NCSC Annual Review 2026 | Understanding the threat | The impact of AI on cyber threat | National Cyber Security Centre

The National Cyber Security Centre's 2026 annual review has reached for the phrase "highly likely", which in the intelligence trade means: we would not bet the biscuit tin on it, but please fund us accordingly. The finding is that cyber criminal adoption of AI will highly likely increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation. Note the wording. Not novelty, not strange new powers, not a machine dreaming up crimes nobody has attempted — scale and efficiency. The same crimes, in greater volume, cheaper per victim, with the tedious human labour automated out of the process. It is the least cinematic apocalypse ever drafted.

The genuinely charming item is the third one. Open-source AI tools built for security researchers are, per the review, "likely to be repurposed by criminals" — which is precisely what the ARTEX framework we wrote about a fortnight ago was already doing in the wild. The Centre has therefore formalised yesterday's incident as next year's forecast, which is either diligent horizon-scanning or a very well-spoken way of admitting that the free tooling went out of the door and nobody in the room was counting it as a supply-chain problem at the time. Everyone agreed the openness was a public good. Nobody agreed who gets the invoice.

Now observe what the review declines to do. Three named threat categories, one probability hedge, and not a single number in the published text to indicate how much bigger or how much faster. "Highly likely" is unfalsifiable by construction — if ransomware volumes double, the forecast was sound; if they merely tick upward, the forecast was sound; and if some plucky defender interrupts the whole thing, the word "likely" was there all along, doing the work. The tools were built for the good guys, given away free, and the criminal uptake is now written up as weather rather than as an own goal. Highly likely, then. Keep the backups offline and the incident-response number laminated to something.