NCSC Assessment: Evaluating the Impact of Artificial Intelligence on Cyber Threats

As the digital landscape continues to evolve, the intersection of artificial intelligence (AI) and cybersecurity emerges as a focal point for policymakers and security experts alike. The National Cyber Security Centre (NCSC) Assessment (NCSC-A) provides invaluable insights into the evolving cyber threat landscape, particularly concerning the potential impact of AI on cyber operations.

The recent Bletchley AI Safety Summit highlighted the potential of Artificial Intelligence (AI) for good, but also acknowledged the security risks it poses. This blog post explores the NCSC’s assessment on how AI will impact cyber threats in the UK over the next two years.

NCSC Assessment (NCSC-A) is the authoritative voice on the cyber threat to the UK. We fuse all-source information – classified intelligence, industry knowledge, academic material and open source – to provide independent key judgements that inform policy decision making and improve UK cyber security. We work closely with government, industry and international partners for expert input into our assessments.

Key Judgements

The NCSC Assessment outlines several key judgements regarding the role of AI in shaping cyber threats over the next two years:

• Increased Volume and Impact: AI will likely make cyber attacks more frequent and impactful.  AI will almost certainly amplify the volume and impact of cyber attacks, with threat actors leveraging AI capabilities to enhance their operations.
• Uneven Impact: The impact of AI on cybercrime will vary depending on the attacker’s skill level. Sophisticated state actors will benefit the most, while novice criminals will see a significant boost in their capabilities.
• Enhanced Capabilities: AI will likely uplift capabilities in reconnaissance, social engineering, and exfiltration, making cyber attacks more effective and harder to detect. AI’s ability to summarise data at pace will also highly likely enable threat actors to identify high-value assets for examination and exfiltration, enhancing the value and impact of cyber attacks over the next two years.
• Social Engineering Boost: AI is particularly adept at social engineering, making phishing attempts more convincing and boosting the success rate of such attacks.  Generative AI (GenAI) can already be used to enable convincing interaction with victims, including the creation of lure documents, without the translation, spelling and grammatical mistakes that often reveal phishing. This will highly likely increase over the next two years as models evolve and uptake increases.
• Ransomware on the Rise: The ease of crafting effective phishing emails with AI is likely to contribute to the global ransomware threat.
• Proliferation of AI: AI-enabled tools and capabilities are expected to become increasingly accessible, potentially leading to a commoditisation of cybercrime capability.
• AI’s Gradual Rise: While AI won’t revolutionize cybercrime by 2025, its capabilities will gradually improve over time.
• Defense Through AI: Fortunately, AI can also be used to enhance cyber defenses by improving detection and security measures.

Context

The assessment focuses on the near-term impact of AI on cyber operations, excluding considerations of the cybersecurity threat to AI tools themselves. It assumes no significant breakthrough in transformative AI during the assessment period, highlighting the need for ongoing vigilance in monitoring AI developments.

The NCSC Assessment Breakdown

The NCSC Assessment uses a “realistic possibility” yardstick to gauge the likelihood of various scenarios. Here’s a look at their key judgements:

• Highly Likely: There is a strong chance that AI will increase the volume and impact of cyberattacks.
• Almost Certain: Social engineering and phishing attacks will become more effective with AI.
• Realistic Possibility: AI-powered malware that bypasses security filters might be developed by highly skilled actors.

Who Benefits Most from AI

• Highly Capable State Actors: These actors have the resources and expertise to leverage AI for advanced cyberattacks.
• Less Skilled Criminals: AI tools will make it easier for them to carry out cyberattacks, particularly social engineering attempts.

Assessment

The NCSC Assessment highlights several critical aspects of AI’s influence on cyber threats:

1. Social Engineering: AI will primarily uplift capabilities in social engineering, enabling threat actors to craft convincing interactions with victims and enhance the effectiveness of phishing campaigns.
2. Ransomware Threat: Cybercriminals are leveraging AI to streamline various aspects of cyber operations, including reconnaissance, phishing, and coding, thereby contributing to the global ransomware threat.
3. Malware Development: While AI has the potential to enhance malware development and exploit efficiency, its current impact remains limited to existing threat actors with access to quality training data.
4. Cyber Resilience Challenges: The proliferation of AI poses challenges to cyber resilience, particularly in detecting and mitigating cyber threats, as AI-powered attacks become more sophisticated and difficult to discern.

Implications

The assessment underscores the need for proactive measures to address the evolving cyber threat landscape:

1. Investment in AI Security: Organizations must invest in AI-driven security solutions to enhance resilience against AI-enabled cyber threats and mitigate the risk of data breaches and cyber attacks.
2. Patching the Gap: AI-powered reconnaissance can quickly identify vulnerable systems, making it even more crucial to patch vulnerabilities promptly.
3. Collaboration and Information Sharing: International cooperation and information sharing are essential to stay abreast of emerging cyber threats and develop effective countermeasures against AI-driven attacks.
4. Cybersecurity Awareness and Training: Enhanced cybersecurity awareness and training programs are critical to equip individuals and organizations with the knowledge and skills needed to identify and respond to AI-powered cyber threats effectively.
5. Data Advantage: The effectiveness of AI in cyberattacks relies on the quality of training data. As successful attacks occur, the data pool grows, potentially leading to even more sophisticated attacks.

Conclusion

While AI presents new challenges, it’s important to remember it can also be a powerful tool for defense. The NCSC Assessment provides valuable insights into the complex interplay between AI and cybersecurity, highlighting the need for proactive measures to address emerging threats. By leveraging AI responsibly and collaboratively, stakeholders can enhance cyber resilience and safeguard against evolving cyber threats in an increasingly digital world.