UK organizations are being urged to address existing security weaknesses before attackers can exploit them more efficiently with artificial intelligence. The National Cyber Security Centre’s November 3 assessment projects increasing use of AI in ransomware, social engineering and vulnerability exploitation over the next two years.

The agency considers AI-enabled malware in a ransomware attack against critical national infrastructure highly likely by 2028. That is a forward-looking risk assessment, not confirmation that such an attack occurred today. Automation can increase hostile activity’s reach.

The NCSC also identifies AI as an opportunity for defence. Its announcement references investment announced the previous week, including £60 million for an initial national Cyber Shield phase and £70 million for a centre addressing exposure and real-time vulnerabilities. That funding predates November 3.

For organizations, the agency emphasizes foundational security investment, limiting unnecessary internet connections and building resilience beyond a basic certification. The report links the AI challenge to accumulated weaknesses in existing technology, rather than suggesting every risk requires an entirely new defensive method.