The NCSC recently assessed that AI-powered malware is "highly likely" to be used in ransomware attacks on Britain's critical national infrastructure within the next two years. While alarming, the more practical insight is that AI will enhance "the speed, scale, and efficiency of existing attack methodologies" rather than conduct end-to-end attacks autonomously.
For your risk management team, this means you're not facing a new type of threat. Instead, you're dealing with faster exploitation of vulnerabilities you likely already know about.
Understanding the Data
Three key data points illustrate the current landscape. The NCSC reports that up to 88% of all attacks stem from four vectors: phishing, exploiting public-facing applications, misuse of valid accounts, and exploiting external remote services. Dr. Richard Horne, head of the NCSC, points out that underinvestment in technology has left organizations with technical debt, making them vulnerable. Meanwhile, the UK government has pledged £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy.
These findings tell a clear story: attackers focus on a limited set of entry points. AI accelerates the time to find and exploit them. The real issue is accumulated neglect, not a lack of technology.
Key Insights
1. The Critical Attack Surface is Narrow and Known.
Four vectors account for up to 88% of attacks. As Oliver Spence of CybaVerse notes, these are not new threats. Misconfigured VPNs and vulnerabilities in third-party software are common targets. AI doesn't change where attackers look; it changes how quickly they find vulnerabilities.
Action: Map your risk controls directly to these four vectors, not to a generic list of threats.
2. AI Increases the Importance of Remediation Speed.
Automated tools can exploit unpatched services faster than before. Your team's remediation delays now matter more. The risk isn't that your controls fail differently; it's that known gaps remain open while exploitation speeds up.
Action: Measure time-to-remediate for external assets as a risk indicator.
3. Technical Debt is a Governance Issue.
Dr. Horne describes underinvestment as accumulated debt. This concept is familiar to finance and risk functions: inventory it, price it, and schedule repayment. Legacy systems and deferred upgrades are risks that need this treatment.
Action: Report cybersecurity technical debt alongside other deferred obligations.
4. Cyber Essentials is Just the Beginning.
The NCSC views the Cyber Essentials scheme as a starting point, not the end goal. Certification shows baseline hygiene but doesn't ensure resilience against faster-moving adversaries.
Action: If Cyber Essentials is your board's highest standard, conduct a gap analysis against a more comprehensive framework like the NIST CSF Core Functions.
5. Defensive AI Requires a Strong Foundation.
Dr. Horne believes AI can improve cyber resilience, but only after addressing underinvestment and foundational weaknesses. Adding AI-assisted detection to unmanaged assets just creates more alerts, not more security.
Action: Prioritize foundational investments before automation.
Implications for Your Team
For risk managers, AI-enhanced ransomware doesn't create a new risk category. It requires reevaluating existing ones. The likelihood and speed of exploiting known weaknesses increase, while response time decreases.
This also impacts your insurance position. Underwriters evaluate controls against these vectors, and your responses on multi-factor authentication, patching cadence, and remote access reflect the exposures the NCSC highlights. If there's a gap between what you attest and what's deployed, it could lead to an Application Fraud Warranty issue after a loss. A candid Cyber Maturity Assessment now is cheaper than a coverage dispute later. Check how your Cyber Extortion Coverage and Business Interruption Coverage respond if the entry point was a known, unremediated weakness.
Action Steps by Priority
Priority 1: Address the Four Vectors (Next 30 to 60 Days)
- Enforce multi-factor authentication on all remote access and privileged accounts. Review dormant and shared credentials.
- Inventory external remote services and public-facing applications. Remove unnecessary ones.
- Conduct Attack Surface Scanning on your perimeter, including third-party platforms. Assign an owner to each finding.
- Test phishing resilience with realistic exercises and simplify reporting suspicious messages.
Priority 2: Make Technical Debt Visible (Next Quarter)
- Create a technical debt register: unsupported systems, deferred patches, known misconfigurations, each with an owner, risk rating, and target date.
- Report remediation lag for external assets to your risk committee regularly.
- Fund repayment explicitly. Unfunded registers only document the problem.
Priority 3: Elevate the Baseline (Next Two Quarters)
- Treat Cyber Essentials as entry-level. Develop a CSF Organizational Profile to compare your status against the NIST CSF Core Functions.
- Review third-party and vendor software dependencies, as these are common weaknesses. Revisit Contingent Business Interruption Coverage during this review.
Priority 4: Implement Defensive Automation (After Foundations)
- Once asset inventory and account hygiene are reliable, evaluate AI-assisted detection and vulnerability prioritization. Ensure vendors provide actionable data.
- Rehearse your response path, including First Notice of Loss timing and Breach Coach engagement, to avoid delays in decision-making.
