The UK is facing a moment of "enormous consequence" for national cyber security, according to the chief executive of the National Cyber Security Centre (NCSC), who is set to warn that decades of "tech on the cheap" have left the country exposed to AI-boosted attacks on critical infrastructure within two years.
The NCSC's annual report found that hackers demanding ransom payments are "highly likely" to use AI to target the UK by 2028. It added that hostile states such as Russia and China will routinely use the technology to pursue their goals by then.
Warning of unprecedented rise in cyber incidents
In a speech launching the report on Tuesday, Dr Richard Horne, CEO of the NCSC, will say: "It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. A 'sliding doors' moment. A moment of choice."
He will add: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
"And because far too many of our organisations and supply chains rest on weak technology and operational foundations."
Supermarkets and critical infrastructure at risk
Dr Horne is expected to warn supermarkets that without action they could soon face empty shelves and power blackouts. He will say: "If leaders of organisations of every size and type do not take the responsibility now to make different choices, then they will one day have to look their investors, shareholders, employees, customers, suppliers, and ultimately, their families and friends in the eye and explain why, despite knowing the consequences, they failed to make the choices required."
"When food isn't on shelves, lights aren't on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn't make the right choices."
The warning comes as the NCSC annual report said that this year its incident management team received 1,831 reports of cyber attacks, of which 337 required support and 80 were nationally significant. The team also warned 8,500 organisations when their systems had been compromised by attackers.
Technical debt and the path forward
Recently, systems controlling fridges in supermarkets in a number of European countries have been hacked, raising questions over the risk of older operational technology being connected to the internet. While there have been no similar incidents in the UK, the report says all organisations have some "technical debt", a backlog of issues put off "as a result of prioritising short-term gains over building resilient products".
Dr Horne will say: "For decades, we have collectively got away with doing tech on the cheap. End-of-life systems kept running for just one more year, well-needed upgrades pushed back as a 'cost efficiency' and technology providers failing to invest in security by design and default."
He will add: "Now, that also carries through to the technology that underpins the automation of physical processes that are vital to modern life. Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls."
"Whilst they are not seen as traditional IT, they too are not built on the strong foundations they require. Their resilience and security is even more overlooked in investment decisions. Our resulting exposure as a society is huge and increasingly exploited in cyber attacks as we saw in the recent disruption of refrigeration units in supermarkets in France."
Dr Horne will also point to China as being best-positioned to use AI to target UK critical national infrastructure. He will say: "We can be a nation where leaders of all organisations actively choose to invest with urgency and not delay in replacing end-of-life technology, where critical physical systems are inaccessible to attackers, where passkeys are adopted as the norm, and where organisations make security and resilience a fundamental requirement, not an afterthought."
"The collective result would be a source of enduring national strength for us all."
