AI could become the new weapon against UK infrastructure

The National Cyber Security Centre’s warning that AI will amplify state and criminal attacks on the UK’s critical infrastructure is a wake‑up call for any organization handling sensitive data. By 2028, adversaries are expected to use AI to automate phishing, weaponise deep‑fakes, and fine‑tune malware, rather than discover brand‑new vulnerabilities.

This projection means defensive strategies must evolve from static signatures to adaptive, AI‑aware models. Companies should audit every point where AI could be leveraged by an attacker, from supply‑chain software to custom inference pipelines. Transparency about model behavior and rigorous testing become non‑negotiable.

In our own practice, we insist on explicit consent before any model processes customer data, and we keep the model lifecycle fully auditable. Those principles are not just ethical niceties; they are defensive measures that limit the attack surface. If an attacker cannot feed undocumented data into a model, the risk vector shrinks dramatically.

Policymakers and operators alike need to treat AI as a dual‑use technology—capable of both productivity gains and heightened threat vectors. Robust governance, clear licensing, and continuous monitoring are the only ways to stay ahead of the curve. — Edgar Melo Costa, founder

Founder’s notes are opinion. They are not investment, legal or professional advice.