Ransomware and Autonomous AI Hacking

Ransomware (malicious software that denies access to devices or data, usually through encryption) illustrates how organised cybercrime can turn technical access into business leverage. AI describes computer systems performing tasks that usually require human intelligence. AI is extending that challenge through automated reconnaissance (information gathering about potential targets), personalised phishing (deceptive communications intended to obtain information, money or access) and support for extortion operations, while reducing the expertise required for some tasks. The leadership issue now reaches beyond ransomware: organisations must consider both adversaries using AI agents(systems that use tools to pursue tasks without continuous human intervention) and their own agents misusing legitimate authority.

Ransomware and data extortion are described in Cybersecurity and Infrastructure Security Agency et al. (2023); assessed AI contributions to intrusion tasks in National Cyber Security Centre (NCSC, 2025a); and risks from agents’ delegated access in NCSC (2026d). The leadership framing is the article’s synthesis of that evidence.

The latest official picture makes the distinction between activity and capability especially important. The NCSC Annual Review 2026 covers 1 September 2025 to 31 August 2026. Its Incident Management Team received 1,831 attack reports; 337 incidents required support, of which 80 were nationally significant. These are measures of the NCSC’s reported workload, not the total number of UK attacks or an organisation’s breach probability. The review warns against simple year-on-year interpretations and identifies known vulnerabilities, stolen credentials and social engineering as continuing routes to compromise (NCSC, 2026c). The boardroom implication is practical: faster adversaries increase the urgency of fixing familiar weaknesses and demonstrating recovery capability.

Evidence and interpretation: linked author–date citations identify the sources supporting each substantive paragraph. Provider investigations are attributed reports, not independent estimates of prevalence; capability evaluations are not breach probabilities. Recommendations draw on official operational guidance, research and consensus frameworks. Where this article proposes a particular sequence, dashboard or scenario, it is identified as an application of those sources rather than a research-validated prescription. The National Institute of Standards and Technology (NIST)’s Cybersecurity Framework 2.0 and the UK government’s Cyber Governance Code of Practice underpin the leadership recommendations (NIST, 2024; Department for Science, Innovation and Technology et al., 2025).

Ransomware remains part of this story, but no longer defines its full scope. Anthropic’s reported espionage operation illustrates agent-assisted intrusion without a ransomware objective, while NCSC guidance identifies the risk of agents performing unintended actions through legitimate access. This article therefore examines both sides: AI used against the enterprise and enterprise AI turned into an unintended route to harm. The common issue is how authority, information and operational dependency are controlled (Anthropic, 2025a; NCSC, 2026d).

A breach is possible, but should not be treated as inevitable for every organisation. Prevention remains essential alongside containment and recovery, consistent with the cybersecurity outcomes framework. Leaders should ask three connected questions: what can an adversary reach, what can an authorised agent do, and what happens when either crosses an intended boundary? These are the article’s practical application of risk governance and proportionate agent controls. Cyber resilience, the ability to prepare for, respond to and recover from cyber attacks and security breaches, requires leadership decisions about acceptable disruption, delegated authority and accountability as well as engineering controls (NIST, 2024; Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d).

AI adoption is material but uneven. The Office for National Statistics (ONS) reported that around 30% of businesses in its survey population used at least one AI technology in September 2026, rising to 51% among businesses with 250 or more employees. These are reported-use measures, not the proportion deploying autonomous agents or considering adoption. The release classifies the findings as official statistics in development and advises caution (Office for National Statistics, 2026a). The distinction matters: general AI uptake does not reveal how much authority organisations have delegated.

AI can reduce the expertise or effort needed for selected tasks, including social engineering (manipulating people into disclosing information or taking an action), malicious software (malware) generation and reconnaissance. The NCSC assesses that this assistance varies with actors’ skills and resources. It does not establish that specialist judgement is unnecessary across an entire operation: tools, access and reliability remain important qualifications (NCSC, 2025a; Anthropic, 2025b).

The familiar claim that defenders must secure everything while attackers need only one weakness is an unhelpful planning rule. Operational guidance instead recommends layered protections, including identity controls, network segmentation (dividing networks into smaller parts with controlled connections) and incident containment. These create opportunities to interrupt an intrusion rather than assume permanent defensive disadvantage. The board should assess how investments change likely business consequences, using risk-based outcomes rather than that slogan (Cybersecurity and Infrastructure Security Agency et al., 2023; NIST, 2024).

The change is not simply better text generation. Anthropic’s September 2026 investigation describes selected cases in which adversaries used AI across cyber operations and assesses their gains in speed, scale and depth. It explicitly warns that these are notable cases, not typical misuse. The NCSC’s November assessment also expects faster and more scalable operations, but says adoption remains uneven and skilled operators gain the greatest benefit. Together, these accounts support planning for more activity without assuming either a universal productivity gain or the disappearance of human expertise (Anthropic, 2026; NCSC, 2026b).

The possibility of delegating repeated work builds on an existing feature of ransomware: specialised services and a division of labour documented in law-enforcement analysis. Understanding that ecosystem helps distinguish what AI changes from what was already established (Europol, 2023).

Law-enforcement analysis describes increasingly professionalised ransomware groups and established affiliate business models (Europol, 2023).

Organised ransomware operations can combine differentiated roles, affiliate programmes, support functions and revenue-sharing arrangements. These features resemble commercial service businesses, but the comparison explains a division of labour rather than establishing that all operators share one structure or that individual attackers have disappeared (Europol, 2023).

Ransomware-as-a-Service (RaaS), a business model in which developers supply ransomware to other criminals, supports this division of labour. Specialist participants may focus on obtaining initial access, developing malware or negotiating payments; associated illicit financial services can support the laundering of cryptocurrency (digital assets secured using cryptography). This arrangement can distribute tasks and enable operations without establishing that every participant works exclusively in one role or faces less risk (Europol, 2023).

AI could deepen this division of labour by reducing effort for selected tasks. The cited assessments and investigations do not establish a timetable for fully self-running criminal organisations by 2030. As a planning judgement, this article therefore assumes uneven adoption: some groups may use assistants, others bounded workflows, and skilled operators both. That judgement reflects the variation in capability and continuing human decisions described in the evidence, not a measured forecast of the criminal market (NCSC, 2025a; Anthropic, 2025b).

For executives, this changes how threat information should be interpreted. A vendor’s description of agentic activity (AI systems using tools and acting without continuous human intervention) is not itself a measure of organisational exposure. Ask which business assets were reachable, which controls failed and whether comparable conditions exist internally. Supplier reports should distinguish observed behaviour from inferred capability and explain visibility limits. This is the article’s application of evidence-based assessment and contextual risk measurement: investment should follow exposure and consequence, not simply the novelty of a tool (Tabassi, 2023; NIST, 2024).

The leadership issue is how these changes alter exposure, not whether criminal activity resembles a conventional company.

Social engineering is one documented area in which AI can assist adversaries (NCSC, 2025a).

AI-generated content can reduce the usefulness of poor grammar and generic messaging as phishing warning signs. The NCSC’s assessment describes more convincing approaches without familiar language errors; this does not mean every phishing message is AI-generated or flawless. For individuals, departments and organisations receiving tailored requests, the practical priority is independent verification of identity, authority and the requested action rather than reliance on superficial errors (NCSC, 2024; Cybersecurity and Infrastructure Security Agency et al., 2023).

Audio and video deepfakes, AI-generated or manipulated media that misrepresent someone or something, extend the verification challenge. Ofcom’s research reviews their use in financial deception, including a reported fraudulent video-call incident. A familiar-sounding voice alone should therefore not be treated as proof of identity or authority; independent confirmation of consequential requests is the article’s control recommendation, consistent with layered anti-fraud and social-engineering protections (Ofcom, 2024; Cybersecurity and Infrastructure Security Agency et al., 2023).

Agentic systems broaden the concern beyond persuasive messages. A tool-enabled agent may take an action and use the result to determine its next step, rather than only propose an answer. NCSC interim guidance consequently addresses identity, permissions, monitoring, oversight and emergency shutdown. The response should protect people making decisions and systems carrying those decisions into effect (NCSC, 2026d).

Human trust can be considered part of the attack surface, the points where an adversary can enter, affect or extract information. Applying that concept to delegated machine authority raises a further question: which decisions can information trigger, and under whose permissions? This is the article’s synthesis of the definition and agent-control guidance (National Institute of Standards and Technology, n.d.-a; NCSC, 2026d).

For boards and executives, the practical challenge is to preserve useful trust while making authority independently verifiable across both human decisions and automated actions. This recommendation applies established access governance and the NCSC’s agent-specific oversight principles (NIST, 2024; NCSC, 2026d).

This article uses autonomous hacking to describe a spectrum of delegated activity, not software with independent intent. At one end, a person asks a model to summarise information or explain a finding. Further along, an agent uses tools made available to it, evaluates a result and decides whether another action is needed. Several tasks may be coordinated with limited intervention. This working distinction draws on the different levels of oversight discussed by the NCSC and the provider’s reported separation of tactical execution from human decisions. Tool access is distinct from authorisation to act against a target; the extent and consequences of delegated authority remain the practical concern (NCSC, 2026d; Anthropic, 2025b).

The boundary with conventional automation is not absolute. The relevant distinction here is between predetermined actions and model-mediated selection of tools or next steps. That flexibility does not establish reliability: the reported espionage investigation includes incorrect conclusions and fabricated findings, while NCSC guidance anticipates unintended agent activity. Leaders should therefore establish authorised scope, success criteria, supervision and stopping conditions rather than infer competence from the word autonomous (Anthropic, 2025b; NCSC, 2026d).

For business planning, distinguish AI-assisted intrusion, an agent-executed task and an end-to-end autonomous campaign. Evidence for one does not establish the others. The United Kingdom (UK) AI Security Institute (AISI)evaluates tasks under specified conditions; Anthropic reports substantial automation with retained human decisions. The article’s recommendation is to use these distinctions when assessing capability claims, preparing for demonstrated improvements without assuming an all-capable attacker (AI Security Institute, 2025; Anthropic, 2025b).

A ransom payment need not be the objective: the reported espionage case concerns unauthorised access and information theft, while agent-risk guidance considers broader unintended actions. As a planning inference, detection and recovery should cover information exposure and improper changes, not only encryption. A system that remains available may still have lost confidentiality or integrity. The cybersecurity outcomes framework supports treating those dimensions together rather than organising every control around one attack label (Anthropic, 2025a; NCSC, 2026d; NIST, 2024).

The strongest case for taking agentic intrusion seriously combines observed misuse with controlled evaluation, while keeping their limitations visible. In November 2025, Anthropic reported disrupting an espionage operation detected that September. According to the provider, its coding tool was manipulated into supporting attempts against roughly thirty organisations, with a small number of successful intrusions. This was a reported espionage campaign, not evidence of a fully autonomous ransomware business. Its relevance is that a tool-enabled model was reportedly used to execute substantial work rather than merely provide advice (Anthropic, 2025a). Source: Anthropic’s November 2025 disclosure.

Anthropic estimated that AI performed 80–90% of tactical operations, while human operators retained important decisions. That figure is the provider’s assessment of activity inside a particular investigation, not a universal measure of attack autonomy or success. The report also describes inaccurate conclusions and fabricated findings, illustrating why apparent progress needs verification. Public reporting does not provide complete independent access to the underlying evidence. Boards should treat the case as a material warning about delegated capability, while resisting the unsupported conclusion that reliable, unsupervised compromise of arbitrary organisations has been demonstrated (Anthropic, 2025b). Source: Anthropic’s full investigation report.

Anthropic’s September 2026 report, covering operations disrupted between December 2025 and August 2026, broadens the picture beyond the earlier espionage case. It describes suspected state-sponsored actors, financially motivated criminals and politically motivated individuals using Claude in cyber operations. The provider assesses the advantage in terms of speed, scale and depth, not exploit generation alone. These are selected notable cases rather than representative activity, so they cannot establish the prevalence of agent-led attacks across the economy (Anthropic, 2026).

Independent evaluation answers a different question. The AI Security Institute’s December 2025 Frontier AI trends reportdocuments improved cyber-task performance, including the first tested model to complete expert-level tasks in 2025. Performance under specified test conditions is not a real-world breach probability (AI Security Institute, 2025). The NCSC’s November 2026 assessment adds an operational judgement: AI is highly likely to improve the speed, scale and efficiency of existing methods, while human operators remain important for directing, validating and adapting outputs. Leaders should use evaluations to track capability and incident evidence to assess exposure, rather than treating either as proof of reliable, unsupervised compromise of arbitrary targets (NCSC, 2026b).

Encryption, transforming readable information into a coded form requiring a key to read, is one of several mechanisms through which attackers can create business pressure. Operational guidance explicitly covers both ransomware encryption and extortion involving stolen data without deployment of ransomware. Preparedness should address both (National Institute of Standards and Technology, n.d.-b; Cybersecurity and Infrastructure Security Agency et al., 2023).

Encryption can be combined with data theft and threats of public disclosure. The joint operational guide documents these tactics and their economic and reputational consequences. Regulatory and notification questions depend on the information and jurisdictions involved; those consequences should not be assumed to apply identically to every incident. The evidence supports preparing for multiple forms of leverage, not ranking their importance universally (Cybersecurity and Infrastructure Security Agency et al., 2023; Department for Science, Innovation and Technology et al., 2025).

The planning implication is to prepare for extortion whether or not file-encrypting ransomware is deployed (Cybersecurity and Infrastructure Security Agency et al., 2023).

Data theft without encryption is a recognised extortion risk, but the cited operational guidance does not establish that disclosure will universally replace disruption by a particular year. Organisations should prepare for combined losses of confidentiality (protection against unauthorised disclosure), integrity (protection against improper alteration or destruction) and availability (timely, reliable access for authorised users), rather than optimise their response around an unsupported forecast about criminal business models (Cybersecurity and Infrastructure Security Agency et al., 2023; National Institute of Standards and Technology, n.d.-b; NIST, 2024).

Autonomous-agent activity adds another layer: unintended actions can occur through an agent’s existing tools and permissions, without requiring file-encrypting malware. This makes authorised access and authorised purpose distinct concerns. Controls should consider what information the task needs, which actions are permitted and which transfers require review. The aim is to limit the consequences of misused access, consistent with the NCSC’s recommendations to constrain environments and apply proportionate oversight (NCSC, 2026d).

Restoring systems and restoring trust are different recovery tasks. Backups (copies retained to support recovery) can support technical restoration. NCSC guidance explicitly notes that ransomware-resistant backups do not address stolen-data extortion; the article’s conclusion is that a restore cannot itself reverse disclosure or demonstrate that confidence has been rebuilt (NCSC, n.d.-f).

Organisations deploying AI agents face a distinct exposure: a useful system may act outside its intended purpose through its instructions, tools or accessible services. An agent connected to documents and business applications crosses trust boundaries (points between different levels of trust or authority) and may hold credentials (information used to establish identity or access rights) enabling changes. Assessment should examine the whole chain, including integrations and permissions, rather than only the model’s answers (NCSC, 2026d; OWASP GenAI Security Project, 2025).

Prompt injection, inputs redirecting an AI system in unintended ways, illustrates this risk: material retrieved for a legitimate task may influence behaviour as though it were an instruction. Independent access controls (rules restricting data or services to authorised users and systems) and action boundaries should therefore remain effective when model safeguards fail. The NCSC’s interim guidance, based on its research, supports additional safeguards, constrained environments and oversight rather than reliance on prompting alone (OWASP GenAI Security Project, n.d.; NCSC, 2026d).

A fictional example makes the business issue concrete; it is not a reported incident. A procurement agent may compare supplier information and draft a recommendation without also being allowed to alter bank details or release payment on the strength of a document. Separating reading, recommending and executing is an illustrative application of constrained permissions and risk-proportionate oversight. Its effectiveness must be tested in the actual workflow rather than assumed from the example (NCSC, 2026d; OWASP GenAI Security Project, 2025).

The Open Worldwide Application Security Project (OWASP)’s Top 10 for agentic applications for 2026 provides a structured, peer-reviewed starting point for assessing agent risks, not a certification of compliance. Maintain an inventory of deployed agents, owners, approved purposes, connected services and withdrawal mechanisms. That inventory is the article’s governance application of the framework, supported by NCSC recommendations on named responsibility, constrained access, attribution and intervention (OWASP GenAI Security Project, 2025; NCSC, 2026d).

The exposure also extends beyond approved agents. The NCSC’s November assessment warns that staff using unapproved AI services with sensitive company information can leave organisations without visibility of how that information is handled or who can access it. As a governance response, discovery should cover unofficial use as well as authorised deployments; provide a usable approved route, clear data-handling rules and a way to report uncertainty without concealing it. Those actions are the article’s application of the assessment, not evidence that every unapproved tool has caused a breach (NCSC, 2026b).

Technical controls and board-level outcomes serve different purposes. Firewalls (controls permitting or blocking network traffic), vulnerability management (identifying, assessing and addressing weaknesses), endpoint detection (monitoring devices for signs of threats) and threat intelligence (analysed threat information informing decisions) support protection. Governance guidance connects that work with business continuity, legal exposure, trust and financial viability. The following list summarises those leadership concerns rather than reporting a survey of every board (Department for Science, Innovation and Technology et al., 2025; NIST, 2024).

• Boards care about business continuity.
• Boards care about regulatory exposure.
• Boards care about customer confidence.
• Boards care about enterprise (and shareholder) value.

Ransomware and agent-related incidents should be assessed against all four outcomes. The operational ransomware guide documents business disruption and economic and reputational impacts; NCSC agent guidance addresses unintended actions and associated risk. The article applies that evidence to the service, information or transaction affected, rather than deriving severity simply from an attack label (Cybersecurity and Infrastructure Security Agency et al., 2023; NCSC, 2026d).

Operational guidance records that ransomware and associated data breaches can prevent organisations from accessing the information needed to deliver mission-critical services, with economic and reputational effects extending into recovery. Costs should therefore be assessed beyond the ransom demand; the guidance does not establish that wider costs exceed the demand in every case (Cybersecurity and Infrastructure Security Agency et al., 2023).

Ransomware and agent-related incidents are enterprise resilience problems as well as cybersecurity problems. Technical controls remain essential, while incident planning, communications and recovery require coordinated business ownership. This is consistent with the UK governance code’s explicit responsibilities for risk management, strategy, people, incident response and assurance (Department for Science, Innovation and Technology et al., 2025).

The practical distinction is between technical controls and the wider business decisions needed to sustain trusted services; neither should be treated as a substitute for the other in implementing risk governance (NIST, 2024).

Autonomy makes delegated authority a governance decision. Who approves a higher-risk deployment, accepts residual exposure or can suspend automation? These are the article’s questions for applying the governance code and NCSC oversight guidance. Critical use cases should have named responsibility, escalation routes and controls proportionate to failure consequences, avoiding gaps between business sponsors, technology teams and providers (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d).

Board reporting should connect technical findings with service consequences: what an agent can affect, how it can be stopped, and what continues operating afterwards. This is an application of contextual risk communication and assurance, not a prescribed reporting template. Relevant legal, regulatory and contractual requirements must be identified for the organisation; source frameworks do not replace jurisdiction-specific advice or justify treating a product purchase as a transfer of accountability (NIST, 2024; Department for Science, Innovation and Technology et al., 2025).

Cybersecurity supports information protection as well as operational continuity. The outcomes framework combines governance, identification, protection, detection, response and recovery; the article’s conclusion is that prevention and trusted restoration should be treated together rather than as competing objectives (NIST, 2024).

Faster adversary activity makes established controls more urgent, not obsolete. The NCSC’s November 2026 review identifies familiar weaknesses as recurring routes into organisations. Its AI assessment warns that AI-assisted vulnerability discovery could increase pressure on defenders to deploy fixes before attackers develop working exploits; it also stresses that not every AI-discovered vulnerability is immediately exploitable. Leadership should therefore test how quickly exposed systems can be identified, prioritised, patched and checked, including services maintained by suppliers. That is a practical application of the assessment, alongside robust identity controls, restricted administrative access and separation of critical environments (NCSC, 2026c; NCSC, 2026b; Cybersecurity and Infrastructure Security Agency et al., 2023).

Apply that discipline to non-human identities (digital identities assigned to software, agents, services or devices). NCSC interim guidance recommends distinct agent identities, credentials limited to necessary tasks and short-lived credentials where practical. It also recommends logging, auditing and monitoring activity. Logs (records of system activity) should support attribution and investigation; linking the initiating request, action, identity and result is the article’s suggested implementation, not reliance on a model’s explanation as the complete record (NCSC, 2026d).

Permissions and approval requirements should reflect consequence. NCSC guidance distinguishes levels of oversight and calls for proportionate controls. Applying that principle, consequential changes should receive independent review with enough context to challenge the proposal, including intended effects, evidence and rollback options (ways to return a system to an earlier state). The specific review design should be tested: a nominal approval step is not evidence that oversight is effective (NCSC, 2026d; Tabassi, 2023).

Establish response authority in advance: define permitted containment actions, escalation conditions and who may accept service disruption. NCSC agent guidance supports monitoring, intervention and emergency shutdown; the governance code supports tested response plans. Exercises should include unintended containment and false positives(benign activity incorrectly identified as a threat), so faster automation is evaluated for business effects as well as adversary containment. That exercise design is the article’s application of the guidance (NCSC, 2026d; Department for Science, Innovation and Technology et al., 2025).

Evaluate defensive claims under conditions resembling the intended environment, including failures, data handling, supervision and changes to models or integrations. NIST research-based guidance supports contextual testing, monitoring and third-party risk management. Bounded pilots, comparisons with existing processes and measures such as investigation quality, containment time and service interruption are the article’s suggested application, not a validated universal scorecard. Procurement should also consider dependency, exit arrangements and retention of decision records (Tabassi, 2023; Autio et al., 2024).

The controls above address present exposure. The following five scenarios are the article’s planning exercises for 2027–2030, not dated predictions or findings that research has validated as a package. Their starting points are documented AI-enabled intrusion capabilities, agent-control risks and established governance outcomes. Test the assumptions against new evidence rather than treating 2030 as a deadline for a predetermined future (AI Security Institute, 2025; NCSC, 2025a; NCSC, 2026d; NIST, 2024).

1. Agentic AI attack platforms

Scenario: more intrusion tasks are delegated to agents, while people concentrate on objectives and exceptions. This extrapolates from reported tactical delegation and measured task improvements; it is not a forecast of end-to-end autonomous attacks. Test identity controls, monitoring and containment against faster or more concurrent activity to identify exposure under that assumption (Anthropic, 2025b; AI Security Institute, 2025; NCSC, 2026d).

2. Hyper-personalised social engineering

Scenario: tailored communications become more convincing and easier to produce, extending the social-engineering assistance assessed by the NCSC. Use this assumption to test transaction verification and identity assurance rather than demand flawless judgement from recipients. Independent confirmation should focus on the action and authority, not message polish or voice familiarity; this is the article’s application of layered protection principles (NCSC, 2024; Ofcom, 2024; Cybersecurity and Infrastructure Security Agency et al., 2023).

3. Supply-chain and integration concentration

Scenario: shared providers and agent integrations concentrate access and dependency across workflows. There is already evidence of concern, though not a measure of realised losses: the ONS release of 5 November 2026 reports that 21% of businesses with 10 or more employees were concerned about cyber attacks affecting supply chains over the following twelve months, while 12% were concerned about AI. The survey refers to October 2026 and remains official statistics in development (Office for National Statistics, 2026b). Use the scenario to map connections, access withdrawal, alternatives and provider support; concern levels do not prove increased concentration or predict a supplier failure (NIST, 2024; Tabassi, 2023).

4. Extortion and integrity loss without encryption

Scenario: applications remain available while information has been disclosed or records cannot be trusted. Operational guidance recognises extortion without encryption, and the outcomes framework addresses integrity as well as availability. Test validation of records, recovery decisions and communication of uncertainty alongside destructive-ransomware recovery; this does not predict encryption’s disappearance (Cybersecurity and Infrastructure Security Agency et al., 2023; NIST, 2024).

5. Convergence of cybersecurity, resilience and governance

Scenario: agents become embedded in important business processes. The article recommends joining the relevant AI and cyber risk assessments, ownership and incident arrangements so operational authority is not missed between reviews. This applies NIST’s organisational integration approach and the UK governance code; it does not prescribe identical team structures or remove the need for specialist expertise (Tabassi, 2023; Department for Science, Innovation and Technology et al., 2025).

Across these scenarios, the article prioritises clear ownership, constrained access, reliable evidence and tested recovery because those activities recur in the cited governance and agent-security guidance, not because the scenario dates have been validated (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d; NIST, 2024).

The following five priorities are the article’s synthesis of official governance, operational recovery and AI-risk guidance, not a research-derived ranking. The supporting paragraphs explain their basis. The ninety-day agenda then proposes one adaptable implementation sequence (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d; Tabassi, 2023; NCSC, n.d.-f).

• Build organisational resilience: Assume compromise is possible and prepare accordingly.
• Exercise crisis leadership: Conduct realistic tabletop exercises (discussion-based rehearsals of an unfolding incident) involving executives, legal teams, communications professionals and operational leaders.
• Prioritise supply chain assurance: Assess material dependencies and access held by connected organisations (NIST, 2024).
• Invest in AI-enabled defence: Adopt AI where evaluated benefits justify its costs, dependencies and delegated authority.
• Measure recovery, not just prevention: Test whether essential operations can be maintained or restored, how long validated restoration takes and whether the recovered service and its information can be trusted.

Build resilience by identifying services whose loss would cause unacceptable harm and the people, systems, information and suppliers needed to sustain them. Include agents where workflows depend on them and test fallback arrangements rather than treating a document as evidence of capability. Identifying critical assets and dependencies, setting risk tolerances and exercising plans are supported by the governance code and cybersecurity framework; minimum service levels and agent-specific fallback tests are the article’s suggested application (Department for Science, Innovation and Technology et al., 2025; NIST, 2024).

Crisis exercises should test relevant decision-making and recovery arrangements, as the governance code recommends. An optional fictional scenario is an approved agent making unexpected changes while the cause remains uncertain. Ask who can suspend it, inform business owners and manage work already in progress. This scenario applies the NCSC’s monitoring and intervention guidance; it is not a reported event or a validated measure of individual performance. Assess the response system and follow through on lessons (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d).

Supply-chain assurance should follow material access and dependency, including providers supporting AI. Supplier assessment, documented responsibilities and monitoring are established risk-management outcomes. Apply them by asking how delegated authority is limited, actions recorded, changes managed and investigation supported. Test access withdrawal and continuity implications. If assurance is insufficient, narrowing the use case, adding independent controls or declining integration are risk-treatment options for management, not guaranteed prescriptions (NIST, 2024; Tabassi, 2023; NCSC, 2026d).

Evaluate AI-enabled defence for demonstrable value rather than assume only AI can counter AI. NIST frameworks support contextual evaluation, monitoring, risk treatment and third-party assessment; operational ransomware guidance also recommends established non-AI controls. Apply these principles through bounded pilots and proportionate authority, reassessing after material changes. Include supervision, costs, failures and dependency in the business case; a workload reduction alone does not establish improved resilience (Tabassi, 2023; Autio et al., 2024; Cybersecurity and Infrastructure Security Agency et al., 2023).

Measure recovery by testing restoration of an important service and validating its information. Record what remains unavailable and which assumptions fail; include agent configurations, integrations and audit records where required by the workflow. This applies the framework’s recovery outcomes and the operational guide’s backup-testing recommendations. NCSC guidance specifically stresses protecting backups against destructive action and warns that resistant backups do not address stolen-data extortion. Technical restoration is therefore not evidence that every consequence has been resolved (NIST, 2024; Cybersecurity and Infrastructure Security Agency et al., 2023; NCSC, n.d.-f).

The following timetable and dashboard are the article’s implementation proposal, not a mandated deadline or an empirically validated ninety-day programme. Adapt the pace to exposure and capacity. The underlying activities, identifying dependencies, assigning responsibility, exercising response and reviewing assurance, derive from the Cyber Governance Code of Practice, Cybersecurity Framework 2.0 and NCSC agent-risk research and guidance (Department for Science, Innovation and Technology et al., 2025; NIST, 2024; NCSC, 2026d).

Suggested first month: establish a prioritised view of critical services, internet-facing systems, material suppliers and agents with consequential access. Include pilots that have entered routine use and investigate unapproved AI handling of sensitive information. Assign owners for gaps in authority, access or maintenance and address urgent exposures while discovery continues. This applies established asset-identification and accountability outcomes to the NCSC’s current warnings about familiar entry routes and shadow AI; the month is a planning interval, not a promise that discovery will be complete (NIST, 2024; NCSC, 2026c; NCSC, 2026b).

Suggested second month: test one critical workflow end to end using a plausible intrusion or unintended-agent scenario. Check access withdrawal, evidence preservation and agreed service continuity, involving providers where practical. Distinguish absent controls from controls that cannot reliably be used; prioritise findings by business consequence. The exercise applies published incident-planning and agent-intervention principles, without implying that one exercise establishes enterprise-wide resilience (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d).

Suggested third month: agree investment, assurance and decision rights. Identify near-term risk reductions, architectural work and residual exposure requiring explicit acceptance. Review material deployments and changes in external evidence, retaining a traceable account of assumptions and adjustments. These activities apply governance and continuous risk-management principles; the timetable is the article’s proposal, not a promise of immunity or a research-established optimum (Department for Science, Innovation and Technology et al., 2025; Tabassi, 2023).

A proposed dashboard can combine critical-service recovery evidence, consequential access reviews, tested containment authority and overdue high-impact remediation. These four measures are illustrative, not a validated universal scorecard. Interpret them with explanations of scope, assumptions and evidence quality: fewer reported gaps alone need not demonstrate lower risk. This applies the frameworks’ emphasis on meaningful measurement, communication and oversight (NIST, 2024; Tabassi, 2023; Department for Science, Innovation and Technology et al., 2025).

Ransomware and autonomous AI hacking describe different dimensions of an incident: malware supporting extortion versus how tasks are executed. The cited evidence includes extortion with or without encryption, a provider-reported espionage operation and agent risks involving excessive or misused authority. The article’s strategic conclusion is to address their shared dependencies, access, trustworthy information, controlled action and recovery, while retaining those distinctions (Cybersecurity and Infrastructure Security Agency et al., 2023; Anthropic, 2025a; NCSC, 2026d).

The November 2026 NCSC assessment strengthens the case for urgency without supporting fatalism. It expects faster and more scalable AI-assisted operations, with human direction and validation still important. The immediate leadership test is therefore not whether every attack is autonomous, but whether the organisation can close known weaknesses, constrain delegated authority and recover a trusted service before disruption becomes intolerable (NCSC, 2026b; NCSC, 2026c).

Security budgets alone should not be presented as proof of resilience. The governance code calls for accountable risk management, incident planning and assurance; the framework specifies outcomes across prevention, response and recovery. The article therefore recommends examining tested capability and clear decision rights alongside expenditure (Department for Science, Innovation and Technology et al., 2025; NIST, 2024).

Cyber resilience requires technical competence, operational preparation and accountable leadership together.

The leadership agenda proposed here is deliberate delegation and preparation for misuse: clear boundaries, usable evidence, rehearsed decisions and assurance that critical services and controls have been tested. It synthesises governance and agent-security guidance rather than promising immunity (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d).

Call to action

Ask your board: “If an AI-assisted intrusion or a compromised enterprise agent affected a critical service tomorrow, could we contain it, maintain an agreed minimum service and demonstrate a credible route to recovery?” Commission an exercise that tests the answer and assigns responsibility for the gaps. Set disruption tolerances according to the service and potential harm, not an arbitrary universal recovery target (Department for Science, Innovation and Technology et al., 2025; NIST, 2024).

If the answer is unclear, now is the time to act.

Use the board’s answer to prioritise review, testing and supply-chain assurance, allocating people, process and technology investment according to exposure and consequence. This closing recommendation applies the risk-based prioritisation and assurance principles in the governance code and cybersecurity framework (Department for Science, Innovation and Technology et al., 2025; NIST, 2024).

Do not wait for a definitive forecast of autonomous attacks before testing the controls that matter today.

Make the next resilience discussion a decision about authority, evidence and tested continuity, not simply another review of technology purchases.

Final thought

Prepare for credible failure without treating it as inevitable. Grant autonomy deliberately, verify consequential actions and practise recovery before the evidence is needed.

What has your organisation learned about preparing for ransomware, governing AI agents or testing recovery? Share lessons that others can apply to strengthen their own resilience.

The closing recommendations apply the governance and agent-security principles discussed above: proportionate oversight, constrained authority, rehearsed decisions and tested recovery. They are commitments to verify, not promises of immunity (Department for Science, Innovation and Technology et al., 2025; NCSC, 2026d; NIST, 2024).

This list covers the distinct publications, organisational pages, definitions and artist resources linked in the article and graphics briefs. Where the article links both a publication page and its document, both destinations are included. Entries use author–date reference conventions; retrieved web-page titles are linked. Provider reports remain attributed investigations, not independent prevalence estimates; editorial scenarios and creative briefs are proposals rather than empirical evidence. Additional curated resources are available (much more here).

• AI Security Institute. (n.d.). AI Security Institute.
• AI Security Institute. (2025, December 18). Frontier AI trends report.
• Anthropic. (n.d.). Anthropic.
• Anthropic. (2025a, November 13). Disrupting the first reported AI-orchestrated cyber espionage campaign.
• Anthropic. (2025b, November). Disrupting the first reported AI-orchestrated cyber espionage campaign: Full report(Updated November 17, 2025).
• Anthropic. (2026, September 10). Detecting and countering misuse of AI: September 2026.
• Autio, C., Schwartz, R., Dunietz, J., Jain, S., Stanley, M., Tabassi, E., Hall, P., & Roberts, K. (2024). Artificial intelligence risk management framework: Generative artificial intelligence profile (NIST AI 600-1). National Institute of Standards and Technology.
• Cybersecurity and Infrastructure Security Agency. (n.d.). Cybersecurity and Infrastructure Security Agency (CISA).
• Cybersecurity and Infrastructure Security Agency, Multi-State Information Sharing and Analysis Center, National Security Agency, & Federal Bureau of Investigation. (2023, October). #StopRansomware guide (Version 3.0).
• Department for Science, Innovation and Technology. (2024, April 9). Cyber resilience. GOV.UK.
• Department for Science, Innovation and Technology. (2025, November 12). Cyber Security and Resilience (Network and Information Systems) Bill: Supporting documents. GOV.UK.
• Department for Science, Innovation and Technology, National Cyber Security Centre, & Department for Digital, Culture, Media and Sport. (2025, April 8). Cyber governance code of practice. GOV.UK.
• Department for Science, Innovation and Technology, & Home Office. (2026, April 30). Cyber security breaches survey 2025/2026. GOV.UK.
• Europol. (2023, September 13). Cyber-attacks: The apex of crime-as-a-service. PDF version.
• Google. (n.d.). An image format for the Web. Google for Developers.
• Government Cyber Unit. (2026, January 6). GovAssure cyber lexicon. UK Government Security.
• Holdsworth, J., & Kosinski, M. (n.d.). What is ransomware as a service (RaaS)? International Business Machines Corporation.
• International Business Machines Corporation. (n.d.-a). International Business Machines Corporation (IBM).
• International Business Machines Corporation. (n.d.-b). What is endpoint detection and response (EDR)? Retrieved November 1, 2026.
• International Business Machines Corporation. (2026). Cost of a data breach report 2026.
• International Color Consortium. (n.d.). sRGB. Three Component Color Encoding Registry.
• Kosinski, M. (n.d.). What is nonhuman identity? International Business Machines Corporation.
• National Cyber Security Centre. (n.d.-a). Glossary.
• National Cyber Security Centre. (n.d.-b). National Cyber Security Centre. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/
• National Cyber Security Centre. (n.d.-c). Network security fundamentals. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/guidance/network-security-fundamentals
• National Cyber Security Centre. (n.d.-d). Phishing. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/section/advice-guidance/all-topics/phishing
• National Cyber Security Centre. (n.d.-e). Ransomware. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/section/advice-guidance/all-topics/ransomware
• National Cyber Security Centre. (n.d.-f). Ransomware-resistant backups. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/collection/ransomware-resistant-backups
• National Cyber Security Centre. (n.d.-g). Tabletop exercises. Retrieved November 1, 2026, from https://www.ncsc.gov.uk/section/exercise-in-a-box/tabletop-exercises
• National Cyber Security Centre. (2024, January 24). The near-term impact of AI on the cyber threat.
• National Cyber Security Centre. (2025a, May 7). Impact of AI on cyber threat from now to 2027. PDF version.
• National Cyber Security Centre. (2025b, October 14). NCSC annual review 2025.
• National Cyber Security Centre. (2026, August 20). Managing the cyber risk of agentic AI [Research-based interim guidance].
• National Institute of Standards and Technology. (n.d.-a). Attack surface. Computer Security Resource Center Glossary.
• National Institute of Standards and Technology. (n.d.-b). Glossary. Small Business Cybersecurity Corner.
• National Institute of Standards and Technology. (n.d.-c). National Institute of Standards and Technology.
• National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). PDF version. Authorship cross-reference: the final report’s title page and NIST’s Computer Security Resource Center catalogue identify the corporate author as National Institute of Standards and Technology. A separate NIST publication record credits Cherilyn Pascoe, Stephen Quinn and Karen Scarfone. Existing “Pascoe et al., 2024” citations in this article refer to this same NIST CSWP 29 publication, not to a separate work. Corporate authorship is used in the reference entry above; the in-text citations still require standardisation to “NIST, 2024”.
• Office for National Statistics. (n.d.). Office for National Statistics.
• Office for National Statistics. (2026, October 8). Business insights and impact on the UK economy: 8 October 2026.
• Ofcom. (2024, July 23). Deepfake defences: Mitigating the harms of deceptive deepfakes.
• Open Worldwide Application Security Project. (n.d.). OWASP Foundation.
• OWASP GenAI Security Project. (n.d.). LLM01:2025 prompt injection.
• OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for agentic applications for 2026.
• Sophos. (n.d.). Sophos.
• Sophos. (2025, June). The state of ransomware 2025.
• Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). National Institute of Standards and Technology.
• World Wide Web Consortium. (n.d.). Images tutorial. Web Accessibility Initiative.
• World Wide Web Consortium. (2011, August 9). The meta element. HTML5: Edition for Web Authors.