AI-Powered Cyberattacks: What UK CISOs Must Defend Now

UK CISOs must now defend against attackers using frontier AI to find and exploit vulnerabilities faster than defenders can patch them. NCSC chief executive Richard Horne has warned that adversaries are increasingly applying AI tooling, and that frontier AI is rapidly enabling the discovery and exploitation of existing vulnerabilities at scale — a shift that changes the economics of attack for every UK organisation, not just those in critical national infrastructure.

This comes as 43% of UK businesses report experiencing a cyber breach or attack in the past year, against a backdrop of new legislation raising the bar for what “adequate” defence now means.

How is AI changing the cyberattack landscape?

According to the NCSC, frontier AI models can now scan codebases and infrastructure for exploitable flaws at a speed and scale no human red team can match, then generate working exploits with minimal operator skill required. This lowers the barrier to entry for less sophisticated threat actors while giving well-resourced groups a significant speed advantage. CISOs who assumed their patch cycle was fast enough against human attackers need to re-test that assumption against AI-assisted ones.

• Executive Action: Re-benchmark patch and remediation timelines against AI-accelerated exploitation speeds, not historical attacker behaviour.
• Prioritise vulnerability scanning on internet-facing assets, since these are the first targets for automated AI-driven reconnaissance.
• Brief the board that “adequate” patching speed has fundamentally changed, with figures to support it.

What does the Cyber Security and Resilience Bill require?

The Cyber Security and Resilience (Network and Information Systems) Bill, last updated on 1 July 2026, extends statutory security and resilience obligations to a wider range of essential and digital services than the current NIS regulations cover. For CISOs, this means a larger population of systems now falls under formal regulatory scrutiny, with incident reporting and security-by-design expectations that go beyond current best practice for many mid-sized firms.

• Executive Action: Map current systems against the Bill’s extended scope to identify newly in-scope services before it receives Royal Assent.
• Align internal incident reporting timelines with the Bill’s anticipated statutory deadlines now, rather than waiting for enforcement guidance.
• Use INFORMD’s project review checklist to assess readiness for the extended NIS scope.

Should firms sign the government’s Cyber Resilience Pledge?

The government is urging UK businesses to sign a voluntary Cyber Resilience Pledge built around three commitments: making cybersecurity a board-level concern, joining the NCSC’s Early Warning Service, and enforcing Cyber Essentials certification across the supply chain. Alongside this sits a £90 million commitment to strengthen SME cyber defences and a £210 million Government Cyber Action Plan protecting public digital services. For CISOs, the pledge is a useful forcing function to get board-level cyber accountability formally documented.

• Executive Action: Enrol in the NCSC’s Early Warning Service if not already registered.
• Require Cyber Essentials certification as a condition of contract for critical suppliers.
• Present the pledge to the board as a governance commitment, not just a technical one.

How should CISOs report AI-driven cyber risk to the board?

With 43% of UK businesses already breached in the past year, the board’s question is no longer whether an attack will happen but how fast the organisation detects and contains it once AI-assisted attackers are involved. CISOs should report detection and containment speed as headline metrics, supported by evidence of Early Warning Service enrolment, Cyber Essentials coverage across suppliers, and patch velocity against internet-facing assets.

• Executive Action: Report mean time to detect and mean time to contain as standing board metrics, not just after an incident.
• Commission an AI-assisted attack simulation to stress-test current detection capability.
• Benchmark board-level cyber literacy using INFORMD’s executive self-assessment tools.

The gap between AI-accelerated attackers and human-speed defences is the single largest resilience risk UK organisations face this year. Waiting for the Cyber Security and Resilience Bill to receive Royal Assent before acting is not a viable strategy. For a structured resilience review, contact INFORMD.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.