AI-Powered Cyber Attacks: Why Crisis Preparedness Must Go Beyond Cyber Security

The National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in ransomware attacks against UK critical national infrastructure by 2028. The warning raises important questions about whether organisations are adequately prepared to manage the wider consequences of increasingly sophisticated cyber threats. 

The NCSC highlights how artificial intelligence could enable attackers to identify vulnerabilities, develop malicious capabilities and conduct attacks at greater speed and scale. 

For organisations responsible for essential services and critical infrastructure, the implications extend well beyond cyber security. 

When a Cyber Incident Becomes an Organisational Crisis 

A serious cyber attack can quickly escalate into a wider operational crisis, disrupting essential services, compromising sensitive information and affecting employees, customers and critical suppliers. 

The challenge becomes even greater when an incident involves multiple, interconnected threats. Cyber attacks may coincide with insider activity, physical security incidents, disinformation or disruption affecting third-party providers. 

Traditional crisis management arrangements, often designed around individual incidents or isolated system failures, may struggle to address these overlapping challenges. 

Organisations must therefore consider not only how they would contain and recover from a cyber attack, but also how they would maintain essential operations while managing the wider consequences. 

Are Existing Crisis Management Arrangements Fit for Purpose? 

The NCSC’s warning reinforces the importance of examining whether existing crisis management structures are sufficiently robust to respond to complex, fast-moving incidents. 

Boards and senior management should be asking: 

Are our crisis management arrangements integrated?

Can cyber security, physical security, operational management, communications and senior leadership work effectively together in a business-as-usual setting as well as during a major incident? 

Can we maintain critical services?

Have we identified the minimum operational capabilities needed to continue functioning during prolonged disruption? 

Do we understand our dependencies?

Could a compromised supplier, service provider or critical third party significantly affect our ability to respond? 

Have we tested our response realistically?

Do crisis exercises reflect simultaneous threats, incomplete information and difficult decisions under pressure? 

Is the board adequately prepared?

Are senior leaders clear about their responsibilities, escalation arrangements and the decisions they may need to make? 

These questions are particularly important for organisations operating critical infrastructure, where disruption can have consequences extending beyond the organisation itself. 

Building Resilience Against Complex Threats 

Effective crisis preparedness requires more than documented plans and technical recovery procedures. 

Organisations need clearly defined responsibilities, coordinated decision-making and the ability to maintain essential services when normal operating arrangements are disrupted. 

Realistic crisis exercises are also essential. Testing how different teams respond together can reveal weaknesses in communication, dependencies, leadership and operational resilience before a real incident occurs. 

The growing potential for AI-enabled cyber attacks makes this preparation increasingly important. 

How GSA Global Can Help 

GSA Global brings together expertise across crisis management, investigations, insider risk, cyber security and physical security to help organisations understand complex threats and strengthen their preparedness. 

Our specialists support organisations in assessing vulnerabilities, reviewing crisis management arrangements and developing practical approaches to managing serious incidents.