Britain’s cyber security authorities have warned that artificial intelligence is accelerating the capabilities of hostile actors, raising new questions about corporate resilience, executive accountability and the ability of organisations to communicate during a major disruption.
The rapid development of artificial intelligence is changing the economics of cybercrime. Attacks that once required specialist expertise, extensive preparation and considerable resources are becoming easier to organise, adapt and execute. For businesses, the implications extend well beyond information technology departments.
A new assessment published on 3 November by Britain’s National Cyber Security Centre warns that AI-powered malware is highly likely to have been used in a ransomware attack against UK critical national infrastructure by 2028.
The assessment identifies Russia, China and other state actors as increasingly likely to incorporate artificial intelligence into cyber operations, improving the speed and scale of attacks against government systems, commercial organisations and essential services.
Its message to business leaders is clear: the ability to withstand a cyberattack can no longer be measured solely by whether an organisation has installed the appropriate security technology.
A faster and less predictable threat
Artificial intelligence is not necessarily creating entirely new categories of cyberattack. Instead, it is allowing existing methods to operate more efficiently.
Attackers can use AI to identify software vulnerabilities, generate convincing fraudulent communications, analyse stolen information and accelerate the exploitation of weaknesses in corporate systems.
According to the NCSC, longstanding vulnerabilities in ageing infrastructure are particularly concerning. Systems that have remained operational for years without substantial modernisation may become increasingly attractive targets as automated tools make identifying weaknesses cheaper and faster.
This creates an important asymmetry.
While companies must protect extensive networks, numerous applications and potentially thousands of employees, attackers need to discover only one sufficiently exploitable weakness.
For organisations operating across multiple countries, fragmented technology systems and inconsistent security procedures increase the complexity of maintaining effective protection.
The growing integration of AI into corporate processes introduces another difficulty: technologies adopted to improve operational efficiency may themselves create new routes for unauthorised access.
Cybersecurity becomes a boardroom responsibility
For many organisations, the most consequential effect of an attack is not the initial intrusion but the disruption that follows.
Production may stop, customer services may become unavailable, payment systems may fail and confidential information may be compromised.
The resulting financial damage can be accompanied by contractual disputes, regulatory investigations and reputational consequences.
These risks require corporate leadership to consider cybersecurity as an enterprise-wide resilience issue.
A company might maintain technically sophisticated security systems while remaining poorly prepared to explain a disruption to customers, employees, regulators or investors.
The resulting communication failures can intensify an operational crisis.
An incomplete initial statement may create uncertainty about the extent of an incident. Contradictory information from different departments can undermine confidence in management. Delayed communication can leave employees and commercial partners relying on speculation.
The central problem is that technical incident response and corporate communications frequently operate according to different procedures and priorities.
Effective crisis management requires them to function together.
The first hours determine the response
During a serious cyber incident, businesses face competing demands.
Technical specialists need time to establish what happened, contain affected systems and determine whether sensitive information has been accessed.
Meanwhile, customers and employees need immediate information about interrupted services and potential risks.
Management must communicate without making claims that subsequent forensic investigations may contradict.
This requires a pre-established framework defining who can authorise public statements, which information can be disclosed and how updates will reach different audiences.
Alternative communication channels are particularly important. If an organisation’s email, website or internal messaging systems become unavailable, its emergency communications must remain functional.
Companies should also distinguish confirmed facts from working assumptions, communicate what actions they are taking and establish when further information will be provided.
The objective is not to eliminate uncertainty but to manage it accurately.
Preparing for a crisis that has not yet occurred
The NCSC assessment does not suggest that every business will experience an AI-enabled cyberattack by 2028. Its scenarios describe plausible developments and their associated probabilities, rather than predicting individual incidents.
Nevertheless, the projected acceleration of cyber threats has practical consequences for corporate planning.
Organisations need to examine whether their incident-response arrangements reflect the speed at which attacks could develop.
Exercises should involve not only IT and security personnel but also communications teams, senior executives, legal advisers, human resources and operational managers.
A simulation involving a ransomware attack on a major supplier, for example, would test both technical continuity and the company’s ability to explain potential service disruption.
Communications planning must also account for increasingly sophisticated impersonation, including fraudulent executive messages, manipulated recordings and synthetic content.
The credibility of an organisation’s official communication channels therefore becomes a security consideration in its own right.
Resilience requires more than technology
Investment in cybersecurity remains essential, particularly where organisations depend on outdated infrastructure.
However, technology alone cannot determine how a company responds when systems fail.
The businesses best positioned to manage future incidents will be those that integrate cyber defence, operational continuity and crisis communications into a coherent management structure.
This involves clear accountability, regularly tested procedures and the ability to communicate accurately under considerable pressure.
As artificial intelligence increases the speed at which cyber incidents can develop, the time available for corporate decision-making may narrow.
For executive teams, the priority is therefore not simply preventing every conceivable attack. It is ensuring that when a serious incident occurs, the organisation can protect essential operations, make informed decisions and maintain credible communication throughout the crisis.
