AI is making cyber attacks faster: what the NCSC warning means for small UK businesses

What happened

On 3 November 2026 the National Cyber Security Centre (NCSC), the UK's cyber security agency, published its State of the Cyber Nation report. Its chief executive, Dr Richard Horne, warned that over the next two years criminals will use AI to make ransomware, scam messages and attacks on known weaknesses faster and larger in scale.

The headline was about hospitals, energy and other critical services. But one line in the report matters to every small business: AI does not invent new ways in. It helps attackers find and use the weaknesses that organisations have put up with for years.

Why it matters to a small business

Most attacks on small firms are not clever. They are a password reused from an old leak, a laptop that has not been updated for months, a website plugin nobody has touched since launch, or an email that looks like it came from a supplier. These used to take a criminal time to find one by one. AI tools now let them check thousands of businesses at once and write convincing emails in seconds, in perfect English and in your supplier's tone.

So the risk is not that you will be targeted by a genius. It is that the small gaps you meant to fix "one day" are now found automatically.

Six things to do this week

1. Turn on automatic updates for every laptop, phone and tablet used for work, and restart them so the updates actually install.
2. Switch on two-step login (a code on your phone as well as a password) for email, banking, your website host, your accounting software and social media accounts. Email comes first, because whoever controls your email can reset everything else.
3. Use a password manager so every account has its own long password. If one site is breached, the rest stay safe.
4. Back up the things you could not lose: client records, invoices, your website. Keep one copy that is not permanently connected to your computer, and test that you can restore it.
5. Agree a "call to check" rule for any email asking to change bank details or make an urgent payment. Ring the person on a number you already have, never the one in the email.
6. Look at Cyber Essentials. It is the government-backed scheme covering the basics: firewalls, secure settings, controlled access, malware protection and updates. The NCSC describes it as the starting point, not the finish line, and some clients and contracts already ask for it.

Your website is part of this

Small business websites are a common way in, because they are often built once and then left alone. A few quick checks:

• Updates: if your site runs on WordPress, the core, theme and every plugin should be up to date. Delete plugins you no longer use.
• Secure connection: your address should start with https and show no "Not secure" warning in the browser.
• Logins: the admin account should have a strong, unique password and two-step login, and old staff or developer accounts should be removed.
• Forms: contact and booking forms should block spam bots, and any personal details sent through them should go only to the people who need them.
• Hosting: ask your host whether they back up the site daily and how quickly they could restore it.

If you run a clinic or practice

Therapists, psychologists, dentists and physios hold sensitive personal and health information, which makes them attractive to criminals. Under UK GDPR you are responsible for keeping that data safe and for reporting serious breaches. The steps above, plus keeping client notes in a secure system rather than in email inboxes, cover most of the risk.

The bottom line

The NCSC's warning is not a reason to panic. It is a reason to close the easy gaps now, because AI makes those the first thing attackers find. Most of the list above costs nothing but an hour of your time.

If you are not sure whether your website is up to date and secure, run our quick website check or ask us to take a look.