UK NCSC Warns AI Will Amplify Cyber Threats to Legacy Systems

As the cybersecurity arm of the UK intelligence agency Government Communications Headquarters (GCHQ), the NCSC believes that it is highly likely that hostile actors will adopt artificial intelligence technology. As AI tools become increasingly capable, attackers will in the future be able to carry out cyberattacks at lower cost and with greater efficiency, including launching large-scale ransomware operations, conducting more targeted social engineering fraud, and rapidly discovering and exploiting system vulnerabilities.

The NCSC Chief Executive Richard Horne said that the development of new technologies is amplifying legacy problems in existing cybersecurity systems. Many organizations have long neglected basic security construction, and these weak points are now becoming increasingly dangerous. If businesses and public institutions fail to take timely action to strengthen infrastructure and patch core weaknesses, they may be easily exploited by future attackers.

The report notes that in recent years the pace of development of artificial intelligence models has far exceeded expectations. Technology companies including Google, Anthropic and OpenAI continue to release more capable large models, some of which have already demonstrated the ability to discover software vulnerabilities and analyze code flaws. Although these capabilities were originally intended to assist development and defense work, cybercriminals may likewise use similar technologies in the future to seek attack opportunities.

The NCSC particularly emphasizes that in the face of the coming AI era, organizations should not focus only on future threats while ignoring existing problems. In fact, the reason cyberattackers frequently succeed is often not that they rely on advanced technology, but that they exploit known vulnerabilities that have long gone unpatched, configuration errors, and old systems exposed to the internet. Many successful intrusion cases stem from traditional security problems such as the exploitation of public network interfaces, phishing email attacks, abuse of legitimate accounts, and flaws in remote services.

To improve defensive capabilities, the NCSC recommends that organizations of all kinds strengthen investment in cybersecurity, reduce unnecessary internet connections, lower external exposure, and at the same time treat basic cybersecurity practices as the starting point for protection work. The agency believes that building a security system should not be the responsibility only of technical departments, but should become a core strategic task for the management of businesses and institutions.

Richard Horne pointed out that over the past few decades, many organizations have become accustomed to building digital systems at the lowest cost and treating security investment as optional. But in the AI era, this way of thinking is no longer sustainable. He called on leaders across industries to invest with a greater sense of urgency and to make security and system resilience basic requirements of organizational operations, rather than waiting until after an attack to remedy the situation.

At the same time, the UK government has also announced a number of cybersecurity investment plans to enhance national-level protection capabilities. These include investing 60 million pounds to build the first phase of the national "Cyber Shield" project, and investing 70 million pounds to establish the National Exposure and Real-time Vulnerability Centre (NERV), used to continuously identify cyber risks in critical infrastructure and the economy. In addition, the UK will establish a new AI cybersecurity centre of excellence in Manchester, operated by the NCSC, to cultivate AI security expertise in government departments.

The NCSC believes that artificial intelligence can be both a powerful defensive tool and a new type of weapon in the hands of attackers. As AI lowers the threshold for cyberattacks and significantly increases attack speed, the time gap between vulnerability discovery and vulnerability exploitation will further shrink in the future. For organizations still relying on old technology and traditional architectures, upgrading systems as soon as possible, patching vulnerabilities and building a more resilient security system is no longer a long-term plan, but an urgent task.