AI is making old IT weaknesses easier to find

What has the NCSC warned about?

The National Cyber Security Centre published a new assessment on 3 November 2026 examining how artificial intelligence could affect cyber threats up to 2028.

It expects AI to increase the speed and scale of sophisticated attacks. This could include vulnerability discovery, social engineering, ransomware and attacks against older technology.

However, the NCSC describes its scenarios as plausible possibilities rather than firm predictions. The development of AI and its use in cyber attacks is moving quickly, so organisations should prepare without treating every headline as a confirmed future event.

NCSC: Artificial intelligence and cyber intrusion

NCSC warning about AI powered attacks

AI does not make basic security irrelevant

One of the most useful points in the NCSC warning is that AI has not suddenly invented a completely new route into every organisation.

Attackers can use AI to identify existing weaknesses more efficiently. A forgotten remote access service, an unpatched firewall, an unsupported server or an unused administrator account may therefore be discovered and exploited more quickly.

AI can also help criminals produce convincing messages, research employees and adapt phishing attempts. Staff may receive emails, Teams messages or telephone calls that sound more natural and contain accurate information about their organisation.

The response is not to panic. It is to remove the weaknesses attackers are looking for and make unusual activity easier to detect.

Check older systems and internet access

Unsupported technology deserves particular attention. A server, firewall, application or operating system can continue working long after suitable security updates have stopped.

Do not assume that a system is safe because nobody regularly logs into it. Forgotten systems can still contain information, passwords, network access or vulnerable software.

Keep a current list of the systems your organisation relies on and record who is responsible for each one. Our related guide explains how to identify public services and decide whether that access is still required.

• Computers, laptops and mobile devices
• Physical and virtual servers
• Firewalls, routers, wireless equipment and VPN services
• Cloud services and Microsoft 365 applications
• Websites, portals and remote access systems
• Specialist business or education software
• Supplier managed systems
• Devices that are directly accessible from the internet

Improve how quickly security updates are handled

The NCSC expects AI to accelerate vulnerability discovery. This could reduce the time between a weakness becoming known and attackers attempting to exploit it.

Routine monthly updates remain important, but some vulnerabilities require action before the next maintenance visit. Every organisation should know who receives security alerts, who decides whether an update is urgent, which supplier is responsible and how quickly a critical fix can be installed.

Where a critical system cannot be updated immediately, record the risk and consider temporary restrictions. This could include removing unnecessary internet access, limiting access to approved locations or taking a vulnerable service offline.

• Name the person who receives vendor and security alerts.
• Document who can approve an urgent change.
• Record how updates are tested and deployed.
• Confirm what happens when an application cannot be updated.
• Keep a working backup and a tested recovery plan.

NCSC assessment of AI enabled vulnerability discovery

Prepare staff for more convincing impersonation

AI generated phishing messages can contain fewer spelling mistakes and may imitate the language used by a manager, supplier or colleague. A convincing message should not bypass normal procedures.

Staff should know how to contact the real person or supplier through an independently verified number. Replying to the suspicious message is not a reliable check because the sender's account may have been compromised.

Technical controls can reduce risk, but an approved verification process is still essential.

• Verify requests to change bank details.
• Treat unexpected password or multifactor authentication prompts with caution.
• Confirm requests for confidential information through a separate channel.
• Check unusual file sharing invitations and messages claiming to come from IT support.
• Verify urgent requests from senior staff before acting.
• Do not grant remote access following an unexpected telephone call.

Make recovery part of the security plan

Preventing every attack is unrealistic. Organisations also need to know how they would continue operating and recover safely.

Backups should be protected from the accounts used for ordinary administration. Important information should be restored during controlled tests rather than relying only on successful backup notifications.

Businesses should consider finance, customer records, email, shared documents and specialist applications. Schools should also consider attendance, safeguarding, parent communications, door access and management information systems.

Keep recovery instructions, important contact details and the cyber response plan somewhere that remains accessible if Microsoft 365 or the main network is unavailable.

A practical thirty day checklist

The goal is not to purchase every new security product. It is to make the organisation's existing technology harder to exploit and easier to recover.

• Confirm who is responsible for cyber security decisions.
• Update the hardware, software and cloud service inventory.
• Identify unsupported systems and agree replacement plans.
• Review internet facing services and remove unnecessary access.
• Install outstanding critical security updates.
• Remove unused accounts and unnecessary administrator rights.
• Require suitable multifactor authentication for important accounts.
• Review how staff verify unusual requests.
• Check that backups are protected and test a controlled restoration.
• Confirm that security alerts reach someone who can act.
• Review supplier responsibilities and escalation contacts.
• Test the cyber response plan with a realistic scenario.

NCSC advice for small and medium sized organisations

How Bury I.T. Support can help

Bury I.T. Support Ltd can review devices, servers, Microsoft 365, firewalls, remote access, administrator accounts, security updates and backup arrangements.

We help businesses and schools identify the weaknesses that matter, agree realistic priorities and document who is responsible for correcting them. The review starts with the organisation's current systems and risks rather than recommending an AI security product simply because it is new.