These questions arise from discussions among risk managers in Slack threads, budget reviews, and board prep sessions. They follow the NCSC's State of the Cyber Nation report, launched on November 3. CEO Richard Horne warned that AI-powered malware is expected to feature in ransomware attacks on UK critical national infrastructure by 2028. The answers below are direct, and where a claim goes beyond the published facts, it's labeled as analysis.
Q1: Is this actually a new threat, or is the NCSC just rebranding old risk?
It's mostly the latter, which is useful. Horne clarified that the danger isn't from AI inventing new attack methods. It's that long-tolerated vulnerabilities can now be exploited at an unimaginable scale.
For your Cybersecurity Risk Register, adjust your scoring. Don't just add an "AI ransomware" line. Revisit the likelihood ratings on existing entries: unpatched systems, end-of-life platforms, excessive access, weak monitoring. If AI shortens the time between vulnerability discovery and exploitation, your previous likelihood assumptions are likely outdated.
Q2: We have a few end-of-life systems we've been meaning to retire. How do we justify moving them up the queue?
Use Horne's language: "End-of-life systems kept running for just one more year" and upgrades delayed as "cost efficiency." This describes a deferred decision, and you should treat it as such.
Document each end-of-life system as a risk with a named owner, a compensating Compliance Control set, and a retirement date. If leadership wants to keep a system running, it should be an Approved Exception with an expiry date, not an indefinite carry-over. An exception that must be renewed forces a recurring conversation about whether the Cyber Risk Appetite still tolerates the exposure.
Frame the cost comparison honestly. Compare the upgrade budget against the expected loss from a disruption of essential services. Horne described scenarios where leaders may have to explain "when food isn't on shelves, lights aren't on, businesses have gone under."
Q3: Can we just rely on cyber insurance to cover the downside?
Don't base your resilience case on it. Anthony Young of Bridewell cautioned that organizations "cannot assume that insurance will resolve the consequences of an attack when essential services are disrupted."
Insurance transfers some financial loss; it doesn't restore a hospital's operations or a power station's output. In your risk treatment decisions, record insurance as one component of a treatment plan, not as the treatment. Pair it with preventive and detective controls, and test whether your Incident Response Structure can sustain operations during an outage, not just recover afterward.
Q4: With so many government announcements, what should we actually do with them?
Sort them into things you can use and things that signal direction.
Usable now: the government offers a 75% discount on Cyber Essentials certification for micro, small, and medium-sized businesses, reducing the cost to between £80 and £125 plus VAT. More than 230 businesses have signed up to the Cyber Resilience Pledge, allowing participants to refer SMEs in their supply chains for free Cyber Essentials certification. If you manage third-party risk, that's a low-friction way to raise the baseline across smaller suppliers.
Direction of travel: the £60m invested in the first phase of a national Cyber Shield, including a £25m Challenge Fund and £70m for a National Exposure and Real-Time Vulnerability (NERV) Centre; £120m for the AI Security Institute; £40m for a National Agentic Security Unit; and the Cyber Security and Resilience Bill alongside the forthcoming National Cyber Action Plan. These indicate where regulatory attention is heading. Add the Bill to your Regulatory Inventory now, and assign someone to track it so your Obligations Library is ready when it lands. Don't assume specific obligations before the text is final.
Q5: The NCSC sent 110,000 alerts about PHP vulnerabilities. Who's supposed to be acting on those?
You are, if you're receiving them. The NCSC issued 110,000 proactive notifications and Early Warning alerts to UK organizations in response to the PHP2Shell vulnerabilities. That's an external signal handed to you for free.
The control question is whether anyone owns it. Check three things. First, does your Information Security Event intake process capture external advisories, and does it route them to a named person? Second, is there a defined timeframe from alert receipt to triage decision? Third, can you evidence what you did? An alert that landed in a shared inbox and was never logged is an audit finding waiting to happen. Consider a Key Control Indicator for time from external advisory receipt to documented disposition.
Q6: We can't fix everything. How do we prioritize spend without guessing?
Use the NCSC's diagnosis as your checklist. Horne listed the failures: technology installed but not funded across its lifecycle; access granted "where it was convenient rather than where it was necessary"; services procured on price alone without asking whether they were resilient or secure; and no monitoring to detect when things go wrong.
Turn each into a question for your Risk Prioritization Matrix:
- Lifecycle: Which critical systems are out of support or have no funded upgrade path?
- Access: Where does privileged access exceed need, and when was it last reviewed?
- Procurement: Do your critical vendors face any security or resilience criteria beyond price?
- Detection: Which critical systems lack monitoring that would tell you something had gone wrong?
Rank by business impact on essential services first, then by exposure. The report also urged organizations to use existing tools, standards, and frameworks to protect against conventional and AI-powered attacks. That's a prompt to mature what you have, not to buy something novel. The Software Security Code of Practice, which 14 new Software Security Ambassadors (including Fortinet, Thales, Capgemini, and Zscaler) will help promote, is a reference point for supplier due diligence.
Where to go for more
- The NCSC's State of the Cyber Nation report, for the full threat assessment and its language on frameworks and standards.
- Cyber Essentials documentation, as a baseline control set for your own estate and your supply chain.
- Updates on the Cyber Security and Resilience Bill and the National Cyber Action Plan, so you can map emerging Regulatory Obligations early.
- Output from the AI Security Institute and the NCSC's new AI Cyber Security Centre of Excellence, as it becomes available.
The two-year window is a planning horizon, not a grace period. Your team can't control how fast attackers move, but you can control how long known weaknesses stay open.
