Has AI created a new class of UK cyber attack? The NCSC says not yet
The UK cyber agency received 1,831 attack reports and supported 337 incidents in its reporting year. It saw attackers add AI tools, but says none enabled a novel attack class; its larger warning is that faster vulnerability discovery could widen the gap between well-defended and exposed organisations.
What changed · 3 November 2026 at 10:08 GMT
Updated 3 November 2026 at 10:08 GMT: added the NCSC's Project DROMOS pilot, which used AI-enabled tooling to inspect government code repositories and surfaced hundreds of potential issues, including critical vulnerabilities. The update makes clear that the agency has not published the number of repositories examined, the confirmed-vulnerability or false-positive rate, remediation outcomes, or a comparator. The original 3 November source and publication time remain visible.
The short version
- What happened
- From 1 September 2025 to 31 August 2026, the NCSC incident team received 1,831 reports, supported 337 incidents and classed 80 as nationally significant; it also sent 8,500 suspected-compromise notifications through Early Warning.
- Who it affects
- People experience cyber incidents through interrupted care, benefits, schooling, utilities and transport. Continuity plans and usable offline routes matter alongside technical controls.
- What remains unproven
- The public review is produced by the agency describing its own work and says national-security constraints prevent full disclosure.
Keep in mind
The public review is produced by the agency describing its own work and says national-security constraints prevent full disclosure.
The 1,831 reports, 337 supported incidents, 80 nationally significant incidents and 8,500 notifications are operational counts with different denominators; none is identified as an AI-caused total.
The review does not publish how many observed attacks used AI, which models or tools were involved, how much human control remained, or whether AI changed the eventual harm.
Probabilistic terms such as almost certain and highly likely are intelligence judgements, not frequencies measured in a controlled study.
The central AI-by-2028 critical-infrastructure assessment was already public in June 2026; the new report consolidates and extends it rather than creating a wholly new warning.
Cyber Shield is a planned five-year programme without published outcome evaluation, false-positive rate or evidence of safe autonomous remediation.
Project DROMOS reports hundreds of potential findings but no repository denominator, confirmation rate, false-positive rate, remediation count, time comparison or prevented-incident outcome.
Source analysis · 6 linked sources. Primary analysed source date: 3 November 2026. Earliest linked supporting source: 17 June 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 10 min The evidence, methods, implications and limitations
The direct answer: AI is amplifying familiar attacks, not replacing them
The UK's National Cyber Security Centre has drawn a useful line between what its incident responders have observed and what its analysts expect next. In the year to 31 August 2026, the incident team began seeing threat actors incorporate AI tools into attacks. Yet the agency says none of those observed uses enabled a novel class of attack. Successful compromises still most often began with known vulnerabilities in internet-facing systems, stolen credentials or social engineering—the same routes defenders already know how to reduce.
That does not make AI irrelevant. The NCSC assesses that it is almost certain to act as a force multiplier for skilled operators, accelerating reconnaissance, vulnerability discovery, social engineering and exploit development. The immediate change is therefore operational tempo. A criminal or state team may examine more targets, adapt messages faster or identify an unpatched weakness sooner. An organisation with slow patching, weak identity controls or an opaque supplier chain can face more attempts without the underlying attack method being new.[2][3]
The denominators show workload, not an AI-attributed incident rate
The annual review covers NCSC activity from 1 September 2025 through 31 August 2026. Its incident team received 1,831 reports of cyber attacks affecting organisations across sectors. After triage, 337 incidents required team support, including 80 classed as nationally significant. Separately, the Early Warning service notified 8,500 organisations about events indicating suspected compromise. These are four different operational counts: incoming reports, supported incidents, a severity subset and proactive notifications. They should not be added together or treated as 10,000 confirmed attacks.
The review does not provide an AI numerator for those totals. It does not say how many of the 1,831 reports involved AI, how many observed AI uses contributed materially to access or harm, or whether an AI-assisted incident was more severe than a comparable conventional one. The NCSC also cautions that incident reporting does not follow a simple annual trend: peaks can be driven by a few large events, while automated warnings may stop some compromises before they need direct support. The counts establish the scale of the agency's workload, not a causal estimate of AI's impact.[1][2]
The distinction that matters
How to read the NCSC's evidence
The review combines operational counts, observed tactics, intelligence judgements and a future programme. They support different conclusions.
Observed workload
1,831 reports were triaged
337 needed support; 80 were nationally significant
Observed AI use
Attackers incorporated AI tools
No disclosed use enabled a novel attack class
Forecast
Assess faster, larger AI-assisted operations
Ransomware using AI malware against CNI judged highly likely
Defensive plan
Build Cyber Shield over five years
Detection first; autonomous remediation remains unproven
Defensive pilot
Use DROMOS to inspect government code repositories
Hundreds of potential issues; confirmation and false-positive rates unpublished
What the intelligence language means—and what it does not
The threat assessment uses calibrated terms rather than experimental probabilities. It says AI will almost certainly multiply activity across the threat landscape and highly likely continue to be integrated into operations. It also judges that AI-assisted vulnerability discovery and exploit development will pose a significant threat, narrowing the time between discovery and defenders' deployment of a patch. Human operators, the NCSC says, are still highly likely to remain essential for directing, validating and adapting outputs; skilled operators benefit most.
Its most consequential forecast is that AI malware will highly likely be used in a ransomware attack on UK critical national infrastructure. This is a warning about capability and exposure, not a notice that such an event is under way. The central expectation that AI-enabled attackers could exploit familiar weaknesses in critical infrastructure by 2028 was already made public by the NCSC in June. The November review adds the year's incident denominators, a consolidated set of judgements, the observation that present AI use has not created a new attack class, and more detail on the defensive response. It should not be reported as though an entirely new deadline or live attack appeared overnight.[3][5]
The widening divide may matter more than the most dramatic scenario
One of the report's strongest judgements concerns inequality between organisations. The NCSC says it is almost certain that a digital divide will widen between organisations able to adopt AI for defence and those unable to adapt. Mature teams may use automation to prioritise vulnerabilities, detect abnormal activity and handle repetitive investigation. Organisations running legacy systems with limited staff and weak governance may instead absorb a larger volume of AI-assisted probing while remaining slow to patch or recover.
That is especially important for essential services and smaller suppliers. A hospital, local authority, school trust or transport operator may depend on old software that cannot be interrupted easily, while a third-party provider can hold access to several customers at once. Faster offensive discovery can turn a known but unpatched flaw into an organisation-wide problem before a stretched team completes testing. The practical response is not to buy an unspecified 'AI security' product. It is to know assets and suppliers, deploy patches according to risk, replace password-only access, monitor internet-facing systems and practise incident recovery.[3]
Project DROMOS adds defensive evidence—but not an effectiveness rate
The NCSC has also described Project DROMOS, a four-week pilot using AI-enabled tooling to inspect government code repositories for security weaknesses. The agency says the pilot surfaced hundreds of potential issues, including critical vulnerabilities, and that the work has expanded into selected government environments. That is material operational evidence that the agency is applying AI to defensive discovery rather than only describing a future programme. Human oversight and management of false positives remain part of the process.
The published account does not provide the number or size of repositories examined, the total findings reviewed, how many potential issues were confirmed, the false-positive rate, the number fixed, the time saved, or a comparison with existing static analysis and human code review. 'Hundreds of potential issues' therefore cannot be converted into a detection rate or a count of prevented incidents. Critical severity also does not establish exploitability in the deployed environment. The right conclusion is narrower: the pilot found candidates worth expert review and was expanded, while its accuracy, incremental value, workload and security outcomes remain unquantified.[6]
Cyber Shield is a staged programme, not proof of autonomous defence
The NCSC and the Department for Digital, Culture, Media and Sport describe Cyber Shield as a five-year effort to build an agentic defence ecosystem at national scale. The proposed architecture would let the NCSC provide intelligence and fused data to defensive agents operated inside participating organisations, then consume signals from those agents to build broader national insight. Government would provide the core platform and policy work; commercial companies, open-source contributors and other participants would develop and operate agents.
The initial operational focus is deliberately narrower than autonomous remediation. Detection and blocking are considered more amenable to automation; actions that change systems remain outside many organisations' risk tolerance because an incorrect response could interrupt a service as effectively as an attacker. The programme description asks how defenders could show that an automated remedial action is safe, predictable and proportionate. Those unanswered questions are evidence limits, not implementation details to wave away. Cyber Shield currently establishes direction, roles and planned stages—not measured detection gains, false-positive rates, prevented incidents or safe autonomous recovery.[4]
What this means for people running public and essential services
For security teams, the report supports prioritising fundamentals under shorter decision windows. Patch queues should account for how exposed and exploitable a flaw is, not only its published severity. Identity protection should reduce reliance on reusable passwords. Contracts and exercises should include suppliers because a trusted connection can become an attack path. Teams considering defensive agents need audit logs, human escalation, rollback, tightly limited permissions and tests showing what happens when a model misclassifies benign activity or receives manipulated input.
For clinicians, teachers, council workers and other service professionals, the consequence is continuity. An AI-assisted attack may still arrive as an unavailable appointment system, delayed benefit payment, lost teaching platform or disrupted transport control. Staff should know how critical tasks continue when digital systems are isolated, and incident plans should protect people who cannot switch easily to an online alternative. The annual review does not prove that disruption is imminent, but it does show why resilience decisions made before an incident shape the human cost afterward.[2][3][4]
What evidence would change the assessment
A more precise assessment would publish a consistent incident taxonomy across years, the proportion of reports that become supported incidents, sector and severity breakdowns, and a clearly defined AI involvement measure. For AI-assisted cases, useful fields would distinguish model-generated phishing, vulnerability discovery, exploit code, orchestration and autonomous tool use; report whether the output changed access, scale or harm; and describe the amount of human control. Sensitive details can be aggregated without turning every attack into an anecdote.
For Cyber Shield, credible evidence would include prespecified trials against existing detection practice, time-to-detection and containment, missed attacks, false blocks, analyst workload, service disruption, privacy effects and independent red-team testing. Results should cover small and legacy-heavy organisations as well as well-funded operators. Until then, the most defensible reading is sober: AI has begun entering real attacks but has not created a new class in the incidents disclosed; the near-term risk comes from amplifying familiar weaknesses; and the UK's agentic defence programme remains an ambitious plan whose safety and effectiveness still have to be demonstrated.[1][2][3][4]
Continue the story
Read next
Continue exploring public services: compare the finding and its evidence limits.
Will Britain require serious AI incidents to be reported?
Not yet. The UK government is considering incident and near-miss reporting through the Cyber Security and Resilience Bill regime. A parliamentary statement now says two cyber pilots identified 1,352 vulnerabilities across 548 repositories in 18 departments, but it still provides no severity, false-positive or comparator data.
Read the next reportExplore the full source and evidence record
What this means for people
- People experience cyber incidents through interrupted care, benefits, schooling, utilities and transport. Continuity plans and usable offline routes matter alongside technical controls.
- Security teams should ask defensive-agent vendors for measured false-positive, missed-attack, rollback and service-disruption evidence before allowing automated actions on live systems.
Global context
AI-assisted cyber operations cross borders, but this report reflects one UK agency's visibility, legal role and critical-infrastructure environment. Other countries differ in incident-reporting duties, supplier concentration, legacy systems, defensive capacity and what intelligence agencies disclose. The general mechanism—faster exploitation of familiar weaknesses—can travel, while the NCSC's counts and confidence judgements should not be transferred directly to another jurisdiction.
What the evidence does not yet show
- The public review is produced by the agency describing its own work and says national-security constraints prevent full disclosure.
- The 1,831 reports, 337 supported incidents, 80 nationally significant incidents and 8,500 notifications are operational counts with different denominators; none is identified as an AI-caused total.
- The review does not publish how many observed attacks used AI, which models or tools were involved, how much human control remained, or whether AI changed the eventual harm.
- Probabilistic terms such as almost certain and highly likely are intelligence judgements, not frequencies measured in a controlled study.
- The central AI-by-2028 critical-infrastructure assessment was already public in June 2026; the new report consolidates and extends it rather than creating a wholly new warning.
- Cyber Shield is a planned five-year programme without published outcome evaluation, false-positive rate or evidence of safe autonomous remediation.
- Project DROMOS reports hundreds of potential findings but no repository denominator, confirmation rate, false-positive rate, remediation count, time comparison or prevented-incident outcome.
What to watch next
- A defined public measure of AI involvement in supported incidents
- Evidence that vulnerability discovery is shrinking patch windows in operational data
- Cyber Shield pilot results for detection, false blocking, analyst workload and service continuity
- DROMOS denominators, independent confirmation, remediation outcomes and comparison with existing review practice
- Standards for agent permissions, audit logs, human approval, rollback and liability
- Whether ransomware uses AI malware against critical infrastructure and what material difference the AI makes
- Sector breakdowns showing whether legacy-heavy public services face a widening defensive gap
Living evidence record
Impact record IAI-0NNO1WV
Evidence stage
Observed
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Updated
Last checked
3 November 2026
Source trail
6 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 6 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 3 November 2026
Research question, topics and regions
What the NCSC's 2026 incident totals, AI threat judgements and Cyber Shield programme establish about present and prospective AI-enabled cyber risk
Topics: Cyber security · Critical infrastructure · Ransomware · AI agents · Public services · National security
Regions: United Kingdom · Europe
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.