UK Cyber Chief Warns of Unprecedented Rise in Cyberattacks Due to AI-Accelerated Vulnerability Exploitation

Impending Cyberattack Surge

Richard Horne, Chief Executive of the UK's National Cyber Security Centre (NCSC), is set to warn of a significant increase in cyber incidents in the coming months. This warning will be delivered during the launch of the agency's annual report.

AI's Role in Exploitation

Horne clarifies that the heightened risk is not due to AI inventing new attack methods, but rather its capacity to discover and exploit long-tolerated vulnerabilities on an unprecedented scale. This aligns with a June alert from the Five Eyes intelligence alliance, which predicted AI would fundamentally alter offensive and defensive cyber capabilities within months.

Accelerated Vulnerability Disclosure

Evidence for this transformation includes the surging number of vulnerabilities being uncovered by vendors. Major technology providers are now fixing hundreds of vulnerabilities in single updates, and the Linux kernel project patched over a thousand vulnerabilities in the last month. AI is enabling faster discovery and patching of these vulnerabilities.

Future Threats and State Actors

The NCSC assesses it is 'highly likely' that AI-powered malware will be used in ransomware attacks on UK critical infrastructure by 2028. By the same year, China and Russia are expected to 'routinely' employ AI in their cyber operations. The report emphasizes that AI exposes existing cybersecurity weaknesses and technical debt, rather than creating them.

Addressing Technical Debt and Insecure Practices

Many state-sponsored hacks exploit vulnerabilities for which patches are available but not deployed promptly. Horne criticizes existing business practices, stating that the industry has 'got away with doing tech on the cheap' for decades, leading to widespread vulnerability. This comes as the British government plans to consult on holding technology companies liable for breaches caused by insecure products.