NCSC CEO Richard Horne has issued a stark warning about Britain’s escalating cyber vulnerabilities, cautioning that artificial intelligence (AI) could trigger an unprecedented surge in cyber incidents. Speaking at The NCSC’s Annual Review Launch 2026, which marked the centre’s tenth anniversary, Horne highlighted a “sliding doors” moment, where immediate decisions will shape future security, prosperity, and public trust for generations.
AI’s Role in Escalating Cyber Threats
Horne emphasized that AI’s immediate risk lies in its capacity to rapidly discover and exploit long-tolerated weaknesses in digital foundations. He likened these foundations to the Leaning Tower of Pisa, arguing that years of “tech on the cheap” and delayed investment have left organisations exposed. AI, in hostile hands, “it can become a force multiplier,” he stated, making existing vulnerabilities easier to exploit at previously unimaginable speed and scale. He noted that the NCSC issued over 110,000 proactive notifications and early warning alerts in response to a PHP vulnerability, illustrating the scale of potential exposure.
Critical Infrastructure at Risk
The exposure extends beyond traditional IT to vital physical systems like electricity switching, water facilities, dam operations, manufacturing lines, heating, and refrigeration. Horne cited disrupted refrigeration units across Europe as an example of cyberattacks reaching physical infrastructure. He detailed Russian campaigns against military networks below the threshold of armed conflict, Iranian operations targeting the UK, and criminal ransomware involving threats to publish stolen data. Horne assessed China as highly likely to intend to use AI against critical infrastructure and other strategic targets, and as best positioned to do so.
Leveraging AI for Defence
Despite the threats, AI also presents defensive opportunities. Horne noted its potential to accelerate the identification and patching of vulnerabilities, citing more than 1,000 vulnerabilities patched by the Linux kernel project in the previous month. He discussed backing for the National Cyber Shield and a planned national exposure and real-time vulnerability centre intended to identify weaknesses across critical infrastructure and the economy. This work is alongside efforts with the AI Security Institute on secure AI development and deployment, the AI Threat Assessment Centre, the National Protective Security Authority, and the Government Cyber Unit, aiming to make AI serve security, prosperity, and the public good.
A Call for Systemic Resilience
Horne stressed that technology alone is insufficient for resilience. He argued for supporting governance, accountability, and legislation, including a proposed Cyber Security and Resilience Bill that would establish a minimum resilience level for critical national infrastructure, and a forthcoming National Cyber Action Plan. His closing appeal was practical: replace end-of-life systems, protect critical physical controls, make passkeys normal, and treat security as a fundamental requirement. He urged business leaders, technology providers, and AI developers to act, asking what future generations might say: “where were you when AI changed everything”.
What is the NCSC’s main warning about AI?
NCSC CEO Richard Horne warns that AI can accelerate attacks against existing weaknesses in digital systems, leading to an unprecedented rise in cyber incidents.
What are the key areas of vulnerability highlighted?
Vulnerabilities extend beyond conventional IT to critical physical systems like electricity, water, and manufacturing, which rely on digital controls. Years of underinvestment and “tech on the cheap” have left these systems exposed.
What measures are proposed to enhance Britain’s cyber security?
Proposed measures include investment throughout a system’s lifecycle, a proposed Cyber Security and Resilience Bill to set minimum resilience levels for critical national infrastructure, and a forthcoming National Cyber Action Plan. Practical steps like replacing end-of-life systems and using passkeys are also encouraged.
