AI tools, often from personal devices, so the organisation loses track of where that data goes.

What to do

The NCSC's list of what worked and what failed reads like a checklist, and none of it needs new products. Many of the state-linked intrusions it handled used flaws for which patches already existed but had not been applied in time.

1. Inventory everything that faces the internet. VPN gateways, firewalls, remote desktop gateways, file transfer servers, web apps and any remote access to operational technology (OT, the systems that run physical processes). The NCSC's own advice is to take systems off the internet where they do not need to be there. Run an external scan of your own address ranges and compare it with what you think you expose.
2. Patch the edge on a clock. Cyber Essentials already requires fixes rated critical or high, or with a CVSS v3 score of 7 or above, to be applied within 14 days of release. For internet-facing devices with a known exploit, aim for a few days. If a product is end of life, plan its replacement now, because the patch wave will not reach it.
3. Move remote and admin logins to passkeys. The review names passkeys as the way to cut the risk from stolen credentials. Start with VPN, cloud admin portals and email, then remove legacy authentication paths that bypass multi-factor authentication.
4. Segment IT from OT. Ransomware that reaches the office network should not be able to reach the control network. Put a monitored boundary between them, allow only the specific flows that operations need, and keep engineering workstations off email and general browsing.
5. Make backups survive an admin compromise. Keep at least one immutable or offline copy on separate credentials, and include OT configurations, controller logic and historian data alongside file servers. Time a full restore so you know your real recovery window.
6. Sign up for Early Warning and check your logs. The service is free for UK organisations. Keep VPN, firewall and identity provider logs for long enough to investigate an alert, and alert on new admin accounts, MFA changes and logins from unfamiliar locations.

For shadow AI, publish a list of approved AI tools and block uploads to the rest at the web proxy, so staff have a sanctioned option instead of a personal one.

What else was announced

The government is funding £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC to find vulnerabilities across critical infrastructure. The NCSC will also run a new AI Cyber Security Centre of Excellence in Manchester. The Cyber Security and Resilience Bill, which widens the rules for CNI operators and their managed service providers, is still before Parliament.

If you want to know what an attacker sees from the internet before an AI tool tells them, our attack surface management service maps and tracks it, and our security operations team watches the logins and admin changes that come next. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: NCSC news release, NCSC Annual Review 2026, incident management, NCSC Annual Review 2026, seven things learned, NCSC Annual Review 2025, incident management, SecurityWeek, Cybersecurity News, Intelligent CISO, Insurance Business, Resultsense, SC Media on the patch wave.