Fewer serious attacks in the UK, but its cyber agency fears an AI-driven wave

Eighty. That is the number of "nationally significant" incidents handled by the NCSC, the UK's national cybersecurity agency, between September 1, 2025 and August 31, 2026. The previous year, it counted 204. On paper, the trend is reassuring. Yet when presenting its annual review on November 3, the agency's chief executive, Richard Horne, struck a very different tone.

According to The Record, he raised the "real prospect of an unprecedented rise in the number of cyber incidents" in the coming months. The cause: artificial intelligence. It does not invent new attacks, but it makes it possible to find and exploit, at scale, weaknesses that have been tolerated for too long.

Why the number of serious incidents fell

The NCSC gives its figures. Its incident response team received 1,831 reports of attacks. After triage, 337 incidents required its help, 80 of which were judged nationally significant. The agency also says it warned 8,500 organizations of signs suggesting a possible compromise, thanks to its early warning service.

It stops short of claiming victory. Reports "do not follow a simple year-on-year trend," it writes, and past peaks were often down to a few particularly severe incidents. In its view, these early alerts probably kept some incidents from getting worse.

AI does not create the flaws, it exposes them

In his foreword, Richard Horne acknowledges that the threat has grown faster than the country's defenses. His key sentence: AI "did not create these cybersecurity weaknesses, it exposed them." He points to accumulated technical debt and investments that have too often been put off.

According to The Record, he was more blunt when speaking: "For decades, we have all got away with doing IT on the cheap." He is targeting end-of-life systems kept running to save money and postponed upgrades. Also according to The Record, the NCSC considers it "highly likely" that AI-driven malware will be used in a ransomware attack on UK critical infrastructure by 2028. It also expects China and Russia to use AI "routinely" in their operations by then.

The government is betting on the same technology to defend itself. The Record cites a £70 million center tasked with using AI to hunt for flaws in critical infrastructure, and a network of defensive AI agents, funded with £60 million for a first phase.

The year's seven lessons, and what they mean for businesses

The diagnosis echoes that of ANSSI (France's national cybersecurity agency), which recently noted that most data thefts require no technical flaw at all. The NCSC draws seven lessons from the year. The first: attackers exploit the basics. Internet-facing equipment remains "a primary route of compromise." The last: even sophisticated actors do not need sophisticated means to get in, and their expertise only shows afterward.

In practical terms, the review calls on organizations to:

• fix known vulnerabilities and secure systems exposed to the Internet;
• keep and monitor logs, and maintain an up-to-date incident response plan;
• check the resilience of their suppliers.

One unknown remains: will the influx of AI-discovered flaws really translate into more successful attacks? According to The Record, UK officials are seeing a sharp rise in discoveries, but not yet a matching rise in exploitation. The next annual review will show whether the curve of 80 incidents has reversed.