The UK's National Cyber Security Centre (NCSC) used its annual State of the Cyber Nation report, launched in London on November 3, 2026, to deliver a stark message. NCSC chief executive Richard Horne said the UK faces a real prospect of an unprecedented rise in the number of cyber incidents in the coming months, and the agency said AI-powered malware is highly likely to be part of a ransomware attack on UK critical national infrastructure by 2028, within about two years.
What AI changes, and what it does not
According to coverage of the report, AI is not inventing new ways to attack. It is increasing the scale and efficiency of familiar steps: scouting targets, social engineering, and finding and exploiting weaknesses. The attack still runs through the same stages.
A concrete example comes from Check Point Research's weekly report of November 2, which described a ransomware group using AI agents. Operators supplied compromised credentials and goals, and the tools carried out network reconnaissance, identified privileged accounts, and supported lateral movement. The same report noted growing use of language models by North Korean threat actors for reconnaissance, tool development, and refining social engineering.
Put plainly: tasks that once needed skilled people and time can be done faster and by more attackers.
Why this is a "basics" story
If AI mostly speeds up known tactics, the defenses against those tactics matter more, not less. This week's other incidents show the pattern:
- An attacker simply talked their way to credentials in the Marathon Health breach.
- Ransomware is hitting devices that skipped a fix from 2024, in the Synology NAS case.
- A trusted update path became the delivery route in the cPGuard hijack.
None of these needed AI. AI makes each easier to attempt at scale.
A short action list
For individuals
- Turn on passkeys or other phishing-resistant sign-in for email, banking, and cloud accounts.
- Install updates promptly, including on routers and NAS devices.
- Treat urgent messages, even very polished ones, as suspect. Verify by a separate, known channel.
For small organizations
- Keep offline or immutable backups, and test a restore.
- Limit admin rights, and alert on unusual logins and bulk downloads.
- Practice what to do if systems go down: who decides, who calls whom.
For critical-infrastructure operators
The NCSC urges investment now, so that defenses are in place before AI-enabled attacks become routine. Segmenting networks and keeping manual fallbacks are two places to start. The recent refrigeration attacks show why a plan that works without the network matters.
Sources
- NCSC: cyber chief says UK facing AI-powered attacks on critical infrastructure
- NCSC Chief Warns of AI Ransomware Threat to UK Critical Infrastructure (Infosecurity Magazine)
- UK faces "unprecedented rise" in cyberattacks in coming months (The Record)
- Check Point Research: 2nd November Threat Intelligence Report
Reported as of November 5, 2026. The report describes forecasts, not certainties.