1. Executive summary
The NCSC published its State of the Cyber Nation report on 3 November 2026 and warned that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. No CVE, victim, malware family or named actor is attached to this item, and no exploitation has been reported. The risk to EMEA financial services is indirect: the report says hostile actors will use AI to find and exploit vulnerabilities that organisations have left unpatched, and that internet-facing systems and end-of-life technology are where that exposure sits. Firms with UK operations or UK-regulated entities should read this as a call to close known gaps on internet-facing estate, not as a new threat to detect.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This is a strategic assessment, not an incident report. The NCSC gives no attack chain, no exploited component, no malware sample and no indicators. What it sets out is a projection and a diagnosis of why the projection matters.
The central judgement, in the NCSC's own probabilistic language, is that "it is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI." The report is explicit that AI has not created new attack methods. Dr Horne's launch speech says the expected rise in incidents is "not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." The mechanism the NCSC describes is therefore acceleration of existing weakness: AI finding and exploiting known vulnerabilities faster and at greater scale than human operators can.
The NCSC's companion assessment, Artificial intelligence and cyber intrusion, sets out three scenarios to 2028 (baseline, pessimistic, optimistic) and states they are "plausible possibilities in the medium-term but are not predictions." Its key judgements include that by 2028 it is "almost certain that many systems will remain vulnerable to attack from AI-cyber tools which identify and exploit system weaknesses," and "likely that attackers will apply AI-cyber capability against known vulnerabilities in critical national infrastructure (CNI) legacy technology." It also judges that by 2028 Russia, China and other nation states will "routinely use AI-cyber to achieve their geopolitical goals." These are assessments of future state, not reports of observed activity.
The report names the exposure it expects attackers to use. The Record quotes Horne saying major technology providers are "now fixing hundreds of vulnerabilities in a single update" and that "the Linux kernel project alone patched more than a thousand vulnerabilities last month." It says state-linked intrusions were often conducted through internet-facing applications and by exploiting "vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion." The same article notes officials have not yet observed a corresponding rise in exploitation. That gap between vulnerability volume and observed exploitation is the report's own framing, and it limits how far the warning can be read as evidence of current attacks.
The report also points to organisational causes: end-of-life systems kept running, upgrades delayed for "cost efficiency," and technology connected to the internet when it need not be. Horne's recommended starting points are Cyber Essentials as a baseline rather than an end goal, and resilience built "according to their size, complexity and risk."
The government measures announced alongside the report are funding and structure, not technical guidance: £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC. The Record reports that a government initiative titled Project DROMOS, initially a four-week pilot, was expanded into live government environments and found "hundreds of potential security issues, including critical vulnerabilities." No technical detail of those findings is public.
No threat actor is named in connection with any specific capability, campaign or victim. The nation-state judgements in the NCSC assessment are forward-looking and general; they are not an attribution of this warning to a named group.
4. Mitigation & containment
The report gives no product, version, patch identifier or configuration string. The steps below follow the specific weaknesses the NCSC names, applied to a financial services estate.
P1 (within 24 hours)
- Inventory every internet-facing system and confirm each one is meant to be reachable from the internet. The report names unnecessary internet connectivity as a driver; anything that fails that test should be removed from exposure or placed behind an authenticated gateway.
- Identify end-of-life and out-of-support systems in production and record an owner and a replacement date for each. The report names running end-of-life systems as a practice that has left organisations exposed.
P2 (within 72 hours)
- Reconcile your vulnerability backlog against vendor advisories for internet-facing applications and confirm that patches rated available by the vendor have actually been deployed, not merely approved. The report's stated mechanism is exploitation of "vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion."
- Where a patch cannot be applied on an internet-facing system, apply the vendor's documented mitigation and record the compensating control against the asset.
P3 (within 7 days)
- Assess your estate against Cyber Essentials and treat a pass as a floor. The NCSC position is that it is "the starting point for cyber security, not the end goal."
- Set a resilience target proportionate to the firm's size, complexity and risk, as the report recommends, and report progress to the board alongside the existing operational resilience metrics.
No fixed release or vendor patch is named in public reporting for this item because it describes no specific vulnerability.
5. Indicators of compromise
No indicators of compromise available in the source material.
The item describes no malware, infrastructure, file artefact or victim. There are no atomic indicators to list and no behavioural indicators specific to an event, because no event is reported.
6. Detection
Insufficient indicators to author detection rules.
The sources contain no strings, command lines, file paths, registry keys or network artefacts belonging to any threat. A rule built from the report's terminology would detect reporting about the warning, not malicious activity.
7. Sources
- NCSC, Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years, https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years, 3 November 2026
- NCSC, Artificial intelligence and cyber intrusion, https://www.ncsc.gov.uk/report/artificial-intelligence-and-cyber-intrusion
- The Record (Recorded Future), UK faces 'unprecedented rise' in cyberattacks in coming months, warns cyber chief, https://therecord.media/uk-ncsc-predicts-rise-cyberattacks-coming-months
8. Adverse Trace position
Adverse Trace assesses this as a strategic warning with no current operational indicators: no CVE, no exploited vulnerability, no victim and no named actor, so there is nothing here to detect or block today. The client impact for EMEA financial services is a governance and hygiene one. The NCSC's own judgement is that the danger comes from unpatched, internet-facing and end-of-life systems that already exist, and that is a condition firms can measure now. We will track the NCSC assessment and any subsequent reporting that attaches a specific capability, actor or victim to it, and we will reissue if the projection becomes an observed event. Firms with UK entities should also watch the Cyber Security and Resilience Bill and the National Cyber Action Plan named in the announcement, which may change UK reporting and liability duties; we will advise separately when their scope is published.
Published via PulseTrace — Adverse Trace threat intelligence.