“The Autumn Budget rightly treats cyber defence as critical national infrastructure, but state-sponsored adversaries aren’t the only threat challenging UK resilience. The (mostly unmanaged) proliferation of AI agents is an immediate vulnerability that is already operating inside British organisations and institutions.

UK enterprises are adding as many as 10,000 autonomous agents each month and the vast majority operate without oversight or control. These systems aren’t malicious, but they are ruthless optimisers. Without effective governance, an agent tasked with solving a problem will find the fastest route to execution, and that will often mean gathering credentials, scraping restricted data or circumventing controls.

If we want to treat AI agents as effective productivity tools, we must also provide the continuous protection our organisations need, to prevent handing the keys to our digital economy to unsupervised machines which are open to manipulation or compromise.”

Jason Bayton, Android Enterprise Expert and Product Lead at NinjaOne: 

“In the first half of this year, 88% of exploitable vulnerabilities occurred within 48 hours of disclosure, and the number of known vulnerabilities has also dramatically increased. That timeline makes it incredibly difficult for organisations using traditional patching techniques to keep up.

Add in the fact that AI models like Claude Mythos can now turn a disclosed CVE into a working exploit in under 11 minutes, and attackers have the upper hand.

Organisations who wait for the next month’s maintenance window to patch and update software, run on stale data and miss the opportunity to remediate.”