In April 2026, Business Secretary Liz Kendall and Security Minister Dan Jarvis published an open letter to every business leader in the country. The message was clear: advances in artificial intelligence are changing the cyber threat landscape, and many organisations may not be fully prepared for what that means.
For years, cyber attacks required a high level of technical skill. Only a relatively small number of highly capable criminals could carry them out. But AI is beginning to change that. It can now automate parts of the process, making it easier for less skilled attackers to attempt more sophisticated attacks.
What made the letter particularly stark was this; only 35,000 businesses out of 5.5 million in the UK (roughly around 1%) currently hold Cyber Essentials certification, the government’s most basic recommended standard for cyber protection. In other words, most organisations have not yet met the minimum recommended level of protection and are at risk.
Here’s what’s driving that concern, and what you can do about it.
How artificial intelligence is changing cyber attacks
A new system from Anthropic called Claude Mythos has sparked a lot of discussion. The company says that, in tests, the model can carry out some hacking and cyber security tasks better and faster than humans. It has reportedly been able to find weaknesses in software and highlight security flaws much more quickly than traditional manual methods.
Because of these capabilities, there are concerns among regulators, governments, and financial organisations about what it could mean if such tools were misused.
However, access to Mythos is currently very limited. Instead of being released publicly, it has been shared with a small number of large technology companies through a programme which is focused on improving security and testing defences.
What this actually means for your business
With concerns about how such tools could be misused, and warnings from officials and cyber experts that they may make it easier to identify and exploit weaknesses in digital systems, it’s important that all businesses review their security posture.
Cyber attacks happen every day, whether they are carried out manually by individuals or supported by tools like AI to:
- Identify weaknesses in software and systems more quickly than before.
- Send phishing emails that are far more convincing than the obvious scam messages most people have learned to spot.
- Try hundreds of password combinations in seconds to get into accounts.
- Break into systems through out of date software.
For businesses, this means the basics of security matter more than ever; keeping systems updated, strengthening access controls, and maintaining visibility across your environment so issues are spotted early. Small and medium-sized businesses are often easier targets because they typically have fewer security controls in place and less dedicated resource to monitor threats.
Employee AI use is a security risk too
On top of AI cyber attacks, many businesses are now dealing with another challenge and that’s how employees use AI tools in day to day work.
Tools like ChatGPT and other AI assistants are being used to speed up tasks such as writing emails, summarising documents, and analysing information. While this can improve productivity, it also introduces new risks if sensitive data is shared without proper controls. For example, employees may unintentionally input:
- Client or customer data into public AI tools.
- Commercially sensitive information when drafting content or summaries.
- Internal emails or documents that were never intended to leave the organisation.
As AI becomes embedded in everyday workflows, businesses need to consider:
- What data should never be shared with public AI tools.
- Which approved tools staff are allowed to use.
- How to monitor and manage usage.
- Whether staff understand the risks involved.
Without clear guidance and governance, AI adoption can introduce new data security and compliance risks into the business.
What the government is asking businesses to do
The government’s letter set out clear, practical steps. None of them are complicated, but many businesses haven’t implemented them yet:
- Cyber security needs to be at the top of your business agenda, not just something your IT team worries about.
- Work towards Cyber Essentials certification. It’s worth noting that Cyber Essentials certification is just one piece of the puzzle, not a guarantee that nothing will ever go wrong. But achieving it shows you have the basics covered, and for many customers and partners, it’s a mark of trust that matters when they’re deciding who to work with.
- Keep software and systems updated. Out-of-date software is one of the most common ways attackers get in.
- Use strong, unique passwords and multi-factor authentication, the extra step where you confirm your identity on a device.
- Have a plan for what you would do if something went wrong and test it.
These aren’t new ideas. The difference now is the urgency behind them.
How Netcentrix can help
We support UK businesses improving their cyber security posture, from preventing attacks to detecting and responding to threats more effectively. The changes outlined in this post are exactly why getting the basics right has never been more important.
Our N-Force Managed Cyber Security service gives businesses the kind of protection that used to only be available to large enterprises. It includes services like:
- SOC monitoring: someone watching over your systems around the clock, looking for anything unusual before it becomes a problem.
- Endpoint protection: keeping every device in your business secure, whether your team is in the office or working remotely.
- Email security: filtering out the kind of sophisticated phishing attempts that AI is now making much harder to spot.
- Identity threat protection: making sure only the right people can access your systems, including multi-factor authentication.
- Security awareness training: helping your team recognise threats so your people don’t become your biggest vulnerability.
- Cyber Essentials readiness: we’ll help you get ready for certification, so when you apply, you know you’re in a good position.
Alongside that, our N-Sure Managed IT Support service covers the day to day management of your IT, so your systems are kept up to date, issues are caught early, and your team has someone to call when more support is needed. We’re based in the UK, we answer quickly, and our customers consistently rate us highly for it.
What sets us apart isn’t just the technology, it’s the people behind it. Your business gets a team that knows your setup, understands your risks, and is genuinely invested in keeping you protected.
Don’t wait until something goes wrong
The businesses that will be most successful are those that act early, rather than reacting after an incident. If your business hasn’t reviewed its cyber risk recently, now is the right time to do it. If you’re unsure whether your current protections are enough, we can help you.
Get in touch with the Netcentrix team today by calling 0333 003 0560 or completing our contact form.
