NCSC State of the Cyber Nation 2026: what AI attacks mean for you

Short read

This post covers the NCSC's State of the Cyber Nation report, published today, which warns that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028.

The NCSC's main point is that AI isn't inventing new attacks. It is making old, unfixed weaknesses far quicker to find and exploit. You'll learn what the report says, why it matters even if you don't run critical infrastructure, and the practical steps to take now.

The NCSC State of the Cyber Nation report, published today (3 November 2026), carries one of the starkest warnings the UK's cyber security agency has issued. The National Cyber Security Centre says it is "highly likely" that AI-powered malware will be used in a ransomware attack on Britain's critical national infrastructure by 2028, and that within two years hostile actors' use of AI will increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.

This article explains what the report says, why it isn't really a story about futuristic AI, and what security leads, business owners and MSPs can do about it this week.

What the NCSC State of the Cyber Nation report says

The headline findings, from the NCSC's announcement and Computer Weekly's coverage of the report:

• AI-powered ransomware against UK infrastructure is expected by 2028. The NCSC rates this "highly likely".
• Russia and China are expected to use AI cyber tools routinely to pursue their goals, with China described as the most "sophisticated and sustained" cyber challenge the UK faces.
• The cost is already high. The NCSC estimates malicious cyber activity costs UK organisations around £14.7bn a year.
• The volume is already high. The NCSC received 1,830 reports of cyber attacks in the past year, 80 of them classed as nationally significant.
• The gap is widening. Organisations with mature security, good governance and enough resources will be able to detect threats, prioritise vulnerabilities and automate their defences. Weaker organisations are likely to struggle to keep up with AI-assisted attacks.

It's not new attacks. It's old weaknesses, found faster

The most important line in the report isn't about AI at all. In his speech launching it, NCSC chief executive Dr Richard Horne is expected to say:

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

According to Computer Weekly, the NCSC says most state-backed attacks it has seen so far don't use advanced, autonomous AI. They exploit common, known vulnerabilities that already work. AI simply shortens the time between a weakness existing and someone using it.

You can see that pattern in this week's news without any AI involved. BleepingComputer reports that more than 1,000 internet-facing GitLab servers were still unpatched against a maximum-severity flaw days after CISA confirmed it was being exploited. And, as we covered yesterday, organisations that patched their Ivanti Connect Secure VPNs in October need to upgrade again. Speed is already the deciding factor. The NCSC's warning is that it is about to matter even more.

The three choices the NCSC is asking for

Dr Horne is urging every organisation to "take the responsibility now to make different choices". The NCSC names three:

1. Invest properly in your technology. The NCSC says too many organisations have under-invested in the systems they rely on, and that security and resilience must be a fundamental requirement, not an afterthought.
2. Don't connect technology to the internet unless it needs to be. Every exposed management interface, VPN, file server or remote-access tool is something an AI-assisted attacker can find and test.
3. Treat Cyber Essentials as the starting point, not the end goal. Organisations are expected to build further resilience according to their size, complexity and risk.

Get ready for the "patch wave"

The report builds on advice the NCSC published in May on preparing for a "vulnerability patch wave": a rush of software updates as vendors use AI to find and fix long-standing bugs. The NCSC's chief technology officer, Ollie Whitehouse, recommended that organisations:

• Find and shrink their internet-facing attack surface first, starting at the perimeter and working inwards to cloud and on-premises systems.
• Prioritise external systems when you can't patch everything, then critical security systems.
• Turn on automatic updates and "hot patching" wherever they're available, including on embedded devices.
• Use a risk-based method such as Stakeholder Specific Vulnerability Categorisation (SSVC) where updates must be scheduled.
• Speed up for any critical vulnerability that is being actively exploited, especially on an internet-facing system.
• Replace or bring back into support end-of-life technology that can no longer be patched.

The NCSC sums this up as "update by default": apply security updates as soon as possible, ideally automatically.

Why this matters if you don't run critical infrastructure

The 2028 prediction is about critical national infrastructure, but the advice isn't. The weaknesses AI makes easier to exploit (unpatched software, exposed services, weak passwords, missing multi-factor authentication) are just as common in a 50-person firm or an MSP's customer base as in a utility. Smaller organisations are often part of the supply chain that larger ones depend on, which makes them a route in.

The government is investing too. Last week the Chancellor announced £60 million for the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre, and an AI Cyber Security Centre of Excellence in Manchester, alongside the Cyber Security and Resilience Bill. None of that replaces the work each organisation has to do on its own systems.

What to do this week

• List everything you expose to the internet, with versions, and switch off what doesn't need to be there.
• Check your patching speed for actively exploited flaws on internet-facing systems. Measure it in days, not months.
• Switch on automatic updates where it's safe to do so.
• Close the basic gaps: multi-factor authentication on every remote and admin login, and no unsupported systems on the perimeter.
• Make sure someone is watching. When exploitation moves faster, the time between an attacker getting in and someone noticing matters more than ever.
• Use Cyber Essentials as your floor, then build from there.

Sources: NCSC announcement, Computer Weekly, NCSC: Preparing for a vulnerability patch wave, BleepingComputer.