What to do
How to defend against AI-assisted attacks
There is no separate fix. The agencies' advice is to get the foundations right and to do them faster: know what you expose, patch promptly, verify requests, limit your AI tools and prepare for a breach.
Last reviewed against NCSC (UK), NCSC New Zealand and UK Government (DSIT and Home Office). Sources
The principle
Foundations, done faster
The Five Eyes statement asks leaders to prioritise foundational cyber security practices and controls, and says success will not come from buying more tools alone [3]. That fits the NCSC's judgement that AI mostly improves existing attack methods [1]. The change is tempo, so tasks that once tolerated a slow cycle, such as patching, now need a shorter one.
In order
A sequence for the next quarter
Work through these in order. The list below gives the plan; the action cards show the detail.
-
1
Build an inventory of systems and mark those reachable from the internet [4]. -
2
Remove public access that is not needed, and add controls where it is [4]. -
3
Set a patching process with prioritisation and a route for urgent updates [4]. -
4
Agree a second-channel check for payments and access changes [7]. -
5
Review each AI tool for the data it reads and the actions it can take [2]. -
6
Test your incident response plan against a scenario involving impersonation and a fast exploit [4].
What does not work
Be careful with claims
The NCSC advises treating with scepticism any vendor that claims to stop prompt injection, and looking for tools that reduce it instead [2]. It also warns against deny-lists of known bad phrases, because attackers can rephrase endlessly [2].
Residual risk
The NCSC says prompt injection cannot be fully mitigated with a product or appliance, and that it must be managed through design, build and operation [2].
Using AI to defend
Keep it contained
The NCSC guidance supports using AI for vulnerability discovery with limits: restrict its access and permissions, run it in a test environment or sandbox under a least-privilege account, and keep skilled people to validate findings [4]. Check how any AI-as-a-service vendor handles your source code and sensitive data [4].
More detail: deepfake fraud, AI and vulnerability discovery and securing your own AI tools.
What to do
Seven steps, in order
-
Step 1
List what you expose to the internet[4]
Identify every system you run and which of them can be reached from the internet. Ask whether each exposed system needs to be public, and add compensating controls where it does.
Who: IT and security teams
-
Step 2
Patch frequently and promptly[4]
Run a vulnerability process that covers identification, prioritisation, validation, remediation and reporting. Agree with suppliers how quickly you can apply their security updates.
Who: IT and security teams
-
Step 3
Verify money and access requests another way[7]
A convincing video call is not proof of identity. Require payment changes and access requests to be confirmed through a separate, known channel before anyone acts.
Who: Finance, HR and service desk teams
-
Step 4
Limit what your AI tools can do[2]
Assume an LLM can be confused by the content it reads. Use deterministic safeguards outside the LLM to restrict the tools and data it can reach, and keep untrusted content away from privileged tools.
Who: Developers and system owners
-
Step 5
Log AI tool use[2]
Record LLM inputs and outputs, tool use and API calls so you can spot unusual behaviour. Failed tool calls can show an attacker's early attempts.
Who: Security operations
-
Step 6
Plan for a breach and test the plan[4]
Adopt an assume-compromise mindset with defence in depth, monitoring and a tested incident response plan, as the NCSC guidance advises.
Who: Security leads and executives
-
Step 7
Put AI risk on the board agenda[3]
The Five Eyes agencies ask leaders to understand and assess risk, readiness and accountability, to prioritise foundational controls and to give cyber leaders authority and resources.
Who: Directors and executives
Keep reading
Read next
Timeline
A dated, sourced timeline of AI-related cyber attack cases and UK and Five Eyes guidance, from the Arup deepfake fraud to the 2026 call to action.
Read the guide
Questions
Sourced answers to common questions on AI cyber attacks: deepfakes, phishing, faster exploitation, prompt injection and what UK organisations should do.
Read the guide
Deepfake fraud
How a deepfake video call cost Arup HK$200m, why staff were convinced, and the checks UK finance and service desk teams can put in place.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
AI makes it quicker to find and use weak points, so it helps to find them first. A penetration test shows which of your internet-facing systems, staff processes and AI tools an attacker could actually use.