The UK’s National Cyber Security Centre (NCSC) published its annual “Annual Review 2026” on November 3, warning that AI-enabled ransomware attacks are “highly likely” to target UK critical infrastructure within the next two years. While the underlying attack methods will not change dramatically, AI is expected to accelerate every stage—from reconnaissance and vulnerability discovery to the development of attack code—amplifying attackers’ capabilities.
NCSC Director Richard Horne pointed to a realistic possibility that the UK faces an unprecedented surge in cyber incidents. He explained that the cause is not the emergence of new malware, but rather that AI will let attackers discover and exploit long-neglected weaknesses at unprecedented scale. He also signaled that the era of “cheap technology” that sacrifices security is over.
The report positions it as nearly certain that AI will function as a “force multiplier” across the cyber threat landscape. Skilled attackers will be able to carry out the work needed for operations at greater scale, faster and more efficiently. At the same time, it analyzed that attackers’ adoption of AI varies, and that the biggest impact will come not from the emergence of new techniques but from the acceleration and expansion of existing methods. It took a skeptical view of fully autonomous attacks, saying human operators are likely to remain responsible for directing, verifying and correcting AI output.
For defenders, the report placed particular emphasis on AI-driven vulnerability discovery and attack-code development. AI models can now detect flaws in large codebases and previously undiscovered misconfigurations. While not all of these are immediately exploitable, system administrators and maintainers will likely be forced into a race to apply patches before attackers can prepare working exploit code.
The report also included a warning to cybercriminals. The use of AI is highly likely to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. Open-source AI tools built for security researchers could be repurposed by criminals to automate existing tasks, it said.
Ransom payment rate hits record low, median payment surges
Cryptocurrencies remain the dominant means of settling ransomware payments. Attackers demand payment in privacy coins such as Bitcoin (BTC) and Monero (XMR), moving funds across borders without going through the traditional banking network.
According to blockchain analytics firm Chainalysis, total on-chain confirmed ransomware payments fell 8% to $820 million in 2025. That was down from a revised $892 million in 2024, while reported attacks reached about 8,000, up 50%.
Metric20242025ChangeTotal on-chain payments$892 million$820 millionDown 8%Reported attacksAbout 5,300About 8,000Up 50%Share of victims who paid63.8%28%Record lowMedian paymentAbout $12,700About $59,556Up 368%
Note: Reported attacks for 2024 are a reference figure back-calculated from the 50% increase and the roughly 8,000 figure for 2025. The 2024 median payment is likewise a reference figure back-calculated from the increase rate.
The share of victims who paid fell from 63.8% to 28%, a record low. Meanwhile, the median payment among victims who did pay jumped 368% to about $59,556, suggesting attackers are narrowing their targets and demanding larger ransoms.
UK rolls out new budget and legislation to strengthen defenses
Alongside the warning, the UK government announced new spending. It will invest £60 million in the national Cyber Shield and £70 million in a national exposure real-time vulnerability center that detects weaknesses across critical infrastructure. It will also establish a new AI cyber security center of excellence in Manchester, operated by the NCSC.
Security Minister Dan Jarvis said government agencies are harnessing the power of AI to stay ahead of those seeking to do harm. The effort also includes the Cyber Security and Resilience Bill and a National Cyber Action Plan to be published soon, both positioned as measures to protect critical services from disruption.
On the cryptocurrency tracking front, law enforcement agencies are increasingly using blockchain analytics—Chainalysis signed a training agreement on crypto crime with South Korean police earlier this year, for example. Investigative authorities in various countries are strengthening coordination against the same kind of illicit fund flows that the NCSC is trying to get ahead of.
For market participants, the key point is that ransomware attack volumes are rising even as the payment rate falls. Even as attack attempts increase, the proportion of ransoms actually paid is declining, meaning direct capital inflows into the crypto market are becoming more limited. On the other hand, the sharp rise in the median payment suggests that the per-incident damage from targeted attacks is expanding. Companies operating critical infrastructure will likely need to rebuild patch management and human oversight systems suited to the AI era.
Click Here For The Original Source.
——————————————————–
