Has AI created a new class of UK cyber attack? The NCSC says not yet
The UK cyber agency received 1,831 attack reports and supported 337 incidents in its reporting year. It saw attackers add AI tools, but says none enabled a novel attack class; its larger warning is that faster vulnerability discovery could widen the gap between well-defended and exposed organisations.
The short version
- What happened
- From 1 September 2025 to 31 August 2026, the NCSC incident team received 1,831 reports, supported 337 incidents and classed 80 as nationally significant; it also sent 8,500 suspected-compromise notifications through Early Warning.
- Who it affects
- People experience cyber incidents through interrupted care, benefits, schooling, utilities and transport. Continuity plans and usable offline routes matter alongside technical controls.
- What remains unproven
- The public review is produced by the agency describing its own work and says national-security constraints prevent full disclosure.
Keep in mind
The public review is produced by the agency describing its own work and says national-security constraints prevent full disclosure.
The 1,831 reports, 337 supported incidents, 80 nationally significant incidents and 8,500 notifications are operational counts with different denominators; none is identified as an AI-caused total.
The review does not publish how many observed attacks used AI, which models or tools were involved, how much human control remained, or whether AI changed the eventual harm.
Probabilistic terms such as almost certain and highly likely are intelligence judgements, not frequencies measured in a controlled study.
The central AI-by-2028 critical-infrastructure assessment was already public in June 2026; the new report consolidates and extends it rather than creating a wholly new warning.
Cyber Shield is a planned five-year programme without published outcome evaluation, false-positive rate or evidence of safe autonomous remediation.
Project DROMOS reports hundreds of potential findings but no repository denominator, confirmation rate, false-positive rate, remediation count, time comparison or prevented-incident outcome.
Source analysis · 6 linked sources. Primary analysed source date: 3 November 2026. Earliest linked supporting source: 17 June 2026.
Read the full report · 10 min The evidence, methods, implications and limitations
The direct answer: AI is amplifying familiar attacks, not replacing them
The UK's National Cyber Security Centre has drawn a useful line between what its incident responders have observed and what its analysts expect next. In the year to 31 August 2026, the incident team began seeing threat actors incorporate AI tools into attacks. Yet the agency says none of those observed uses enabled a novel class of attack. Successful compromises still most often began with known vulnerabilities in internet-facing systems, stolen credentials or social engineering—the same routes defenders already know how to reduce.
That does not make AI irrelevant. The NCSC assesses that it is almost certain to act as a force multiplier for skilled operators, accelerating reconnaissance, vulnerability discovery, social engineering and exploit development. The immediate change is therefore operational tempo. A criminal or state team may examine more targets, adapt messages faster or identify an unpatched weakness sooner. An organisation with slow patching, weak identity controls or an opaque supplier chain can face more attempts without the underlying attack method being new.[2][3]
The denominators show workload, not an AI-attributed incident rate
The annual review covers NCSC activity from 1 September 2025 through 31 August 2026. Its incident team received 1,831 reports of cyber attacks affecting organisations across sectors. After triage, 337 incidents required team support, including 80 classed as nationally significant. Separately, the Early Warning service notified 8,500 organisations about events indicating suspected compromise. These are four different operational counts: incoming reports, supported incidents, a severity subset and proactive notifications. They should not be added together or treated as 10,000 confirmed attacks.
The review does not provide an AI numerator for those totals. It does not say how many of the 1,831 reports involved AI, how many observed AI uses contributed materially to access or harm, or whether an AI-assisted incident was more severe than a comparable conventional one. The NCSC also cautions that incident reporting does not follow a simple annual trend: peaks can be driven by a few large events, while automated warnings may stop some compromises before they need direct support. The counts establish the scale of the agency's workload, not a causal estimate of AI's impact.[1][2]
The distinction that matters
How to read the NCSC's evidence
The review combines operational counts, observed tactics, intelligence judgements and a future programme. They support different conclusions.
Observed workload
1,831 reports were triaged
337 needed support; 80 were nationally significant
Observed AI use
Attackers incorporated AI tools
No disclosed use enabled a novel attack class
Forecast
Assess faster, larger AI-assisted operations
Ransomware using AI malware against CNI judged highly likely
Defensive plan
Build Cyber Shield over five years
Detection first; autonomous remediation remains unproven
Defensive pilot
Use DROMOS to inspect government code repositories
Hundreds of potential issues; confirmation and false-positive rates unpublished
What the intelligence language means—and what it does not
The threat assessment uses calibrated terms rather than experimental probabilities. It says AI will almost certainly multiply activity across the threat landscape and highly likely continue to be integrated into operations. It also judges that AI-assisted vulnerability discovery and exploit development will pose a significant threat, narrowing the time between discovery and defenders' deployment of a patch. Human operators, the NCSC says, are still highly likely to remain essential for directing, validating and adapting outputs; skilled operators benefit most.
Its most consequential forecast is that AI malware will highly likely be used in a ransomware attack on UK critical national infrastructure. This is a warning about capability and exposure, not a notice that such an event is under way. The central expectation that AI-enabled attackers could exploit familiar weaknesses in critical infrastructure by 2028 was already made public by the NCSC in June. The November review adds the year's incident denominators, a consolidated set of judgements, the observation that present AI use has not created a new attack class, and more detail on the defensive response. It should not be reported as though an entirely new deadline or live attack appeared overnight.[3][5]
The widening divide may matter more than the most dramatic scenario
One of the report's strongest judgements concerns inequality between organisations. The NCSC says it is almost certain that a digital divide will widen between organisations able to adopt AI for defence and those unable to adapt. Mature teams may use automation to prioritise vulnerabilities, detect abnormal activity and handle repetitive investigation. Organisations running legacy systems with limited staff and weak governance may instead absorb a larger volume of AI-assisted probing while remaining slow to patch or recover.
That is especially important for essential services and smaller suppliers. A hospital, local authority, school trust or transport operator may depend on old software that cannot be interrupted easily, while a third-party provider can hold access to several customers at once. Faster offensive discovery can turn a known but unpatched flaw into an organisation-wide problem before a stretched team completes testing. The practical response is not to buy an unspecified 'AI security' product. It is to know assets and suppliers, deploy patches according to risk, replace password-only access, monitor internet-facing systems and practise incident recovery.[3]
Project DROMOS adds defensive evidence—but not an effectiveness rate
The NCSC has also described Project DROMOS, a four-week pilot using AI-enabled tooling to inspect government code repositories for security weaknesses. The agency says the pilot surfaced hundreds of potential issues, including critical vulnerabilities, and that the work has expanded into selected government environments. That is material operational evidence that the agency is applying AI to defensive discovery rather than only describing a future programme. Human oversight and management of false positives remain part of the process.
The published account does not provide the number or size of repositories examined, the total findings reviewed, how many potential issues were confirmed, the false-positive rate, the number fixed, the time saved, or a comparison with existing static analysis and human code review. 'Hundreds of potential issues' therefore cannot be converted into a detection rate or a count of prevented incidents. Critical severity also does not establish exploitability in the deployed environment. The right conclusion is narrower: the pilot found candidates worth expert review and was expanded, while its accuracy, incremental value, workload and security outcomes remain unquantified.[6]
Cyber Shield is a staged programme, not proof of autonomous defence
The NCSC and the Department for Digital, Culture, Media and Sport describe Cyber Shield as a five-year effort to build an agentic defence ecosystem at national scale. The proposed architecture would let the NCSC provide intelligence and fused data to defensive agents operated inside participating organisations, then consume signals from those agents to build broader national insight. Government would provide the core platform and policy work; commercial companies, open-source contributors and other participants would develop and operate agents.
The initial operational focus is deliberately narrower than autonomous remediation. Detection and blocking are considered more amenable to automation; actions that change systems remain outside many organisations' risk tolerance because an incorrect response could interrupt a service as effectively as an attacker. The programme description asks how defenders could show that an automated remedial action is safe, predictable and proportionate. Those unanswered questions are evidence limits, not implementation details to wave away. Cyber Shield currently establishes direction, roles and planned stages—not measured detection gains, false-positive rates, prevented incidents or safe autonomous recovery.[4]
What this means for people running public and essential services
For security teams, the report supports prioritising fundamentals under shorter decision windows. Patch queues should account for how exposed and exploitable a flaw is, not only its published severity. Identity protection should reduce reliance on reusable passwords. Contracts and exercises should include suppliers because a trusted connection can become an attack path. Teams considering defensive agents need audit logs, human escalation, rollback, tightly limited permissions and tests showing what happens when a model misclassifies benign activity or receives manipulated input.
For clinicians, teachers, council workers and other service professionals, the consequence is continuity. An AI-assisted attack may still arrive as an unavailable appointment system, delayed benefit payment, lost teaching platform or disrupted transport control. Staff should know how critical tasks continue when digital systems are isolated, and incident plans should protect people who cannot switch easily to an online alternative. The annual review does not prove that disruption is imminent, but it does show why resilience decisions made before an incident shape the human cost afterward.[2][3][4]
What evidence would change the assessment
A more precise assessment would publish a consistent incident taxonomy across years, the proportion of reports that become supported incidents, sector and severity breakdowns, and a clearly defined AI involvement measure. For AI-assisted cases, useful fields would distinguish model-generated phishing, vulnerability discovery, exploit code, orchestration and autonomous tool use; report whether the output changed access, scale or harm; and describe the amount of human control. Sensitive details can be aggregated without turning every attack into an anecdote.
For Cyber Shield, credible evidence would include prespecified trials against existing detection practice, time-to-detection and containment, missed attacks, false blocks, analyst workload, service disruption, privacy effects and independent red-team testing. Results should cover small and legacy-heavy organisations as well as well-funded operators. Until then, the most defensible reading is sober: AI has begun entering real attacks but has not created a new class in the incidents disclosed; the near-term risk comes from amplifying familiar weaknesses; and the UK's agentic defence programme remains an ambitious plan whose safety and effectiveness still have to be demonstrated.[1][2][3][4]