UK NCSC: AI to intensify cyber threats through 2027

UK NCSC assesses AI will almost certainly increase cyber threat frequency and intensity through 2027, creating a digital divide between secured and vulnerable systems.

The UK's National Cyber Security Centre published a strategic assessment examining how artificial intelligence will impact the cyber threat landscape from now through 2027. The report concludes that AI will almost certainly make cyber intrusion operations more effective and efficient, leading to increased frequency and intensity of attacks. Threat actors are already leveraging AI to enhance reconnaissance, vulnerability research, exploit development, social engineering, and malware generation. By 2027, AI-enabled tools will almost certainly help adversaries exploit known vulnerabilities faster, shrinking the window between disclosure and exploitation from days to potentially hours. The most significant development will come from AI-assisted vulnerability research and exploit development (VRED), with skilled state actors potentially achieving enhanced zero-day discovery capabilities.

The assessment identifies a looming digital divide between organizations that can keep pace with AI-enabled threats and those that cannot. While only highly capable state actors currently possess the investment and expertise to fully harness AI for advanced operations, the proliferation of AI-enabled cyber tools will highly likely expand intrusion capabilities to a broader range of state and non-state actors, including cyber criminals and hacktivists operating 'as-a-service' models. The growing incorporation of AI systems across critical national infrastructure presents an expanded attack surface vulnerable to exploitation through techniques like prompt injection and supply chain attacks. The NCSC emphasizes that maintaining fundamental cyber security practices and keeping pace with frontier AI developments will be critical to cyber resilience over the coming decade.

Source reporting: https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027