PDF LINK
#19,122
In July of 2015, in The Lloyd’s Business Blackout Scenario, we looked at the impact of a prolonged grid down disaster brought on by a deliberate cyber attack, which they describe as:
The report depicts a scenario where hackers shut down parts of the US power grid, plunging 15 US states and Washington DC into darkness and leaves 93 million people without power.
Experts predict it would result in a rise in mortality rates as health and safety systems fail; a decline in trade as ports shut down; disruption to water supplies as electric pumps fail and chaos to transport networks as infrastructure collapses.
Two years later, in DHS: NIAC Cyber Threat Report - August 2017, we looked at the President's National Infrastructure Advisory Council's 45-page report on the urgent cyber threats to our critical infrastructure.
Again in 2018, we looked at another Presidential Advisory report (see NIAC: Surviving A Catastrophic Power Outage), which warned:
![]() |
| https://www.hsdl.org/?view&did=819354 |
What is a catastrophic power outage?• Events beyond modern experience that exhaust or exceed mutual aid capabilities
• Likely to be no-notice or limited-notice events that could be complicated by a cyber-physical attack
• Long duration, lasting several weeks to months due to physical infrastructure damage
• Affects a broad geographic area, covering multiple states or regions and affecting tens of millions of people
• Causes severe cascading impacts that force critical sectors—drinking water and wastewater systems, communications, transportation, healthcare, and financial services—to operate in a degraded state
(Excerpt From Dec 2018 NIAC Report)
In 2022 we looked at two reports issued by the White House on the very real risks of increased cyber attacks against both the private and public sector, which could have profound economic, and societal impacts.
While most of these attacks are thwarted, last year the FBI reported that in 2024, their Internet Crime Complaint Center (IC3) reported 859,532 complaints of cybercrime in the US in 2024, resulting in over $16 billion in losses - a 33% increase in losses from 2023.Fast forward to 2026, and AI (artificial intelligence) apps are already being used to improve the ability of bad actors to hack sophisticated systems (see NBC News Report).
While primarily used as a `force multiplier' until now, the next generation of AI (aka `Mythos') - announced April 7th by Anthropic - has been deemed by its creators to be too dangerous to release to the general public.
This has raised considerable concern around the world, as numerous other AI systems are under development, and it is likely that more will achieve this level of sophistication (read:danger) in the months ahead.
Which brings us to the following UK Government statement on the risks of `Mythos', and the evolving threat from AI tools.
AI cyber threats: open letter to business leaders (HTML)
Published 15 April 2026
The Rt Hon Liz Kendall MP
Secretary of State for Science, Innovation and Technology
22-26 Whitehall
London SW1A 2EG
The Rt Hon Dan Jarvis MP
Minister of State for the Cabinet Office
70 Whitehall
London
SW1A 2AS
15 April 2026
Dear business leaders,
Open letter to businesses on AI cyber threats
We are writing to you because the threat your business faces in cyber space is changing, and the way we respond must change with it.
For years, the most serious cyber attacks have relied on a small number of highly skilled criminals. That is now shifting. A new generation of AI models are becoming capable of doing work that previously required rare expertise: finding weaknesses in software, writing the code to exploit them, and doing so at a speed and scale that would have been impossible even a year ago.
Last week, AI firm Anthropic announced a new model called Mythos. Testing by DSIT’s AI Security Institute (AISI) - one of the world’s leading bodies for evaluating the capabilities of Frontier AI - has found it to be substantially more capable at cyber offence than any model we have previously assessed. Recent tests of advanced AI models, including the AISI’s evaluation of Anthropic’s Mythos, indicate that AI cyber capabilities are accelerating even faster than had been previously envisaged. The AISI assess that frontier model capabilities are doubling every 4 months, compared to every 8 months previously.
This finding is significant both for what it means today, but also because it highlights the speed at which AI capabilities are increasing and the threats they potentially pose. OpenAI also announced scaling up their Trusted Access for Cyber program last night, showing that AI’s accelerating impact on cyber is not isolated to a single company, and we expect more to follow. The trajectory is clear and therefore it is vital that we are prepared for frontier AI model capabilities to rapidly increase over the next year, and plan accordingly for that outcome.
The UK is not standing still in response to this threat. We have built the AI Security Institute, the most advanced capability of any government in the world for understanding frontier AI systems. This ensures that your government can have an independently verified, robust assessment of current capabilities.
More broadly, the National Cyber Security Centre, part of GCHQ, is world-leading in defending the UK online, and continues to publish practical guidance every business can use. The Cyber Security and Resilience Bill, which is currently progressing through Parliament, will strengthen protections for critical services – from the NHS to the energy system – that we all rely on, and shortly we will publish the National Cyber Action Plan setting out the steps this government will take to ensure the UK’s national security against cyber threats.
Government action alone will not be enough. Every business in the UK has a part of play. Criminals will not just target government systems and critical infrastructure. They will target ordinary companies, of every size, in every sector. Attackers go where defences are weakest.
The steps organisations should take to protect against AI-driven cyber threats are the same cyber hygiene measures recommended for traditional cyber threats. We are asking every business leader reading this to take the following steps:
1. Take cyber security seriously, at the very top of your organisation.
If your board has not recently discussed cyber risk, do so at your next meeting and then regularly. This is not an issue to delegate to your IT team and forget about. This will only become increasingly important. We urge you and your board to use the Cyber Governance Code of Practice to ensure your organisation is sufficiently protected. Smaller businesses should also use the NCSC’s Cyber Action Toolkit to help them build their cyber protection. Not all incidents can be prevented, so you should plan and rehearse how your organisation would respond to a significant incident, including consideration of how cyber insurance can support response and recovery. Free cyber insurance is available to small organisations that obtain Cyber Essentials.
2. Get the basics right with Cyber Essentials.
Most successful cyber-attacks exploit simple weaknesses: outdated software, weak passwords, missing backups. Cyber Essentials is the government-backed certification scheme that protects against the most common attacks. Organisations that hold it are significantly less likely to suffer a damaging cyber incident. For most businesses, getting certified is neither expensive nor difficult. You should also look to embed Cyber Essential requirements across your supply chains, and large organisations should use the NCSC’s Cyber Assessment Framework.
3. Follow NCSC advice and sign up to their Early Warning Service.
The National Cyber Security Centre (NCSC) provides free, practical advice, training and guidance at ncsc.gov.uk, for organisations of every size. Advice will also be issued by Regulators for regulated sectors. Early Warning is a free service from NCSC, which can inform organisations of potential cyber attacks and give them invaluable time to act before an incident escalates.
We are entering a period in which the pace of technological change may test every institution in the country. The businesses that act now – that treat cyber security as an essential part of running a modern company, not an optional extra – will be the ones best placed to thrive through it and seize its advantages. We urge you to be among them.
Yours sincerely,
The Rt Hon Liz Kendall MP
Secretary of State for Science, Innovation and Technology
Dan Jarvis MBE MP
Security Minister, Cabinet Office and Home Office
While the internet seems obsessed with the idea that killer robots, or some all-powerful AI overlord will destroy humanity, the reality is that it will probably be humans - using AI. technology for ill-gotten gain - that pose the biggest danger.
While there is very little you and I can do to prevent cyber attacks on large industries or our critical infrastructure, we can be better prepared to deal with its potential impacts.
A few recent blogs on how to prepare for long-term (days or even weeks) power outages, and other disruptions, include:
#NPM: DOE Resource Adequacy Report & Prepping For Power Outages
#NPM25: Preparedness Starts At Home
Denk Vooruit: The Netherlands National Citizen Preparedness Drive
While I can't tell you what disruptions will come, or when they might occur, I can tell you that being prepared - in advance - is the best insurance you and your family can have in an increasingly uncertain world.

