Overview
The UK’s National Cyber Security Centre (NCSC) has published a formal intelligence assessment titled Artificial Intelligence and Cyber Intrusion, examining how AI is currently being leveraged by threat actors to conduct cyber intrusions and projecting how this threat will evolve through to 2028. The assessment is produced by NCSC Assessment (NCSC-A), which integrates classified intelligence, industry knowledge, academic research, and open-source material to deliver authoritative, policy-informing judgements.
Rather than making firm predictions, the report presents three plausible scenarios intended to illuminate potential trajectories of AI-driven cyber threats and support the development of proactive security strategies. The use of PHIA (Professional Heads of Intelligence Assessment) probabilistic language ensures analytical rigour and transparency in how confidence levels are communicated.
Technical Analysis
While the full technical content of the report is not reproduced in the available article text, the NCSC’s framing indicates a focus on AI as an intrusion enabler — accelerating the speed, scale, and sophistication of attacks rather than representing a categorically new attack class. Key threat dimensions likely addressed include:
- AI-assisted reconnaissance and target selection, enabling adversaries to process large datasets to identify vulnerabilities faster than human analysts.
- AI-generated social engineering content, including spear-phishing and deepfake-assisted impersonation, lowering the skill barrier for effective intrusion.
- AI-augmented exploitation tooling, where models assist in vulnerability discovery and payload crafting.
- Lowered entry barriers for less sophisticated actors, as commercial AI tools provide capabilities previously limited to advanced threat groups.
The three scenarios serve as structured analytical frameworks rather than forecasts, reflecting uncertainty in how AI adoption curves, defensive adaptations, and geopolitical factors will interact through 2028.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): Adversaries exploiting commercially available AI tools to conduct intrusions.
- AML.T0088 (Generate Deepfakes): AI-generated content used in social engineering campaigns.
- AML.T0043 (Craft Adversarial Data): AI assistance in crafting inputs designed to evade detection systems.
- AML.T0015 (Evade AI Model): Threat actors adapting techniques to bypass AI-powered defensive tooling.
- LLM09 (Overreliance): Defender risk of over-trusting AI-generated security assessments without human verification.
- LLM05 (Supply Chain Vulnerabilities): AI tooling integrated into enterprise workflows introducing new attack surfaces.
Impact Assessment
The assessment is relevant to a broad set of UK stakeholders, including government departments, critical national infrastructure operators, large enterprises, and SMEs increasingly adopting AI-integrated tools. The 2028 horizon is significant — organisations that do not adapt defensive postures now risk being materially unprepared as AI-enabled threat actor capabilities mature. Nation-state actors and sophisticated cybercriminal groups are assessed as the primary threat actors most capable of operationalising AI at scale in the near term.
Mitigation & Recommendations
- Scenario-plan against the NCSC’s three projected trajectories to stress-test current security architectures against plausible AI-enabled intrusion models.
- Invest in AI-aware detection capabilities that account for AI-generated phishing, synthetic media, and automated exploitation attempts.
- Adopt human-in-the-loop validation for AI-assisted security tooling to mitigate overreliance risks.
- Engage with NCSC’s Cyber Essentials and Active Cyber Defence services to baseline and continuously improve organisational resilience.
- Monitor NCSC advisories and PHIA-aligned assessments for updated intelligence as the threat landscape evolves toward 2028.