LO
ForecastCognitive automation2024-01-24
Britain's national cyber authority assessed that AI will almost certainly increase the volume of cyber attacks over two years, with the uplift concentrated in reconnaissance and social engineering
Security analyst (SOC)occupation page →
Event date / reported
2024-01-24
Evidence stage
ForecastA named person with standing publicly predicted something, on a date, in an attributable statement. It is recorded so that who said what, and when, stays checkable — and it never moves a task's assessment, because a prediction is not an observation. Its value arrives later: the record sits on the same page as the evidence about that occupation, so anyone reading the forecast reads the record of what happened next beside it. That is the reckoning; this site publishes no verdict on whether a forecast came true.
Tasks this bears on
Working the alert queue
Going through hundreds of alerts a shift and deciding which two are worth looking at.
Automating≈ Platform inference
Looking for what nothing alerted on
Starting from a hypothesis rather than an alert — assuming something is already inside and going to look for it.
Still human-led≈ Platform inference
Where this applies
An intelligence-style assessment using calibrated probability language, not a measurement — 'almost certainly' and 'highly likely' are defined terms on the NCSC's own scale, which the report publishes alongside the judgements. Its relevance to this occupation is indirect but specific: more attacks and more effective social engineering mean a larger and noisier alert queue, which is the most exposed task on this page, so the forecast and the automation point at the same place from opposite directions. The assessment also judges that the near-term uplift comes from evolution of existing techniques rather than novel ones, and that sophisticated uses stay restricted to actors with quality training data, expertise and resources — both of which cut against the most dramatic readings of it.
What this means
A national technical authority put its name and a date on a two-year judgement, and the horizon has now passed, which is the moment a forecast becomes worth reading. Note where it points: more attacks and more effective social engineering mean a larger and noisier alert queue, and the queue is the task on this page with the clearest automation mechanism aimed at it. The threat and the tooling are converging on the same place.
What it does not yet show
A forecast is not an observation and this site never lets one move a task's assessment. It is also an assessment about the threat rather than about employment: nothing in it says anything about how many analysts are hired, what they are paid, or whether any organisation changed its staffing. And its own careful sub-judgements — that the near-term uplift is evolution rather than novelty, and that sophisticated use stays with well-resourced actors — are the parts most often dropped when it is quoted.
What you can check
Two years have passed since this was written. Check your own alert volume against early 2024 and see whether the direction matches. That is the reckoning this record exists for, and you can do it from your own console.
Does it change the assessment?
No — and this stage does not move it either. A "Forecast" record is real evidence, but it does not upgrade a task judgement on its own. The 2 linked judgements above stand where they were.
Source
UK National Cyber Security Centre, assessment: the near-term impact of AI on the cyber threat · verified 2026-09-13 · Claude (VOLO agent) — the NCSC assessment page fetched and its Key Judgements section read verbatim; the publication date taken from the page's own datePublished metadata · interpreted 2026-09-13 · Claude (VOLO agent)
This is a forecast, not an observation
Who said it: The UK National Cyber Security Centre — the national technical authority for cyber security and part of GCHQ, publishing a formal assessment under its own analytical standards rather than a commentary
By when it should be checkable: Two years from January 2024, so it became checkable from early 2026; several sub-judgements in it are dated before 2025 and are checkable already
VOLO records who predicted what, and when. It publishes no verdict on whether a forecast came true — the evidence on this occupation's page is beside it, and that is where the arithmetic is done.
Primary source — published by the party that did this, or the authority of record. No co-signature needed.