Britain faces a real prospect of an unprecedented rise in cyber incidents in the coming months, the head of the UK's National Cyber Security Centre (NCSC) has warned. The warning came on 3 November 2026, when the agency published its State of the Cyber Nation report and its Annual Review 2026.

Dr Richard Horne, the NCSC's chief executive, said the danger is not that artificial intelligence has invented new ways to attack. It is that weaknesses organisations have tolerated for years can now be found and exploited at a scale that was once unimaginable. In his launch speech he said: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

The NCSC, which is part of the signals intelligence agency GCHQ, judges it highly likely that AI-powered malware will be used in a ransomware attack on Britain's critical national infrastructure by 2028. Its report warns that within the next two years, AI adoption by hostile actors is highly likely to increase the scale and efficiency of their operations, including ransomware attacks, social engineering and the exploitation of vulnerabilities.

The scale of attacks on the UK

The NCSC's Annual Review 2026, covering 1 September 2025 to 31 August 2026, sets out the scale of the threat. The agency received 1,831 reports of cyberattacks in that period. Of those, 337 incidents required support from its incident management team, including 80 classed as nationally significant. Through its Early Warning service, the NCSC also notified about 8,500 organisations of events indicating a suspected compromise, helping them spot malicious activity before it became a full incident.

Government research cited by the NCSC estimates that malicious cyber activity costs UK organisations about £14.7 billion a year. The review identifies cybercrime, espionage and supply chain compromises as significant threats to the UK's economic security, and warns that cyber espionage is highly likely to represent the most significant long-term cyber threat to UK economic growth.

Dr Horne told organisations that, as a society, the era of "tech on the cheap" at the expense of security is over. He said leaders must actively choose to invest with urgency, and warned that failing to do so will leave them having to explain themselves "when food isn't on shelves, lights aren't on, businesses have gone under".

What the government is doing

The warning comes as the government invests in cyber defence and resilience. The Chancellor has announced £60 million for the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC, to develop AI security expertise within government.

Ministers are also taking action through the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan, aimed at strengthening the UK's defences, deterring hostile state aggression, keeping essential services running and keeping the British people safe.

Dr Horne urged every organisation to make different choices now: to invest properly in its technology, to avoid leaving technology unnecessarily connected to the internet, and to treat Cyber Essentials as the starting point for cyber security rather than the end goal, building greater resilience according to size, complexity and risk.

A moment of choice

The NCSC describes the UK as being at a point of "enormous consequence" for cyber security. Its report calls on organisations to make use of the tools, standards and frameworks that already exist and are proven to protect against conventional and AI-powered attacks, and says AI also represents a critical opportunity to improve the UK's collective cyber resilience if organisations act on it.

As reported by the National Cyber Security Centre, the agency is imploring organisations to face what Dr Horne calls "a moment of choice". As reported by Intelligent Gov, the Annual Review recorded 80 nationally significant incidents in the year to 31 August 2026, and the agency warned that the UK's cyber resilience is failing to keep pace with the growing threat.