The UK's National Cyber Security Centre (NCSC), the cyber security arm of GCHQ, has warned that the country faces a real prospect of an “unprecedented” rise in cyber incidents in the coming months. The warning was delivered by CEO Richard Horne on 3 November 2026, at the launch of the NCSC Annual Review 2026, titled “The State of the Cyber Nation”.
According to Horne, the risk does not come from new kinds of attack created by artificial intelligence. The problem is that weaknesses tolerated for years can now be discovered and exploited at a scale once unimaginable, with AI's help. “AI did not create these cyber security weaknesses; it revealed them,” he wrote in the report's foreword.
NCSC Annual Review 2026 in numbers
The figures for 1 September 2025 to 31 August 2026 tell a mixed story: the NCSC received 1,831 attack reports, up from 1,727 the previous year, but gave hands-on support in 337 cases (down from 429) and classed 80 as nationally significant, against 204 a year earlier. The review itself cautions that incident numbers rarely move in a straight line, as a handful of severe events can skew a single year — so the fall should not be read as a lasting improvement.
What AI could change by 2028
The review also makes a forward-looking assessment: the NCSC judges it “highly likely” that by 2028, AI-powered malware will be used in a ransomware attack on UK critical national infrastructure, and that China, Russia and other states will routinely use AI in cyber operations against the country. China is described as the most sophisticated and sustained threat; Russia as the most audacious.
Other findings: 88% of incidents at large organisations came through four routes — public-facing applications, phishing, misused valid accounts and remote services; malicious cyber activity is estimated to cost UK organisations about £14.7 billion a year; and the 2025 attack on Jaguar Land Rover is used as the main example of economic harm. The NCSC also warns about “shadow AI” — staff putting company data into unapproved AI tools, often on personal devices.
Why it matters
For Geekiki readers, the core message is practical: defence does not depend on a miraculous new technology, but on fixing the basics — patching, protecting accounts and closing doors that have been open for years, before AI helps attackers find them at scale.
Read also: Falha OpenSSH “sshole” permite invadir o Alpine Linux com senha longa.
Featured image: aerial view of GCHQ headquarters in Cheltenham, the organisation the NCSC belongs to. Photo: Ministry of Defence / GCHQ, Crown Copyright, via Wikimedia Commons, under the Open Government Licence v1.0.
Sources: NCSC Annual Review 2026 — foreword by CEO Richard Horne; GCHQ — NCSC Annual Review 2026; Insurance Business; Zero Day Feed, based on The Record.
Transparency: this article was produced with the help of artificial intelligence, by cross-checking public posts on X and internet sources, including those cited above. Please consult the original sources to verify the data.
By Muse
