For organisations adopting AI, the important question is therefore not whether artificial intelligence should be used. The more useful question is how AI can be introduced while protecting confidential information, systems, customers, employees and business operations.

This guide examines the major AI cyber security risks facing UK businesses, explains how attackers may exploit AI, considers the specific risks created by AI systems themselves and sets out practical steps organisations can take to reduce their exposure.

What Are AI Cyber Security Risks

AI cyber security risks can broadly be divided into two categories.

The first involves attackers using AI as a tool. Criminals can use artificial intelligence to generate convincing messages, automate certain activities, analyse information and potentially lower the technical barrier to some forms of cyber attack.

The second involves attacks against AI systems themselves. An organisation might deploy a generative AI application, an AI-powered customer service system, a machine-learning model or an AI agent connected to internal systems. Those systems can introduce vulnerabilities that are different from conventional applications.

The UK National Cyber Security Centre explains that AI systems can have novel security vulnerabilities that need to be considered alongside traditional cyber threats. Its guidance highlights issues including hallucinations, prompt injection and data poisoning.

For a business, the distinction is important. Installing an AI application does not automatically create a cyber attack, but connecting that application to sensitive information, business systems or external tools can create additional attack paths.

Similarly, an attacker does not necessarily need an advanced AI system to compromise a company. Traditional weaknesses such as stolen passwords, unpatched software, poor access controls and inadequate backups remain highly relevant.

The practical approach is therefore to treat AI security as part of the organisation’s wider cyber security and risk-management programme rather than as a completely separate discipline.

How Artificial Intelligence Is Changing the Cyber Threat Landscape

AI can affect cyber security in several ways. For attackers, the technology can assist with tasks that previously required more time or specialist expertise. For defenders, AI can potentially help analyse large volumes of information, identify unusual activity and support security teams.

The UK Government’s 2026 open letter to business leaders states that new generations of AI models are becoming capable of performing activities that previously required rare expertise, including finding software weaknesses and writing code to exploit them. The Government’s warning is significant because it frames AI as a factor that can change the economics and scale of cyber attacks.

However, businesses should avoid treating every AI-assisted cyber threat as a futuristic scenario. Many of the most important risks are familiar threats enhanced by automation.

A phishing email generated or improved using AI is still phishing. A fraudulent payment request is still business fraud. Malware delivered through an AI-assisted campaign still needs a route into the organisation.

The security challenge is that AI can potentially make some of these activities faster, more convincing or easier to customise.

There is another important consideration. AI can accelerate legitimate business activity as well as malicious activity. If a security team takes several hours to investigate an alert while an attacker can automate reconnaissance or produce convincing messages at scale, the balance between attacker and defender can change.

This makes resilience particularly important. Businesses should not rely on being able to identify every malicious AI-generated message or predict every new attack technique. Instead, they should build layers of protection so that one successful deception does not automatically result in a major compromise.

How Criminals Are Using AI

AI-Enhanced Phishing

Phishing has historically relied on convincing a victim to click a link, open an attachment, disclose information or transfer money. Poor spelling and obvious grammatical errors have sometimes made fraudulent messages easier to identify.

Generative AI can help produce polished written content and adapt messages for different audiences. This means employees should not assume that a professional-looking email is genuine.

Businesses should instead rely on layered controls, including multi-factor authentication, email security, domain protection, staff awareness training, payment verification procedures and strong identity controls.

Social Engineering

Social engineering targets people rather than technical vulnerabilities. AI can assist attackers in creating tailored communications that imitate the language, tone or interests of a particular target.

The risk is particularly relevant to finance teams, senior executives, HR departments and employees with access to sensitive information.

A business should have clear processes for unusual requests. For example, a request to change supplier bank details should not be approved solely because the email appears to come from a familiar contact.

Fraud and Impersonation

Artificial intelligence can also contribute to increasingly convincing impersonation attempts. Synthetic text, audio and video can be used to create misleading communications or make a fraudulent request appear more credible.

Businesses should therefore establish independent verification procedures for high-risk transactions. The more consequential the request, the less the organisation should depend on the apparent authenticity of a single communication.

Reconnaissance and Information Gathering

Attackers can already collect information from public websites, social media, company documents and other sources. AI may help process and organise large volumes of information more efficiently.

Businesses should consider what information they expose publicly and whether seemingly harmless details could help an attacker understand their technology, employees, suppliers or internal processes.

Malware and Exploit Development Assistance

AI can be used to assist with programming and technical tasks. The UK Government’s 2026 warning to businesses specifically highlighted the potential for advanced models to perform activities involving software weaknesses and exploit code.

This does not mean AI has eliminated the need for technical expertise or that every AI model can independently conduct sophisticated attacks. It does mean organisations should consider how automation and AI assistance may alter the threat environment.

Automated Analysis of Stolen Information

Cyber criminals who obtain large volumes of stolen data face the practical challenge of identifying information that can be monetised or used in further attacks. AI can potentially help categorise, summarise or analyse information.

For businesses, this reinforces the importance of limiting the amount of information exposed during an incident and protecting sensitive data with appropriate access controls.

The Biggest AI Cyber Security Risks for UK Businesses

AI introduces a broad range of risks. The following areas are particularly important for organisations developing or deploying generative AI, large language models, machine-learning systems and AI-enabled applications.

1. Prompt Injection

Prompt injection occurs when an attacker provides input designed to influence an AI system into behaving in an unintended way.

For a basic chatbot, the consequences may be limited to an inappropriate or inaccurate response. For an AI application connected to business data or tools, the consequences can be considerably more serious.

An AI system might be instructed to summarise documents, search a database, retrieve information or interact with another application. If malicious content is introduced into the information the system processes, the AI may interpret that content as instructions.

The NCSC has described prompt injection as a significant weakness affecting large language models and has warned that risks increase when LLMs are used to pass information to third-party applications and services.

Businesses should therefore avoid assuming that a system prompt or carefully written instruction is a complete security boundary. Technical controls, permissions, validation and system architecture remain important.

2. Indirect Prompt Injection

Indirect prompt injection is particularly relevant to AI systems that retrieve external content.

Imagine an AI assistant that reads web pages, emails, documents or knowledge-base articles before answering a user’s question. An attacker could attempt to place malicious instructions inside one of those sources.

The AI may then encounter the malicious instruction as part of the information it is processing.

This creates an important distinction between data and instructions. A secure AI application needs to consider what happens when content from an untrusted source contains instructions intended to manipulate the model.

The UK’s AI Cyber Security Code of Practice specifically identifies indirect prompt injection as one of the distinct security risks associated with AI.

3. Sensitive Information Disclosure

One of the most immediate risks for businesses is exposing confidential information to an AI system without understanding how that information is handled.

Employees may enter:

• Customer information
• Personal data
• Financial information
• Contracts
• Internal reports
• Commercial strategies
• Source code
• Credentials or secrets
• Intellectual property
• Confidential correspondence

Even where an employee’s intention is simply to summarise or analyse a document, the organisation needs to understand the relevant provider’s data handling, retention, security and access arrangements.

The ICO’s AI and data protection guidance explains how organisations should consider UK data protection law when AI systems process personal data. It also distinguishes legal requirements from recommended good practice.

4. Data Poisoning

AI systems depend heavily on data. If an attacker can manipulate training, fine-tuning or other data used by a model, they may influence the system’s behaviour.

This is known as data poisoning.

The risk can arise at different stages of an AI system’s lifecycle. An organisation might obtain data from external sources, use third-party models, fine-tune a model or build a retrieval system containing internally collected information.

The UK Government’s AI Cyber Security Code identifies data poisoning as a distinct AI security risk.

Businesses should understand where their AI data originates, who can modify it, how changes are approved and how the integrity of important datasets is monitored.

5. AI Supply-Chain Risks

An AI system is rarely isolated.

It may depend on a model provider, cloud platform, API, software library, dataset, vector database, plugin, monitoring service or other third-party component.

Each dependency can introduce security considerations.

OWASP’s 2025 Top 10 for Large Language Model and Generative AI Applications includes supply-chain vulnerabilities as a major risk category. The organisation also highlights risks involving data and model poisoning, excessive agency, system prompt leakage and vector and embedding weaknesses.

For UK businesses, supplier due diligence should therefore extend beyond conventional IT security questions.

Organisations should understand:

• Which AI models and services are being used?
• Where is business data processed?
• What third parties have access?
• How are updates managed?
• How are vulnerabilities reported?
• What happens if the supplier suffers an incident?
• Can the business retrieve or delete its data?
• How are access credentials protected?
• What happens if the service is discontinued?

6. Excessive AI Permissions

The risks increase substantially when an AI system can take actions rather than simply generate text.

An AI assistant that can read a document has one type of risk. An agent that can read documents, send emails, modify records, create tickets, execute code and make API calls has a much larger potential impact.

This is why the principle of least privilege is important.

An AI system should have only the access necessary for the task it is intended to perform.

Permissions should also be reviewed regularly. An AI application should not retain powerful access indefinitely simply because that access was convenient during initial deployment.

7. AI Agents and Autonomous Actions

Agentic AI introduces another dimension to AI security.

An AI agent can be designed to pursue a goal through multiple steps, potentially using tools and external systems. This can provide significant business value, but it also means an unintended instruction or model behaviour could have consequences beyond an incorrect answer.

The NCSC’s latest guidance on agentic AI recommends safeguards, sandboxing and active oversight. It also advises organisations to define what an agent should achieve, what actions it should be allowed to take and when it must stop and seek human approval.

This is an important change in mindset.

When AI is purely informational, an incorrect answer may be the primary concern. When AI can act, the organisation must also consider the consequences of incorrect or manipulated actions.

8. Hallucinations and Unreliable Outputs

AI systems can generate convincing but incorrect information. This is commonly described as hallucination.

From a cyber security perspective, unreliable output can cause problems even when there is no malicious attacker.

An AI system could recommend an incorrect security configuration, invent a technical explanation, misclassify an incident or produce inaccurate code.

Businesses should therefore identify where human review is required.

AI output should not automatically be treated as authoritative simply because it is presented confidently.

9. Model and System Prompt Leakage

AI applications may contain system instructions, configuration information or other information that developers do not intend to expose.

Attackers may attempt to manipulate the model into revealing those instructions.

System prompts should not be treated as a replacement for conventional security controls. Secrets, credentials and sensitive configuration information should be protected through proper technical mechanisms rather than relying on the model not to reveal them.

10. Vector and Embedding Weaknesses

Many business AI systems use retrieval-augmented generation, often abbreviated to RAG. These systems can retrieve relevant internal information and provide it to a language model when generating an answer.

This can make AI much more useful for business applications, but it creates another security layer.

Businesses need to consider who can add information to the knowledge base, who can retrieve it, how documents are indexed and whether access controls from the original system are preserved.

A user should not automatically gain access to confidential information simply because an AI system can technically retrieve it.

11. Improper Output Handling

AI-generated output should be treated as untrusted input where appropriate.

If an application takes model-generated content and passes it directly into another system without suitable validation, an attacker may be able to exploit the downstream application.

This is particularly important when AI-generated content is used to create database queries, execute commands, modify records or interact with software.

12. Shadow AI

Shadow AI describes the use of AI tools by employees without appropriate organisational oversight.

An employee might use a consumer AI service to rewrite a confidential email, analyse a spreadsheet, review source code or summarise a customer document.

The employee may have no malicious intention. The problem is that the business may not know what information has been shared or what controls apply to the service.

Organisations should not respond simply by telling employees that AI is prohibited. A better approach is to establish clear rules explaining which tools are approved, what information may be entered and what employees should do when they are unsure.

13. AI-Enabled Deepfakes and Impersonation

Synthetic audio, video and images can complicate identity verification.

Businesses should therefore be cautious about relying solely on voice or visual familiarity when approving high-risk transactions.

For example, a finance team should have a documented process for independently verifying payment changes. A senior executive’s apparent voice should not automatically override that process.

14. AI and Vulnerability Management

AI can create another challenge for software security because organisations may rapidly integrate new AI libraries, APIs and services.

Each new component can introduce dependencies that require maintenance and monitoring.

Businesses should know which versions of important software components are deployed, monitor security advisories and establish a process for responding when vulnerabilities are discovered.

AI applications should therefore be included within existing vulnerability management and software asset management processes rather than being treated as exceptions.

The Risks of AI Agents for Businesses

AI agents deserve particular attention because they combine artificial intelligence with the ability to interact with tools and systems.

The NCSC’s current guidance states that organisations should consider how agentic AI systems behave when they do not function as expected and should plan for unintended activity.

Several controls are particularly important.

Define the Agent’s Authority

Before deploying an AI agent, establish exactly what it is allowed to do.

For example, an internal service-desk agent might be allowed to create support tickets but not disable user accounts. A sales assistant might be allowed to draft emails but not send them without approval.

Use Human Approval for High-Risk Actions

High-impact actions should generally have an appropriate approval mechanism.

Examples could include:

• Financial transactions
• Changing supplier payment details
• Deleting business records
• Changing security settings
• Creating privileged accounts
• Sending sensitive information externally
• Deploying production software

Use Sandboxing and Isolation

Where an AI system needs to execute code or interact with potentially untrusted material, isolation can reduce the consequences of unexpected behaviour.

Sandboxing should be considered alongside authentication, authorisation, network controls and monitoring.

Monitor Agent Activity

Businesses need visibility into what agents are doing.

Logging should make it possible to investigate significant actions, understand the sequence of events and identify anomalous behaviour.

Threat Model the Complete System

Security teams should not assess the AI model alone.

The assessment should include the model, prompts, data sources, retrieval system, tools, APIs, identity system, user interface, infrastructure and third-party services.

Plan for Failure

AI agents should have clearly defined failure states. If a tool becomes unavailable, a response appears suspicious or the agent reaches a task it was not designed to perform, the system should have a safe way to stop rather than continuing indefinitely.

This is particularly important for automated workflows. A small mistake repeated automatically can have a larger impact than a single incorrect response.

AI and Phishing: Why Businesses Need to Be More Careful

Phishing remains one of the clearest examples of how AI can amplify an established cyber threat.

Employees should no longer rely on obvious spelling mistakes or awkward wording as their primary defence.

Instead, organisations should focus on behavioural controls and technical protections.

Useful measures include:

• Multi-factor authentication
• Passkeys where appropriate
• Email filtering and security controls
• Domain-based email authentication
• Security awareness training
• Payment verification procedures
• Clear reporting mechanisms
• Privileged access controls
• Endpoint protection
• Regular phishing exercises

The key principle is simple: technology should reduce the consequences of a successful social-engineering attempt rather than assuming every employee will recognise every malicious message.

Organisations should also ensure that senior staff understand the risk. Attackers may target decision-makers because access to a single executive account can provide an opportunity to access sensitive correspondence, approve transactions or initiate further attacks.

AI Data Security Risks for UK Businesses

Data is one of the most important considerations when adopting artificial intelligence.

The ICO provides detailed guidance on how data protection law applies when organisations use AI systems that process personal data. Its guidance is designed for organisations across the public, private and third sectors.

Businesses should understand what data an AI system receives, where it goes, how long it is retained, who can access it and how it is deleted.

Customer Data

Customer information may contain personal or commercially sensitive details. Before using such information with an AI service, the organisation should understand whether the processing is appropriate and whether relevant data protection obligations are being met.

Employee Information

HR departments may use AI for recruitment, document processing or workplace analysis. These uses can involve sensitive employee information and therefore require appropriate governance.

Intellectual Property

Businesses may possess valuable designs, source code, engineering documents, commercial strategies and other intellectual property.

Employees should know whether such information can be entered into external AI services.

Credentials and Secrets

Passwords, API keys, access tokens and other secrets should never be casually entered into AI tools.

AI should not become an alternative storage location for credentials.

Data Retention and Deletion

Businesses should understand how information is retained by their AI suppliers and what mechanisms exist for deletion. This is particularly important where AI services process personal or commercially confidential information.

Procurement teams should ask specific questions rather than assuming that all AI services operate in the same way. Data retention, model training arrangements and administrative access can vary between providers and products.

AI Supply Chain and Third-Party Risks

Many businesses will not build their own AI models. Instead, they will purchase or integrate AI capabilities provided by another organisation.

This can be a sensible approach, but it means cyber security due diligence must extend through the AI supply chain.

The UK AI Cyber Security Code of Practice includes securing the supply chain as one of its principles.

When assessing an AI provider, businesses should consider:

• Security certifications and independent assurance
• Data processing arrangements
• Authentication and access controls
• Encryption
• Logging and monitoring
• Incident response
• Vulnerability management
• Sub-processors
• Business continuity
• Data deletion
• Model and software update processes
• Contractual security obligations

Security should be assessed before procurement rather than after an AI system has become embedded in business processes.

Businesses should also consider concentration risk. If several critical business processes depend on the same AI provider, an outage or security incident affecting that provider could have a wider impact than expected.

How UK Businesses Can Reduce AI Cyber Security Risks

1. Establish an AI Usage Policy

Every organisation using AI should have clear guidance for employees.

The policy should explain which AI services are approved, what data may be entered, how outputs should be checked and what employees should do if an AI tool behaves unexpectedly.

The policy should be practical rather than simply prohibitive.

2. Create an AI Inventory

You cannot secure what you do not know exists.

Maintain a record of AI systems used by the organisation, including:

• Purpose
• Supplier
• Users
• Data processed
• Business systems connected
• Permissions
• Security owner
• Risk classification

3. Apply Least Privilege

AI systems should have the minimum permissions required to perform their function.

This is particularly important for AI agents and systems connected to APIs.

4. Protect Sensitive Data

Use data classification to establish what information can be processed by different AI services.

Where appropriate, consider techniques such as redaction, anonymisation or pseudonymisation before information is processed.

5. Train Employees

AI security training should cover more than the traditional phishing message.

Employees should understand prompt injection, confidential information risks, hallucinations, deepfakes, shadow AI and the organisation’s approved tools.

6. Maintain Strong Identity Security

Strong authentication remains fundamental.

Multi-factor authentication, passkeys, privileged access management and appropriate account lifecycle controls can reduce the impact of compromised credentials.

The UK Government’s current business cyber security guidance continues to emphasise foundational security measures, including Cyber Essentials.

7. Monitor AI Systems

Monitoring should cover both security events and unusual AI behaviour.

Organisations should consider logging access, prompts where appropriate, tool calls, administrative actions and other security-relevant events.

8. Test AI Applications

Security testing should consider how an AI application behaves when exposed to malicious input.

Testing should include prompt injection, access-control bypass attempts, malicious documents, data leakage, unexpected outputs and abuse of connected tools.

9. Include AI in Incident Response

Your incident response plan should cover AI-related incidents.

For example, what happens if an employee accidentally submits confidential information to an AI service? What happens if an AI agent takes an unintended action? Who can disable the system? Who investigates the event?

10. Keep AI Systems Updated

AI systems, their surrounding software and infrastructure require maintenance.

Security updates, dependency management and vulnerability remediation should be part of normal operational processes.

11. Use Secure-by-Design Principles

The NCSC and international partners have promoted secure-by-design principles for AI development. The approach places responsibility for security into the design and development lifecycle rather than treating it as an afterthought.

The UK’s AI Cyber Security Code of Practice similarly places emphasis on designing AI systems for security, evaluating threats, protecting infrastructure, securing supply chains, testing systems and monitoring behaviour.

12. Establish Clear Ownership

AI security can fall between departments if responsibility is unclear. IT may manage the technology, procurement may manage the supplier, legal teams may assess contracts and data protection teams may assess privacy, while individual departments may actually use the system.

Assigning a clear owner helps ensure that security decisions are not left unresolved between teams.

AI Cyber Security Risk Assessment for UK Businesses

A practical AI risk assessment can start with five questions.

1. What AI systems are we using? Identify approved and unapproved applications.
2. What information can they access? Map personal, financial, commercial and technical data.
3. What can the AI do? Determine whether it only generates information or can take actions.
4. Who is responsible? Establish clear ownership for security and risk.
5. What happens if it fails? Identify operational, financial, legal, privacy and reputational consequences.

The UK Government has also published an AI Risk Management Toolkit to help teams involved in designing, procuring and delivering AI products understand, assess and manage AI risks. The toolkit is intended to support multidisciplinary teams and can provide an additional reference for UK organisations developing their AI governance approach.

A useful risk assessment should also consider the worst credible outcome. If an AI system can access customer records, for example, the assessment should consider what could happen if the system disclosed information to an unauthorised person. If an agent can send emails, the assessment should consider the consequences of manipulated or erroneous communications.

AI Cyber Security Checklist for UK Businesses

Use the following checklist as a starting point for an AI security review.

The Role of Senior Leadership in AI Cyber Security

AI security should not be left entirely to the IT department.

The UK Government’s Cyber Governance Code of Practice is aimed at boards and directors and explains how organisations can manage digital risks. This reflects a broader principle: cyber security is a business risk, not simply a technical problem.

Senior leaders should understand:

• Which AI systems are strategically important
• What sensitive information AI can access
• Which AI systems can take actions
• What suppliers are involved
• What the consequences of an AI security incident could be
• Whether adequate monitoring exists
• Whether the organisation can respond quickly to an incident

Boards do not need to become AI engineers. They do need enough understanding to challenge assumptions, allocate appropriate resources and ensure that AI adoption does not bypass established risk-management processes.

AI Cyber Security and Cyber Essentials

AI security does not replace conventional cyber security.

A business can have sophisticated AI governance and still be vulnerable because of weak passwords, unsupported software, poor access controls or inadequate backups.

The UK Government’s 2026 letter to business leaders recommends getting the basics right with Cyber Essentials and points organisations towards NCSC guidance and the Early Warning Service.

For many organisations, the sensible approach is therefore to build AI security on top of a strong conventional cyber security foundation.

That means securing identity, endpoints, networks, cloud services, software, backups, email and access controls while separately assessing AI-specific risks.

This is particularly important for smaller businesses. Limited cyber security resources can make it tempting to focus entirely on the newest AI threats while overlooking basic weaknesses. Attackers do not necessarily need an AI-specific vulnerability if a conventional security weakness provides an easier route into the organisation.

AI Governance, Compliance and Data Protection

AI security cannot be considered separately from governance.

Businesses using AI need to understand which laws, contractual obligations, regulatory expectations and internal policies apply to their particular use case.

Data protection is especially relevant where AI systems process information about identifiable individuals. The ICO’s guidance explains how organisations should consider data protection requirements when developing or deploying AI.

However, businesses should avoid assuming that every AI application has exactly the same legal requirements. The appropriate obligations depend on factors including the type of information processed, the purpose of processing, the organisation’s role and the characteristics of the AI system.

Security teams should therefore work with appropriate legal, compliance and data protection specialists when AI is being deployed for significant or sensitive purposes.

The Future of AI and Cyber Security in the UK

The relationship between AI and cyber security will continue to evolve.

Some developments are already established, while others remain emerging areas where businesses should monitor the evidence rather than assume a particular outcome.

Agentic AI is one area attracting increasing attention. As AI systems gain the ability to use tools and perform multi-step tasks, organisations will need to consider not only whether the model produces a correct answer but whether the system can safely act.

The UK Government is also developing its AI cyber security policy and research base. Its AI cyber security collection includes research on AI security standards, AI and software security and the wider AI security services market.

Internationally, NIST continues to develop risk-management resources for AI. Its Generative AI Profile provides a framework for identifying and managing risks associated with generative AI, while NIST is also developing work specifically addressing the intersection of AI and cyber security.

For UK businesses, the practical lesson is that AI governance should not be a one-off project.

Models change. Suppliers change. Employees discover new tools. AI agents gain new capabilities. Business systems become more interconnected.

Security controls therefore need to evolve alongside the technology.

What Businesses Should Do Now

Organisations do not need to wait for a perfect AI security framework before taking action.

A sensible starting point is to understand the current situation.

1. Identify every AI service currently being used.
2. Determine what business information each service can access.
3. Identify whether employees are using unapproved AI tools.
4. Review the permissions assigned to AI applications and agents.
5. Assess third-party AI suppliers.
6. Introduce clear AI usage policies.
7. Train employees on AI-specific threats.
8. Test important AI applications for security weaknesses.
9. Update incident response plans.
10. Review AI security regularly as technology and business processes change.

Businesses should also prioritise their actions according to risk. A public-facing chatbot with no access to sensitive information may require a different security approach from an AI agent connected to customer databases and financial systems.

This means AI security should be proportionate. Not every application requires the same controls, but every application should have a clear understanding of its purpose, data access, permissions and potential consequences of compromise.

Questions Business Leaders Should Ask About AI

Senior leaders can improve AI governance by asking straightforward questions:

• Where is our business currently using AI?
• Are employees using AI tools that have not been approved?
• What confidential information is being processed?
• Which AI suppliers have access to our information?
• Can any AI system take actions without human approval?
• What happens if an AI system is manipulated?
• Can we detect inappropriate AI activity?
• Could an AI supplier outage affect a critical business process?
• Do our contracts address security and data protection?
• Have we included AI in our incident response plans?
• When was our AI risk assessment last reviewed?

These questions do not require a board to understand the technical details of machine learning. They help establish whether the organisation understands its exposure and has appropriate accountability.

Artificial intelligence is changing the cyber security landscape for UK businesses, but the answer is not to treat AI as inherently unsafe or to assume that every AI-related threat is futuristic.

The most useful approach is risk-based.

Businesses should understand how they are using AI, what information the technology can access, what actions it can take and which suppliers sit behind it. They should combine conventional cyber security controls with AI-specific measures addressing prompt injection, data poisoning, information disclosure, supply-chain risks, excessive permissions and unreliable outputs.

AI agents deserve particular attention because systems capable of taking autonomous actions can turn an incorrect or manipulated instruction into a real-world business event. Appropriate permissions, sandboxing, monitoring, testing and human approval can help reduce that risk.

For UK organisations, AI security should also be connected to wider governance, data protection and cyber resilience. The NCSC, UK Government and ICO have published resources that can help organisations understand and manage these risks.

Ultimately, the objective is not simply to prevent businesses from using artificial intelligence. It is to ensure that AI can be adopted in a controlled, secure and responsible way without unnecessarily exposing the organisation, its employees, customers or suppliers to avoidable cyber threats.

The businesses that approach AI security effectively will not necessarily be those that use the least artificial intelligence. They will be the organisations that understand where AI creates value, where it creates risk and what controls are necessary to keep that risk within acceptable boundaries.

Sources and Useful Websites

• National Cyber Security Centre – AI and cyber security: what you need to know
• National Cyber Security Centre – Managing the cyber risk of agentic AI
• National Cyber Security Centre – Thinking about the security of AI systems
• GOV.UK – AI Cyber Security Code of Practice
• GOV.UK – AI cyber threats: open letter to business leaders
• GOV.UK – AI Risk Management Toolkit
• GOV.UK – Cyber security guidance for business
• GOV.UK – Cyber Governance Code of Practice
• Information Commissioner’s Office – Artificial intelligence and data protection
• OWASP GenAI Security Project – Top 10 Risks for LLM and Generative AI Applications
• NIST – Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
• NIST – AI Risk Management Framework
• CISA and NCSC – Guidelines for Secure AI System Development

Frequently Asked Questions About AI Cyber Security

What are the biggest AI cyber security risks for UK businesses?

Key risks include prompt injection, sensitive information disclosure, data poisoning, insecure AI integrations, excessive AI permissions, supply-chain vulnerabilities, AI-enabled phishing, deepfake impersonation and the unintended behaviour of AI agents. The specific risk depends on how the organisation uses AI and what systems and data the technology can access.

Can AI be used to improve cyber attacks?

Yes. AI can assist with activities such as generating convincing communications, analysing information and supporting certain technical tasks. The UK Government warned UK business leaders in 2026 that advances in AI are changing the cyber threat environment. However, many AI-assisted attacks still rely on established attack methods and conventional security weaknesses.

What is prompt injection?

Prompt injection is an attack in which malicious input attempts to influence an AI system to behave in an unintended way. The risk becomes particularly important when an AI application can access confidential information or interact with external systems.

What is shadow AI?

Shadow AI refers to employees using AI services without appropriate organisational approval or oversight. It can create data protection, confidentiality, security and compliance risks because the business may not know what information has been submitted or how the service processes it.

Are AI agents more risky than ordinary AI chatbots?

They can introduce additional security considerations because agents may be able to use tools, access systems and take actions. The potential impact of an error or successful manipulation can therefore be greater. The NCSC recommends safeguards, sandboxing, clear constraints and active oversight when deploying agentic AI.

Can Cyber Essentials protect a business against AI attacks?

Cyber Essentials is not an AI-specific security framework, but foundational cyber security remains important when defending against AI-enabled threats. Strong authentication, secure configuration, access control, patching and other basic measures can reduce exposure to many conventional attack routes that may also be used in AI-assisted campaigns.

Should UK businesses ban employees from using AI?

A blanket ban is not necessarily the only approach. Businesses should assess their individual risks and establish clear rules covering approved tools, permitted data, security controls and acceptable use. Where AI can deliver legitimate business value, controlled adoption can be preferable to unmanaged use that occurs without the organisation’s knowledge.

How can a business protect confidential information when using AI?

Start by understanding what data each AI service processes and establishing which information employees are permitted to enter. Use data classification, access controls, approved services, contractual due diligence and appropriate technical safeguards. Personal data processed through AI systems should also be assessed against applicable UK data protection requirements.

What should a business do if an AI system behaves unexpectedly?

The response depends on the system and the potential impact. Organisations should have a documented incident process covering who can suspend the system, revoke credentials or permissions, preserve relevant logs, investigate the event and communicate with affected parties. AI-related incidents should be incorporated into the wider business incident response plan.

Is AI cyber security only a problem for large organisations?

No. Smaller businesses may use AI services, handle sensitive information and rely on third-party technology just like larger organisations. The scale and complexity of the controls will vary, but every organisation should understand which AI systems it uses, what data they access and what could happen if they were compromised or misused.