What did the NCSC actually say?
The NCSC’s Annual Review 2026 uses calibrated probability language. “Highly likely” sits near the top of their scale, one step below “almost certain.” The judgment is specific: AI-powered malware in a ransomware attack on UK critical national infrastructure within two years.
The numbers behind it are worth reading. Between September 2025 and August 2026, the NCSC handled 1,831 reports of cyber attacks. Three hundred and thirty-seven required their incident management team. Eighty were nationally significant. That’s more than one nationally significant incident a week.
Richard Horne, the NCSC’s CEO, was direct at the review’s launch: “For decades, we have collectively got away with doing tech on the cheap.” The vulnerabilities this created, he said, have been “tolerated for far too long.” His warning landed with a practical image: “when food isn’t on shelves, lights aren’t on, businesses have gone under.”
The NCSC’s foreword puts the AI angle in perspective: “Artificial intelligence did not create those weaknesses. It has revealed them.”
The judgment is about the UK. The dynamics it describes are not. The NCSC assesses it is “almost certain AI will act as a force multiplier across the cyber threat landscape.” Any team running servers that support essential services should read this as their timeline too.
Does AI change the threat or just the speed?
The NCSC is clear on this point: AI is “unlikely to fundamentally change the goals of hostile actors.” What changes is the pace and the scale.
A University of Edinburgh study, published in May 2026, reinforces this. Researchers analyzed more than 100 million posts from underground cybercrime forums and found that AI coding assistants “are mostly proving useful for already skilled actors” rather than lowering the barrier for newcomers. Their conclusion: what the security community is watching is “an evolution rather than a revolution in criminal practices.”
In May 2026, Google’s Threat Intelligence Group published its assessment of a zero-day exploit it believes was developed with AI assistance. GTIG reported “high confidence that the actor leveraged an AI model to support the discovery and weaponization” of a vulnerability in an open-source system administration tool. The evidence included educational-style docstrings and a hallucinated CVSS score in the exploit code.
It’s a milestone. But the NCSC’s broader read is the one to hold: “Human operators highly likely remain essential for directing, validating and adapting AI-generated outputs.” The skills still matter. AI makes skilled crews faster. It hasn’t replaced them.
For a deeper look at how AI changes the ransomware equation, our earlier post covers what AI changes about ransomware prevention.
Why does the patch race matter more now?
The NCSC judges that AI-assisted vulnerability discovery and exploit development will “highly likely pose a significant threat.” Defenders, the review warns, “will face a race to shorten patch deployment timelines.”
The race is already tightening. The Zero Day Clock, maintained by Sysdig, tracks when vulnerabilities are first exploited relative to their public disclosure. In the first half of 2026, 141 of 491 newly exploited vulnerabilities were already under attack when they went public. That’s 29 percent of the exploited set with no patch window at all.
For teams running critical applications, the math is plain. Faster discovery means shorter windows. Shorter windows mean that controls which work before a vendor patch lands carry more weight each quarter. Patching alone isn’t enough when nearly a third of the problem arrives pre-patched.
For guidance on compensating controls where a server can’t take a normal patch cycle, see how to protect servers you can’t patch.
What should a CNI team do in the next 24 months?
The NCSC’s review points teams back to fundamentals: “Most successful attacks continue to exploit familiar weaknesses.” Here’s a plan that starts this quarter and finishes before the 2028 window closes.
This quarter: baseline and harden. Map the servers that run your critical applications. Know what’s supposed to run on each one and what isn’t. Harden configurations against the NCSC’s published guidance. Start with the systems where downtime isn’t an option: historians, SCADA and HMI servers, domain controllers and the jump servers that administer them.
Next quarter: close the patch gap. Build a process that gets critical patches deployed faster than your current cycle allows. Where a vendor patch doesn’t exist yet or can’t be applied, put a compensating control in place. Virtual Patching, as part of a known-good enforcement approach, closes the exposure that AI-accelerated vulnerability discovery opens before a vendor patch exists. Mimic Networks provides this for Windows and Linux servers, including servers past end of support.
Months 7 through 12: enforce and verify. Move from monitoring to enforcement on your most critical servers. Verify that unauthorized changes to files, processes and services are blocked, not just logged. A protected server with no connection to the management plane stays in enforcement, with updates and changes to its profile going in from physical media.
Year two: extend and exercise. Widen enforcement across the management and supervisory layer. Run tabletop exercises that assume AI-assisted reconnaissance and faster exploitation timelines. Test your response pipeline against a 24-hour discovery-to-protection window.
The Cyber Security and Resilience Bill, currently at Report Stage in the House of Commons, will set minimum resilience standards for critical national infrastructure. These steps put your team ahead of it.
— — —
The NCSC gave teams a two-year window. How you use it matters more than the warning itself. The Known-Good Enforcement Guide, by Mimic Networks, is a practical place to start. If you want to talk through what enforcement looks like on your infrastructure, the Mimic Networks team is here.
Frequently asked questions
How likely is an AI-powered ransomware attack on UK critical infrastructure by 2028?
+The NCSC’s 2026 Annual Review judges it “highly likely.” In their probability framework, that term reflects a high level of analytical confidence. The assessment covers AI-powered malware used in a ransomware attack on UK critical national infrastructure within a two-year window. The NCSC handled 80 nationally significant cyber incidents in the twelve months through August 2026, and the review describes threats that are growing in both scale and sophistication.
What does the NCSC mean by “highly likely”?
+The NCSC uses calibrated probability language borrowed from the intelligence community. “Highly likely” sits one step below “almost certain” and well above “realistic possibility.” When the NCSC applies this term, it carries the same weight as a formal intelligence assessment. The NCSC separately assessed it is “almost certain AI will act as a force multiplier across the cyber threat landscape,” placing the broader AI threat even higher on their scale.
Can critical infrastructure teams defend against AI-powered ransomware without buying new tools?
+For most of the problem, yes. The NCSC’s review says the most successful attacks still exploit familiar weaknesses: unpatched or known vulnerabilities, poorly secured systems and internet-facing assets. Baselining critical servers, accelerating patch deployment, enforcing configuration standards and rehearsing incident response require discipline, not new purchases. Controls that shorten the gap between disclosure and protection strengthen the position further.
How does known-good enforcement protect servers running critical applications?
+Known-good enforcement compares every change on a protected server against an established baseline and blocks anything that falls outside it. A file, process or service change that wasn’t authorized doesn’t execute. On servers in the management and supervisory layer, this adds a control that works independently of whether endpoint detection identifies the threat or whether a vendor patch exists for the vulnerability being exploited.
