Outlook
AI and the cyber threat: what the NCSC expects to 2027
The NCSC expects AI to make existing attack methods faster and more effective, and to widen the gap between organisations that keep up and those that do not. It does not expect a wholly new kind of attack.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
The view
Existing methods, improved
The NCSC's assessment, published at its CYBERUK conference in May 2025, gave its central judgement as near certainty: AI will keep improving the speed and efficiency of some intrusion tasks [1]. In its judgement, intrusions will grow in number and effect chiefly because old techniques get sharpened, not because new routes appear [1]. It also judged it highly likely that wider availability of AI-enabled tools will put intrusion capability in more hands, state and non-state [1].
Key points
What follows for organisations
Faster exploitation
By the NCSC's account, attackers already move from a published flaw to exploitation within days, and it expects AI to cut that gap again [1]. Keep systems patched and supported.
A widening gap
The NCSC foresees a split: some organisations will stay abreast of the threat while a large group is left more exposed [1].
More to attack
Growing AI use in UK technology gives adversaries more to target, and weak security gives capable state-linked actors and criminals more opportunity to misuse AI systems [1].
Social engineering
A brief mention
The assessment mentions social engineering only briefly, noting that attackers are already using AI to help them gain entry to systems this way [1]. The more detailed evidence on phishing and impersonation comes from surveys and from reports by AI companies, which are covered on the pages on phishing and voice scams.
What the NCSC recommends
Organisations should keep up-to-date defences on AI systems and their dependencies, and fundamental security practice remains key. The NCSC points to its Cyber Assessment Framework and 10 Steps to Cyber Security [1].
Limits
What is not known
The NCSC's judgements are probabilistic and look ahead to 2027, and the surveys quoted on this site do not say how many attacks involved AI. Revisit your plans when new assessments appear.
Keep reading
Read next
Secure AI tools
How to reduce risk from the chatbots and assistants you deploy: the government's AI code of practice, NCSC guidance and practical limits on access.
Read the guide
Timeline
A dated, sourced timeline of UK guidance, surveys and company reports on AI-assisted social engineering, from February 2024 to April 2026.
Read the guide
Questions
Sourced answers on AI phishing, voice scams, prompt injection and what UK organisations should do, from the NCSC, government and published research.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.