NCSC: AI accelerates existing tradecraft and creates new attack surface
On November 3, the National Cyber Security Centre published its State of the Cyber Nation report and CEO Richard Horne stated that it is highly likely that AI‑driven malware will be used in ransomware against critical national infrastructure before the end of 2028. The threat does not lie in AI discovering new vulnerabilities, but in it scaling the discovery and exploitation of technical debt tolerated for years. source.
The NCSC’s highly likely assessment is based on China and Russia routinely employing AI for geopolitical purposes in cyber operations. The complementary report argues that the short‑term risk is twofold: AI makes known tradecraft faster and broader, and by embedding itself in critical infrastructure itself, it generates new attack surface. Sectors with legacy OT are priority targets.
The UK government announced alongside the report sixty million pounds for the first phase of the national Cyber Shield, seventy million for a National Real‑Time Exposure and Vulnerability Centre, and an AI Cybersecurity Centre of Excellence in Manchester. These investments reflect that the response requires coordinated state capability, not just isolated and sustained organizational measures.
ANSSI: seven principles for securing agentic AI systems
On October 29, the Agence nationale de la sécurité des systèmes d’information published Les Essentiels Sécuriser un système IA agentique version 1.0, a two‑page fact sheet with seven operational principles. The starting point is clear: an authorized action can be harmful because the agent may make mistakes, be manipulated, or chain permitted operations with a prohibited and systemic effect. source.
The first principle requires independent deterministic authorization: an upstream filter for each tool, a policy immutable by the model, and verification of action chains. The second classifies actions into three categories — autonomous execution, mandatory human approval, prohibited action — and stipulates that critical operations always require a human approver. The third principle mandates that the approval mechanism reside outside the agentic system.
Principles four through seven complete the framework: untrusted inputs and outputs, secrets outside the model context, separate memories and external flows via controlled interfaces; emergency stop with access revocation and degraded mode without weakening controls; assume all data sent to a hosted model may be accessible to the provider; immutable audit with tamper‑proof logs, documented mission, annual review, human owner, and deployment blocked if unacceptable risk persists.
Convergence: when agentic AI operates on critical infrastructure
The cross‑synthesis reveals a common vector: AI scales the exploitation of technical debt in critical infrastructure per the NCSC, and agentic AI chains authorized actions with harmful effect per ANSSI. The joint priority action is to inventory agentic systems in OT and IT environments and perform threat modeling of action chains to anticipate critical abuse paths.
The shared key control deploys model‑independent policy enforcement points on every tool exposed to an agent: cyber hygiene and segmentation on one side, deterministic out‑of‑band authorization with critical human‑in‑the‑loop on the other. In governance, the UK Cyber Assessment Framework and the National Cyber Action Plan must align with GDPR Article 32 and EU AI Act Article 6 on high‑risk.
The ANSSI fact sheet serves as a concrete benchmark for demonstrating accountability to regulators and auditors. It impacts the supply chain: tender specifications must reflect security requirements derived from the agentic system risk analysis. A single registry of agentic systems with owner, criticality, action matrix, and annual review is needed to maintain continuous and permanently auditable traceability.
Practical implementation: guardrails, secrets, and immutable audit
Upstream deterministic authorization is implemented with a policy engine such as OPA or Cedar and an API gateway that validates action, params, and target before execution. It adds latency and requires an exhaustive catalog of tools and actions plus versioned policies to avoid uncontrolled drifts at runtime and ensure consistency across versions and continuous audit and automatic validation.
The classification of actions into three levels requires an action‑by‑criticality matrix reviewed by architecture and legal, and a human approval workflow based on Slack, Jira, or ITSM with timeout and escalation. It does not scale to thousands of trivial actions; only low‑risk actions are automated after rigorous threat modeling and continuous compliance monitoring and exhaustive documentation.
Secrets outside the context require Vault, AWS Secrets Manager, or Azure Key Vault plus a token broker that injects short‑lived credentials into the agent. Operational complexity is high: rotation and revocation must be automatic and audited, and immutable logs use append‑only storage with hash chaining and a SIEM with integrity alerts and legally defensible, continuous retention.
Applicable recommendations for technical leadership
Applicable recommendations for technical leadership: first, conduct an immediate inventory of agentic systems in OT and IT environments with an action and criticality matrix. Second, deploy model‑independent policy enforcement points on every tool exposed to an agent with default‑deny and human‑in‑the‑loop for critical operations. Third, establish a centralized kill switch with token revocation and network quarantine tested in quarterly chaos engineering exercises.
Fourth, enforce immutable append‑only logs with hash chaining and integrity alerts in the SIEM alongside legally defensible retention. Fifth, align governance with the Cyber Assessment Framework, GDPR Article 32, and EU AI Act Article 6; maintain a single register with an owner and annual review. Sixth, prioritize patching based on active exploitation according to CISA KEV and NCSC advisories, and enforce OT/IT segmentation with allow‑listing of remote management.
Conditions and limits: many OT systems do not support patching without downtime; Cyber Essentials does not stop nation‑state actors with zero‑days; behavioral detection requires tuning and continuous threat intel; human approval does not scale to thousands of trivial actions; secrets outside the context add operational complexity; hosted model providers may not offer private deployment; investment in guardrails and auditing incurs latency, storage, and specialized personnel costs.
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "NCSC and ANSSI: Agentic AI and Ransomware in Critical Infrastructure",
"summary": "NCSC warns: AI will scale ransomware in critical infrastructure before 2028; ANSSI defines seven principles to govern agentic systems with deterministic authorization and immutable audit.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-08T06:01:35.034+01:00",
"eventDate": "2026-11-03",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-08-am-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-08-am-es/"
},
"topics": [
"AI",
"Artificial Intelligence",
"Compliance and Regulations",
"Cybersecurity",
"Cybersecurity News",
"English",
"Malware",
"Supply Chain"
],
"sources": [
"https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years",
"https://universconvergents.com/2026/11/05/anssi-essentiels-securiser-systeme-ia-agentique"
]
}