AI is helping businesses move faster, but attackers have access to the same advantages. As the cyber threat landscape accelerates, organisations need to look at whether their security, response and recovery capabilities can keep up.
Artificial intelligence is dominating business conversations right now. Organisations are exploring Copilot, automation, AI agents and new ways to improve productivity, while leadership teams are under growing pressure to turn that investment into something tangible.
At the same time, AI is changing the cyber threat businesses face.
The NCSC Annual Review 2026 gives a fairly stark assessment. The National Cyber Security Centre says it is “almost certain AI will act as a force multiplier across the cyber threat landscape”, helping skilled attackers operate with greater speed, scale and efficiency.
That matters because many of the security processes organisations rely on today were designed for a threat landscape that moved more slowly.
As AI speeds up vulnerability discovery, exploit development and other stages of an attack, the amount of time defenders have to react is getting smaller.
AI is changing the speed of cyber attacks
The NCSC expects AI to accelerate existing attack methods rather than suddenly create an entirely new generation of cyber threats.
Its assessment points to AI already enhancing reconnaissance, social engineering, vulnerability discovery and exploit development. Skilled attackers stand to gain the most because AI can help them streamline work that previously required considerably more time and manual effort.
For businesses, vulnerability management is an obvious area where this matters.
The NCSC warns that AI-assisted vulnerability discovery and exploit development are highly likely to give attackers greater opportunities to target systems before organisations can patch them. It describes an emerging race to shorten patch deployment times as more vulnerabilities are discovered and attackers become faster at developing working exploits.
This closely reflects the concern Richard Kuczma has previously raised internally at Wanstor: that AI is compressing the time between vulnerability disclosure and exploitation, increasing the importance of how quickly organisations can get a fix safely into production.
And recent incidents show just how quickly those vulnerabilities can start to matter.
PHP2Shell shows how quickly the window can close
In October, two critical remote code execution vulnerabilities known collectively as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, were confirmed as successfully exploited in the wild.
The PHP security team released patches on 21 October. However, security researchers had already observed attackers targeting the vulnerabilities four days before those patches were available.
PHP is also far from niche; rhe reporting cites estimates that PHP is used by roughly 70% of websites, with more than 5.1 million PHP hosts exposed online.
For IT teams, incidents like PHP2Shell put the focus firmly on response time.
Finding vulnerabilities is one part of the job. Knowing which ones create the greatest exposure, prioritising remediation and being able to act quickly are becoming increasingly important as the time available to defenders shrinks.
Cyber attacks are becoming an operational problem
There is another part of cyber resilience that businesses sometimes underestimate: what happens when an attack moves beyond IT systems and starts affecting normal operations.
We have just seen a very physical example.
On 2 November, more than 115 supermarkets and stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia were reported to have experienced disruption to refrigeration systems following a cyber attack. Attackers remotely changed temperatures, shut down refrigeration units and activated defrost cycles. In some cases, stores lost stock and had to intervene urgently to keep operating.
One affected store reportedly had its temperature settings changed to +50°C, while other businesses used refrigerated trucks in an attempt to protect stock.
It is a useful reminder of what cyber security ultimately protects.
The consequences of an attack can reach far beyond an inaccessible laptop or a suspicious email. They can interrupt services, affect customers, damage physical assets, disrupt supply chains and stop people from doing their jobs.
For leadership teams, the question therefore needs to include what happens after an attacker gets through.
How quickly could you detect the issue? Who would take ownership? Could you contain it? How long would recovery take? And how much of the business could continue operating in the meantime?
The gap between resilient and vulnerable organisations could grow
One of the most important warnings in the NCSC Annual Review 2026 is that AI could widen the cyber security divide between organisations.
The NCSC expects businesses with mature cyber security programmes, sufficient resources and robust AI governance to improve their ability to detect threats, prioritise vulnerabilities and automate defensive activity.
Organisations with weaker security, legacy technology and fewer resources may find it much harder to keep up with the increasing speed of AI-assisted attacks. The NCSC warns that those businesses could then become increasingly attractive targets.
That makes cyber resilience an important part of any serious AI strategy.
If an organisation is investing heavily in AI to improve productivity and transform the way people work, its security capabilities need to develop alongside it.
That includes knowing where your biggest exposures are, improving patching and vulnerability management, strengthening identity controls, monitoring the environment effectively and having clear processes for responding when something goes wrong.
Wanstor’s existing security approach reflects those priorities, covering exposure visibility, Microsoft Entra ID and Conditional Access for identity, Microsoft Defender XDR and Microsoft Sentinel for detection and response, and clear recovery capabilities.
What should businesses be doing now?
The changing threat landscape does not mean organisations should slow down their AI plans. It does mean cyber security deserves a place in those conversations from the beginning.
A few questions are worth asking now:
How quickly are you patching critical vulnerabilities?
If your current process takes weeks or months, consider whether that remains appropriate as exploitation timelines shorten. Understand which vulnerabilities present the greatest risk and make sure critical remediation can be prioritised quickly.
Do you know where your biggest exposures are?
Effective vulnerability management depends on visibility. You need a clear picture of your assets, vulnerabilities and risk before you can make informed decisions about what to fix first.
Could you detect and contain an attack quickly?
Security tooling alone doesn’t guarantee a fast response. Make sure alerts are monitored, responsibilities are clear and people know what needs to happen when a genuine incident is identified.
Have you tested your recovery plans?
A recovery plan sitting in a document is very different from one that has actually been tested. Understand which systems the business depends on, how quickly they could be restored and what the organisation would do while recovery takes place.
Is AI part of your cyber security strategy?
Consider how AI changes both sides of the equation. Attackers are already finding ways to use it, while defenders can also use AI to analyse threats, prioritise vulnerabilities and automate parts of their response.
The NCSC expects that difference in defensive capability to become increasingly significant.
Cyber resilience needs to keep pace
AI adoption is accelerating quickly, and there is good reason for businesses to be excited about what it can offer.
The security conversation needs to move at the same pace.
Recent incidents show how quickly vulnerabilities can become exploitable and how easily cyber attacks can affect real-world operations. Meanwhile, the NCSC expects AI to make existing attack methods faster and more scalable. For businesses, that makes the ability to detect, respond and recover increasingly important.
No one will care how successful an AI strategy is if a cyber attack takes the business offline for days, weeks or months.
Before pushing ahead with the next stage of AI adoption, take the time to understand whether your cyber resilience is ready to support it.
FAQs
How is AI changing cyber security threats?
The NCSC expects AI to increase the speed, scale and efficiency of cyber attacks. It is already helping with activities including reconnaissance, social engineering, vulnerability discovery and exploit development.
Is AI creating completely new types of cyber attacks?
The NCSC expects the biggest near-term impact to come from accelerating and scaling existing attack techniques rather than creating entirely new attack vectors. Human operators are also expected to remain important in directing and validating AI-assisted attacks.
Why does AI make vulnerability management more important?
AI can help skilled attackers identify vulnerabilities and develop exploits more quickly. The NCSC therefore expects organisations to face growing pressure to reduce patch deployment times before attackers can exploit newly discovered weaknesses.
What is cyber resilience?
Cyber resilience is an organisation’s ability to prepare for, respond to and recover from cyber incidents while limiting disruption to the business. That includes preventative security alongside detection, incident response, business continuity and recovery.
How can businesses improve their cyber resilience?
Start with visibility into your current exposure. Critical areas include vulnerability and patch management, identity and access controls, threat detection, incident response and tested recovery processes. At Wanstor, these areas are supported through capabilities including threat and vulnerability management, Microsoft Entra ID, Microsoft Defender XDR, Microsoft Sentinel and managed detection and response.