## AI Accelerates Vulnerability Discovery and Exploitation **Richard Horne**, Chief Executive of the **NCSC**, part of the UK's cyber and signals intelligence agency **GCHQ**, is set to deliver a sobering message: Britain faces a "real prospect of an unprecedented rise in the number of cyber incidents" in the coming months. This escalation, he explains, is not due to AI inventing new attack methods, but rather its capacity to uncover and exploit existing vulnerabilities with unparalleled speed and scale. This warning echoes an alert issued in June by the **Five Eyes** intelligence alliance, which predicted that AI would fundamentally transform both offensive and defensive cyber capabilities, stating the timeline for this shift was "months, not years." Officials point to the dramatic increase in vulnerabilities being disclosed by vendors as evidence of this transformation. Major technology providers are now patching hundreds of vulnerabilities in single updates, while the **Linux** kernel project alone patched over a thousand vulnerabilities last month. **Horne** notes that AI is enabling vulnerabilities to be found and fixed faster than ever. ## State-Sponsored Threats and Critical Infrastructure at Risk The threat from attackers deploying AI remains significant. The **NCSC** anticipates it is "highly likely" that AI-powered malware will be used in ransomware attacks on Britain's critical infrastructure by 2028. Furthermore, the agency warns that **China** and **Russia** will be "routinely" employing AI in their cyber operations by the same date. The annual report clarifies that AI "did not create these cybersecurity weaknesses." Instead, it is exposing "years of technical debt and the failure to implement even basic cyber protections." Many state-sponsored attacks, the report highlights, leverage internet-facing applications and exploit vulnerabilities for which patches are available but have not been deployed in a timely fashion. ## Addressing Technical Debt and Business Incentives **Horne** criticized existing business practices that have led to widespread vulnerability, stating, "For decades, we have collectively got away with doing tech on the cheap." He referenced organizations running end-of-life systems and delaying upgrades for "cost efficiency." He warned that executives failing to act will ultimately face severe consequences, impacting investors, shareholders, employees, customers, and suppliers, potentially leading to disruptions in essential services and business failures. Last year, the **NCSC** publicly advocated for a "strategic policy agenda" to address insecure technology. **Ollie Whitehouse**, the **NCSC**'s Chief Technology Officer, noted that while the knowledge to build secure products exists, the business and commercial incentives to adopt and sustain secure solutions are insufficient. ## AI vs. AI: The Defender's Advantage Despite the formidable threat, **Horne** believes AI also presents a significant opportunity for cyber defense. The British government, including the **NCSC**, is actively planning to deploy AI for security purposes. "AI has the potential to be one of the greatest opportunities in cyber defence," **Horne** is expected to say. The report reveals that the government has already begun testing frontier AI systems to identify weaknesses in its own networks. One such initiative, **Project DROMOS**, initially a four-week pilot, was expanded into live government environments where it discovered "hundreds of potential security issues, including critical vulnerabilities." Looking beyond government systems, the **NCSC** plans a new £70 million ($93 million) **NERV Centre** – the **National Exposure and Real-Time Vulnerability Centre**. This initiative will leverage AI to build on existing projects, identifying vulnerabilities across the UK's critical infrastructure and economy. An additional £60 million ($80 million) has been allocated to the first phase of **Cyber Shield**, a national network of AI agents first previewed in July. **Horne** expects this to "embed cutting-edge agentic AI into machine speed cyber defence at a national scale." Under this plan, the **NCSC** will provide the platform and threat intelligence, while security companies and open-source developers will build AI agents to operate within organizations nationwide, initially focusing on detecting and blocking attacks. The **NCSC** believes that as AI transforms cybersecurity, the "structural advantage will remain with defenders" because they "own or operate the environment, can instrument it, can change it and can define acceptable behaviour." However, the report cautions that "this advantage is not a given and realising it requires clear direction, investment and disciplined adoption."