Faster cyber attacks in the age of AI: where can patching and response time be cut?
The UK’s National Cyber Security Centre (NCSC) published its tenth Annual Review on 3 November 2026, covering September 2025 to August 2026. One of its central findings is that artificial intelligence is unlikely to change attackers’ goals; what it changes is how quickly, at what scale and how efficiently they reach them. NCSC – The impact of AI on cyber threat
In his foreword, NCSC CEO Richard Horne puts it this way: AI did not create the weaknesses, it revealed them – years of accumulated technical debt and a failure to implement basic protections. NCSC – Foreword by Richard Horne The engineering question follows directly: if attackers reach a flaw faster, where can we cut the time it takes to patch and to respond?
What exactly does the NCSC say?
The NCSC uses graded probability terms in its assessments (such as “almost certain” and “highly likely”), so its wording is worth quoting precisely. According to the review, it is almost certain that AI will act as a force multiplier across the threat landscape, speeding up reconnaissance, social engineering, vulnerability discovery and exploit development. The greatest impact will come from accelerating and scaling existing techniques rather than from new attack vectors.
It is highly likely that AI-assisted vulnerability discovery and exploit development will pose a significant threat, giving attackers a better chance to reach systems before their owners patch them. The NCSC expects defenders and maintainers to face a race to shorten patch deployment timelines before attackers can develop working exploits. The same chapter judges that criminal adoption of AI will highly likely increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation. NCSC – The impact of AI
Another chapter sets the timeframe: by 2028 it is highly likely that China, Russia and other states will routinely use AI in their cyber operations, and that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure. The review also presents a deliberately pessimistic 2028 scenario, stressing that it is not a prediction but an illustration of the consequences of inaction. NCSC – The cyber threat to the UK · NCSC – The age of autonomous attack
An important counterweight: according to the NCSC, human direction remains essential. Attackers are highly likely to use AI to speed up existing methods rather than run fully autonomous end-to-end attacks, with people directing, validating and adapting the AI’s output.
Most breaches still come through known flaws
During the period, the NCSC’s Incident Management team received 1,831 reports of cyber attacks. Of these, 337 required support and 80 were classed as nationally significant. Through the Early Warning service, the NCSC also notified 8,500 organisations of events indicating a suspected compromise. NCSC – Incident management
According to the review, most successful compromises still rely on familiar methods: known vulnerabilities in internet-facing systems, stolen credentials and social engineering. State-linked actors sometimes exploited previously unknown flaws, but many cases involved vulnerabilities for which patches existed but had not been deployed quickly enough. The team has begun to see AI tools in attacks, but none of the observed uses enabled a new class of attack.
The implication is that, for most organisations, the main risk is not an unknown attack invented by AI but the time between the publication of a known flaw and the installation of its fix. If AI narrows that window on the attacker’s side, defenders have to narrow it on theirs.
The path of a patch: where is time lost?
In May 2026, NCSC CTO Ollie Whitehouse warned that organisations must prepare for a “vulnerability patch wave”: because of AI-assisted vulnerability discovery, a large number of updates is expected across all severities, some of them critical. His recommendations also set an order: NCSC – Preparing for a vulnerability patch wave
- External attack surface first. Internet-facing systems come first, then work inwards to cloud and on-premises environments. Where capacity is limited, the external surface and critical security systems take priority.
- Automatic patching where possible. Hot patching without service disruption and automatic updates – including on embedded devices – should be enabled.
- Prioritisation where not. Processes and risk appetite must support frequent, large-scale updating; the SSVC (Stakeholder-Specific Vulnerability Categorization) decision tree can set the order.
- Replacement where no patch exists. End-of-life technology without support has to be replaced or brought back into support.
The NCSC’s guidance also warns that organisations often do not even know whether they run the affected software or appliance. Time is therefore frequently lost at the stage of establishing whether the organisation is affected, well before installation. NCSC – Responding to active exploitation
- Disclosure
- Exposure
- Prioritisation
- Deployment
- Verification
Asset inventory · automatic updates · supplier obligations across the chain
How many days is right? The NCSC timescales
The NCSC’s vulnerability management guidance follows an “update by default” principle: all updates should be installed as soon as possible, ideally automatically, regardless of severity. Safety-critical systems and operational technology (OT) may be exceptions. Alongside its business-as-usual timescales, the guidance sets shorter windows for when a flaw is already being actively exploited. NCSC – Update timescales · NCSC – Responding to active exploitation
| System or situation | Install within | Note |
|---|---|---|
| Internet-facing services and software | 5 days | Test environment or backup first, then (phased if needed) rollout. |
| Operating system and applications | 7 days | Automatic installation, phased rollout (for example 10 per cent of the estate per day), pause or roll back on issues. |
| Internal or air-gapped systems | 14 days | Test environment or backup first, then rollout. |
| Actively exploited flaw (CISA KEV), internet-accessible, automatable, allows total control | Immediately, within 24 hours | Plus an assured Cyber Incident Response (CIR) provider. |
| The same, but exploitation is not automatable | Within 48 hours | Plus an incident response provider. |
| The same, but the system is not internet-accessible | Within 72 hours | Plus an incident response provider. |
The review gives a government example to show that such timescales are achievable: under the UK Government Cyber Action Plan, the median time taken to fix domain-related vulnerabilities fell from 50 days to 8 days. NCSC – A moment of choice
Security systems need particular attention here. A video recorder, camera or access-control panel is often an embedded device where automatic updates are not always available and a firmware update needs testing and a maintenance window. According to the NCSC, where the risk of updating is too high, the system should be placed on an exception list, and the organisation must own the risk of not updating. In my article “A Camera Is a Computer Too – It Just Happens to Sit on a Pole” I used an NVR vulnerability advisory to show why the installed inventory has to be compared with the advisory’s exact model and firmware scope.
When patching is already too late: response time
Once exploitation of a critical flaw becomes automated, the NCSC says every hour without the update matters. Its guidance therefore recommends a rapid response pathway built into existing IT incident management. Security and IT operations should agree in advance that remediating an actively exploited flaw gets the same priority as a total system compromise (P1). The obligation to mitigate quickly should also be written into supplier contracts. NCSC – Responding to active exploitation
Alongside regular vulnerability scanning, non-traditional data sources are worth using, such as searching the email gateway for messages from the vendor, or perimeter proxy logs for connections to the vendor’s site. Shadow IT, developer environments and contractors’ machines also need checking.
If compromise is suspected, the NCSC’s generic priority actions are: assess the level of compromise, isolate the affected system where possible and replace it with a new, fully updated one – even at the cost of an outage – and then fully investigate for evidence of compromise, ideally with an assured incident response provider. NCSC – Priority actions under active exploitation
According to the review, defence will also become machine-assisted. AI agents may help investigate activity and correlate evidence, and in some cases take reversible action. This has to be introduced alongside rehearsed playbooks, reliable telemetry and clear authority to act within guardrails. NCSC – The changing nature of operational cyber defence
The EU and Hungarian frame
In the EU, vulnerability handling is also a legal requirement. Article 21(2)(e) of the NIS2 Directive – (EU) 2022/2555 – explicitly lists security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure, among the risk-management measures. Under Article 23(4), for a significant incident an early warning is due without undue delay and in any event within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. EUR-Lex – NIS2 Directive
In Hungary, Parliament adopted Act LXIX of 2024 on the cybersecurity of Hungary with regard to the EU directive. Section 66 sets reporting rules that depend on the type of organisation: some must report threats, near misses and incidents without delay, others the events causing serious disruption or significant damage, in both cases to the national cybersecurity incident response centre as set out in a government decree. Act LXIX of 2024 – National Legislation Database
On the manufacturers’ side, the reporting obligations of the EU Cyber Resilience Act (CRA) have applied since 11 September 2026. Manufacturers of products with digital elements must submit an early warning on actively exploited vulnerabilities within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure becomes available. European Commission – CRA reporting
NIS2 – significant incident
- 24 hours Early warning
- 72 hours Incident notification
- 1 month Final report after the notification
CRA – actively exploited vulnerability (manufacturer)
- 24 hours Early warning
- 72 hours Full notification
- 14 days Final report after a corrective measure is available
In my reading, all three rules rest on the same foundation: the organisation must be able to say within hours whether it is affected. That takes the same asset inventory and the same decision path as fast patching does. This is my own conclusion, not an official position; which obligations apply to a given organisation has to be determined from the scope of the legislation.
AI speeds up the defenders too
The review is not only about threats. In Project DROMOS, the UK government used frontier AI models to examine government code repositories. After a four-week pilot, the programme was extended to selected government environments, where it uncovered hundreds of potential security issues, including critical vulnerabilities. It also set up governance and procedures for human oversight and for handling false positives. NCSC – Project DROMOS
How a specialised model can support authorised vulnerability research, and why every finding needs expert validation, is something I covered in detail in GPT-6 Cyber: faster vulnerability discovery, greater responsibility.
In the end, the NCSC’s message is an engineering one: the tools for defending against AI-assisted attacks – an up-to-date asset inventory, update by default, a rapid response path, monitoring and rehearsed incident response – already exist, and the task is to implement them quickly and at scale. The question is whether an organisation gets from a published flaw to an installed fix in hours, days or weeks. That time is worth measuring now, before a patch wave measures it for us.
Sources: NCSC – The impact of AI on cyber threat · NCSC – The cyber threat to the UK · NCSC – The age of autonomous attack · NCSC – Incident management · NCSC – Foreword: Richard Horne · NCSC – A moment of choice · NCSC – The changing nature of operational cyber defence · NCSC – Project DROMOS · NCSC – Preparing for a vulnerability patch wave · NCSC – Policy to update by default · NCSC – Responding to active exploitation
Legal sources: NIS2 Directive – (EU) 2022/2555 · Act LXIX of 2024 (Hungary) · European Commission – CRA reporting
Last reviewed:
Questions, or an idea to talk through?
Whether it is a security system, the IT network behind it or just a thought on this article, I am happy to hear from you.
Get in touch
