During a keynote address at the recent CYBERUK conference, Dr. Richard Horne the CEO of the UK’s National Cyber Security Centre (NCSC) said that the country is facing a perfect storm for cyber security as various forces come together.
Dr. Horne highlighted the conjunction of four key areas:
AI
“We know our adversaries will increasingly apply AI tooling,” said Dr. Horne. “As we have seen in the media in recent days, frontier AI is rapidly enabling discovery and exploitation of existing vulnerabilities at scale. Illustrating how quickly it will expose where fundamentals of cyber security are still to be addressed, such as code shipped by tech producers with significant vulnerabilities, organizations that are not patching with the completeness or urgency they should or that are failing to grasp the nettle of replacing old legacy systems.
“And while we may not yet be seeing significant new attacks as a result of AI, we know that our success as defenders will rely on us embracing AI for defence, at least as quickly as adversaries embrace it to attack.
“Then, we must ensure that the AI we rely on is secure. Using for example the newly-published international standard for AI security to enforce a much-needed global benchmark.”
Quantum
“We don’t know when a quantum computer will be able to break the widely used cryptography that we rely on in everything we do. But we do know it is in our gift, to be ready for that point,” said Dr. Horne.
Global context: political shift
“We are living through the most seismic geopolitical shift in modern history,” said Dr. Horne. “As Blaise Metreweli, the chief of MI6, said in December our world is more dangerous and contested now than it has been for decades. We are operating in a space between peace and war. And let’s be clear, cyberspace is part of that contest.”
Setting out the changing cyber threat landscape in this area, Dr. Horne commented: “I said in October [2025] that the NCSC is handling an average of four nationally significant incidents a week. Well, today those numbers remain fairly steady. But we see a change in where those attacks come from.”
“Criminal activity such as ransomware remains the most prevalent threat to the vast majority of organizations, but the majority of the nationally significant incidents that my teams are handling now originate directly or indirectly from nation states.
“We know that China’s intelligence and military agencies now display an eye-watering level of sophistication in their cyber operations. This, combined with their whole-of-state approach means we face more than just a capable cyber threat but a peer competitor in cyberspace.
“We know that Iran is almost certainly using cyber activity to support the repression of British individuals on our streets who are seen as a threat to the regime.
“And we know that Russia is taking the cyber lessons it has learnt in a theatre of war and is moving them beyond the battlefield. The tactics and techniques honed in conflict are now being directed at states it considers hostile.
“Working with our partners, including the National Protective Security Authority, we are seeing sustained Russian hybrid activity targeting assets across the UK and Europe. So we know we have a unique window to learn how cyber operations have been used in conflict situations and shore up our resilience at home.
Full-scale cyber warfare
Carrying on from the theme of geopolitical related threats Dr. Horne highlighted the worry that a future conflict would result in an actual cyber war.
“We can’t know over the next ten years whether the UK will be in a state of conflict, but we do know we must prepare for that eventuality,” said Dr. Horne. “And we do know from conflicts around the world this last year that cyber operations are now integral to conflict, as much a reality of modern warfare as drones and missiles.”
“[We also know] that, were we to be in, or near, a conflict situation, the UK would likely face hacktivist attacks at scale. With similar effects and sophistication to the ransomware attacks we see today but [with] no option to pay a ransom to help recover.”
