GCHQ's cyber chief: 'we have got away with doing tech on the cheap', and AI will now exploit it at scale by 2028
What's new? The UK's National Cyber Security Centre (NCSC), part of GCHQ, published its annual State of the Cyber Nation review on 3 November 2026. Its central judgement: it is "highly likely" that AI-powered malware will be used in a ransomware attack on British critical national infrastructure by 2028, and that China, Russia and other states will routinely use AI in cyber operations by then.
The argument is about old debt, not new weapons. Launching the report, NCSC CEO Richard Horne said the UK faces "a real prospect of an unprecedented rise in the number of cyber incidents" in the coming months, "not because AI has invented new ways to attack us" but because "vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." His line for boards: "For decades, we have collectively got away with doing tech on the cheap."
What the NCSC assesses (its own words, not confirmed incidents): AI acts as a force multiplier across reconnaissance, social engineering, vulnerability discovery and exploit writing, but human operators remain essential and AI is not yet running end-to-end attacks. The biggest near-term risk is AI-assisted bug finding that lets attackers hit systems before owners patch. It also flags employees pasting company data into unsanctioned "shadow AI" tools, and expects a widening gap between well-resourced organisations and those on legacy technology.
The defensive flip side. Horne said the same tools are speeding up fixes: the Linux kernel project alone patched more than a thousand vulnerabilities last month. The UK Chancellor last week announced £60 million for a first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC.
Why it matters: A national security agency is now telling boards that patch speed and basic hygiene, not exotic AI defences, decide who gets hit. That framing favours vendors in vulnerability management, exposure monitoring and automated patching, and puts pressure on organisations still running unpatched internet-facing systems.
Sources: NCSC press release, NCSC Annual Review 2026: the impact of AI on cyber threat, Richard Horne's launch speech, Financial Times, The Record.
