AI didn't break UK cyber. It switched the lights on.

By Krystian Heald, Clarity's Growth & Strategic Partnerships Director, specialising in trade body organisations in key sectors across cybersecurity, health, and telecommunications. Krystian also acts as head of the Cybersecurity Business Network. 

The NCSC turned ten this year and rather than celebrate quietly, it used its Annual Review to state that UK cyber resilience is not where it should be. Perhaps more alarmingly, the threat is growing faster than our defences can manage.

Some may blame AI for this challenge, but the NCSC was clear that AI did not create our weaknesses, it revealed them. Years of deferred upgrades, unpatched systems and job items pushed down the timeline are now being found and exploited at machine speed. It asks that industry and Government take action to proactively tackle these threats head on.

Bringing together leaders from across Cyber, AI, Government & CNI, CBN is hosting Parliament & Cyber on Tuesday 1 December in Westminster, to discuss how we tackle these challenges and address frontier AI security.

What this means for UK cyber

First, the basics still decide most outcomes. 88% of incidents at large organisations came through four familiar routes: exposed applications, phishing, compromised accounts and remote services. Attackers mostly get in because the door was left open.

Second, cyber is now an economic story. Malicious cyber activity costs the UK an estimated £14.7 billion a year, roughly the size of the UK cyber security sector itself. The attack on JLR alone had an economic impact of £2.1bn and contributed to UK growth of just 0.1% in Q3 2025.

Resilience is growth policy, and whether or not the Government takes that view, I would argue it is fundamental.

Third, the NCSC warns of a growing divide between organisations able to use AI for defence and those that cannot. The resilient are getting safer, and everyone else is becoming a more attractive target.

Where the opportunity is

The encouraging part of all this is that defenders still hold the structural advantage. We own our environments, we can monitor them and we can change them. But the question is whether we use that advantage quickly enough.

Government is building the framework. The Cyber Security and Resilience Bill, the forthcoming National Cyber Action Plan, the National Detect Strategy and Cyber Shield all point towards continuous, AI-assisted defence at national scale.

Cyber Shield deserves the closest attention. The NCSC will provide the core platform, the defensive agents will be built by the market, and DCMS will co-design the protocols and standards with industry. That is an open invitation to help write the rules for how AI defends the country, and a real opening for UK vendors to build sovereign capability.

Why engagement matters now

The policy shaped over the next eighteen months will set expectations for a decade.

Organisations that engage early gain influence over the standards they will later have to meet, early sight of where demand is heading, and credibility with the departments, regulators and buyers making those decisions. Those that wait will inherit frameworks designed around somebody else's priorities, which is usually the more expensive option.

There is a commercial case too. The number of NCSC-assured consultancy providers has risen by 78%, and buyers across supply chains, critical infrastructure and defence increasingly want evidence of resilience before they sign. Investing in it is becoming how suppliers win work.

A moment of choice

The NCSC calls this a moment of choice, and it is right.

It has set out the problem and has built some of the tools needed. What comes next is a serious conversation between the people who can act on it: senior leaders from cyber companies, critical infrastructure operators and the organisations they protect, alongside ministers, parliamentarians, officials and regulators. Too often these groups discuss the same issues in separate rooms and only meet at consultation stage, when most of the thinking is done. Bringing them together early means policy is tested against how organisations really operate, and industry hears directly what government needs from it.

At Clarity & CBN we will keep putting cyber companies, policymakers and parliamentarians in the same room, helping organisations make their case where decisions are made. If you have a view on how the UK should defend itself in an AI world, join us on 1 December and bring it with you. The NCSC has said the quiet part out loud. The rest of us should take the hint.