AI-powered cyber attacks are now expected to break through, according to the UK government. Your IT provider should already be monitoring your systems around the clock and be ready to report an incident within 24 hours. They should also be helping you govern how AI is used across your business. If they can't show you how, now's the time to ask.
On 12 October 2026, the UK's AI minister said a breach of the country's cyber defences by AI is "likely, if not inevitable", while a new law is on its way that will hold IT providers like us to account for how we protect our customers. Below, we explain what's changed and what we're doing about it, then suggest some questions to put to your IT provider.
How AI is making cyber attacks faster
Kanishka Narayan, the UK's AI minister, used his first speech since his role moved to Cabinet level to deliver a blunt message. He said a breach of the UK's cyber defences is "likely, if not inevitable", and announced new work to prepare for serious incidents involving autonomous AI agents 1.
He pointed to an incident in Australia earlier this year, where a rogue AI agent hacked a government website and accessed private data, which shows how the threat has shifted. AI agents can now find weaknesses and exploit them far faster than a human attacker, and they don't stop for the weekend.
The government also said it'll consider strengthening the Cyber Security and Resilience Bill to better protect hospitals and utilities. For any organisation that relies on an IT provider, that bill matters more than most people realise.
How the Cyber Security and Resilience Bill will regulate UK IT providers
The Cyber Security and Resilience Bill is going through the House of Lords, with Royal Assent expected in late 2026. For the first time, managed service providers that monitor, manage or support customer systems are likely to be regulated, and so are data centres 2.
In practice, that means providers like us will need to do the following:
- Report a significant incident to the regulator and the National Cyber Security Centre within 24 hours, with a full report within 72 hours
- Tell affected customers when an incident touches them
- Treat a breach of confidentiality or data integrity as seriously as an outage
The most serious failures can bring fines of up to £17 million or 4% of global turnover, whichever is higher. The detail will be set in secondary legislation, and most of the rules are expected to take effect around 2028.
We think that's good news because your IT provider holds the keys to your systems, and if they're attacked, you're attacked. The new law makes sure providers are held to the standard their customers already expect.
How Wavenet is preparing for AI-powered attached and new regulation
We're not waiting for the secondary legislation to tell us what good looks like, so we're focusing on the following areas.
- Watching around the clock. Our CyberGuard Security Operations Centre monitors customer systems 24/7/365, using threat detection, managed detection and response, and SIEM monitoring. AI-driven attacks move quickly, so our team is set up to respond quickly too.
- Responding when incidents happen. Our CyberGuard incident response team is available 24/7/365 to help investigate incidents and restore operations. We also help customers plan and manage communications during an incident.
- Using AI to support threat detection. Our managed SOC combines AI and machine learning tools with security analysts who review and investigate alerts. These tools help identify unusual activity across large volumes of security data, supporting the team’s investigation and response.
- Keeping data close to home. Wavenet Cloud runs in UK datacentres on HPE GreenLake, so customers can keep critical data and workloads under UK jurisdiction.
- Testing regularly. Penetration testing, vulnerability management and Cyber Essentials Plus help customers find weak spots before an attacker does.
- Helping customers use AI safely. Our Copilot Readiness Assessments and Copilot Launchpad programme help you assess security readiness and put governance in place before a wider rollout. That preparation includes reviewing access permissions and how sensitive information is protected, so Copilot doesn’t make existing oversharing problems easier to exploit.
When something does go wrong, our CyberGuard incident response team is on hand to contain it and get you running again.
Seven questions to ask your IT provider about AI cyber security
You don't need to be a security expert to hold your provider to account. Start with these questions.
1. Who's watching our systems at 3am on a Sunday?
Look for a named security operations centre that works 24/7.
2. How fast would you tell us about a breach?
The new law sets 24 hours for the regulator, so your provider should be able to tell you their process today.
3. Are you ready for the Cyber Security and Resilience Bill?
If they haven't started preparing, that tells you something about how ready they are.
4. How are you using AI to detect attacks?
Attackers are using it, so defenders need to use it too.
5. Where is our data stored, and under which country's laws?
This matters more as AI tools handle more of your information.
6. What happens before we switch on AI tools like Copilot?
Someone should check who can see what. AI tools surface any data a user has permission to access, including data they shouldn't.
7. When did you last test our defences?
Ask for the date of the last penetration test and what was fixed afterwards.
If you get vague answers to the above or none at all, it's worth a second opinion.
How to start protecting your business from AI-powered attacks
The minister's warning is a good prompt to check your defences. Many attacks still get in through basic gaps such as unpatched systems or weak access controls, and AI just makes those gaps easier to find.
Start with the seven questions above. If your provider can answer them clearly, great. If not, we'd be happy to help you work out where the gaps are.
Find out how ready your business is for AI-powered attacks. Talk to our CyberGuard team today.
Frequently asked questions
How can a 24/7 security operations centre protect my business from AI-powered attacks ?
AI-powered attacks can find and exploit weaknesses in minutes, at any time of day. A managed security operations centre (SOC) monitors your systems around the clock, so suspicious activity is investigated and contained before it causes damage. Find out more about our managed SOC services.
What does the Cyber Security and Resilience Bill mean for my IT provider ?
Managed service providers are likely to be regulated for the first time, with 24-hour incident reporting and fines for the most serious failures. Ask your provider how they're preparing, and look for one with 24/7 monitoring and a tested incident response plan. Explore our managed security services.
What should I do if my business is hit by a cyber attack ?
Act quickly to contain the threat and keep a record of what happened. If your organisation is regulated, you may also have reporting deadlines to meet. Our CyberGuard incident response team is available 24/7/365 to help you contain an attack and recover.
How often should my business carry out penetration testing ?
Most organisations test at least once a year, and again after significant changes such as a new system or a cloud migration. Regular testing shows you where an attacker could get in, so you can fix it first. Find out more about our penetration testing services.
How do I make sure Microsoft Copilot is safe to roll out ?
Copilot can surface any data a user has permission to access, so review access permissions and data governance before a wider rollout. A Microsoft 365 Copilot readiness assessment shows you where the gaps are and what to fix first.
Sources
1. ITV News: https://www.itv.com/news/2026-10-12/ai-breach-of-uk-cyber-defences-likely-if-not-inevitable-minister-warns2. Compliance Hub: https://compliancehub.wiki/uk-cyber-security-resilience-bill-lords-committee-september-2026-msp-data-centre-scope/
