### [AI-powered cyberattacks: a 90‑day CTO plan](https://thepracticalcto.com/blog/ai-powered-cyberattacks-90-day-cto-plan/) **Published:** November 3, 2026 **Author:** Ayan Sarkar **Excerpt:** A 90‑day CTO plan to prepare for AI-powered cyberattacks: identity, segmentation, AI-aware detection, code-signing, and IR rehearsals. **Content:** TECHNOLOGY LEADERSHIP / NOVEMBER 2026 · 5 MIN READ # AI-powered cyberattacks: a 90‑day CTO plan The UK’s cyber authorities have warned that AI-driven threats are moving from theory to timeline. Various reports say the UK should expect AI-shaped attacks on critical infrastructure within two years or by 2028. This is a planning signal, not a reason for panic—so let’s turn it into a focused 90‑day execution plan. IN THIS ARTICLE [What happened: the UK’s warning is now time-bound](#s-1) · [Why this matters for boards and operators](#s-2) · [Prepare for AI-powered cyberattacks: a 90‑day plan](#s-3) · [Costs, governance and operating model choices](#s-4) · [What CTOs should do this week](#s-5) KEY TAKEAWAYS 01 Treat AI as an accelerant: tighten identity, segment crown jewels, and assume faster, more tailored intrusions. 02 Deploy AI-aware detection and model-assisted SOC playbooks to keep pace with attacker speed. 03 Rehearse incident response for AI-enabled intrusions; codify code-signing and supply chain controls. ## What happened: the UK’s warning is now time-bound AI-powered cyberattacks are no longer abstract. Multiple outlets report that the UK should expect AI-shaped attacks on critical infrastructure within a defined window. The [National Cyber Security Centre](https://news.google.com/rss/articles/CBMirgFBVV95cUxQV24yNXJ1SVVXeXI4VUJvQ1hUYmhiXzBueTc4cERpTmV5V0w2U3UzNG5qS1VVMVphVWRHU2xoVVNJUVZjUDY3dWtKWVU4ZTYyN25KTTVNa2hRYUNkODFCTnVXR1M5Mm55bXNjallpaWtSM2c0VVdKYk1sTERQUEc3bmN1MWMyRGV4eGgtazdGSExtMVJBY1JvXzVoUjhWLUtrNmNlZmcybnNZTlAzcEE?oc=5), [Reuters](https://news.google.com/rss/articles/CBMizgFBVV95cUxQTjFmQ0ExbUxlWldEekp5T3NVZUc2Mm92VzBUdzJBUUtGVHJjVEhzRmRPSXJTaW1SdFJRTDd0SDNhWGxfc0VJOXJSSFBzX1NfWTVYU2I4Xy1Xa1FPajdrOWVMOHhMeVF2cFlvRGhReXZnOHdRLWxkTGQzV2d5MjBRNkFzZmNick93VXZIdXJSbTk4OWNadkFkUW41RjJCME9FdlZ5ZGFMV0NMM2FuQnRTSmNGcktqR0pNNnZsRl9zTmpMbGZ1T1NiZ2MyLW9Qdw?oc=5) and [Computer Weekly](https://news.google.com/rss/articles/CBMirgFBVV95cUxNN2lzMWwxbm5oTWdGLUdnX3JJR21tdHFGTGZpLTljd0tTYjJDdjNVMmF1c1M4ODN6a2d4R2dLTlpJRm9FLXN4MlMzUHVDTU9mWHJ1MnNRRVIwV2pMR24tN3dHdXQ2U3o5NHppSGR6U0lyaFZWVnRxNzhRbGU1V3E1OEFBVTMzOVRYR2NzUDJVSmNrbVVSbEtMRFZiNi1hODR1VXRLeEJmRW1wVnpVSGc?oc=5) report a two‑year horizon; [AP News](https://news.google.com/rss/articles/CBMivAFBVV95cUxNaGx3eWwwYzBFUHZMcktMZFJxU1JEclEyZnZNTDVRNkg3c1dQeEY1WUItTTFhN3ZXZE00dm43MGgxbTR4SU1MZm9KOGpTLUxjTThXX0V1X0N3YXZmVW1BMjVwNnJ1VmY3dTFKaTc3dEZtREN3WDhYWm82UndfWEZnR3BiU0hsN2gweENzRGJxcWVmWnkwMFV2cWsycVQzbU9pNk13R1VWNVM2cWotd25maDdEZldfeF9TRkw5aQ?oc=5) and [The Guardian](https://news.google.com/rss/articles/CBMixwFBVV95cUxObVNSQVUzUFl2ZHdCNlAtOGQtRTVmekF0NUU4cDlHYlFTYkw3U1lPYUpRVmVGQ3hzWnFqcUVEdkV3dlNpWVJoWERHRFgzQVBJXzVjUTZIcUgyMTF1MG5ZZGlHaE52MXhXTEsxQmRxUDhvVkplSUd3MG5FRVUyeGtPczlqZWthYnZDY3NZcmVtUjVKUnZVUjUyNWQ5dFE1UzFNczVyNXQ4V0RGb0JTc214bkotWnRTMXZvbFV0d2o1VjdJOEpXc1hZ?oc=5) point to ‘by 2028,’ with the latter saying AI‑powered malware is ‘highly likely’ to be used against UK infrastructure by then. The tempo is already rising: the UK faces an ‘unprecedented rise’ in cyberattacks in the coming months, according to [The Record](https://news.google.com/rss/articles/CBMifEFVX3lxTE1aYmlyQ3g1MFhaQnFWMlNuMGxFOE5obkZ0MzBCcWtsY0Frd2tNVGRCTzNvaTRHZGpudkFKTWxCMEg0S1VicVhLUFRjQncxeWlyRXZIZkpGRDlNSjg1YkdZdUFEQVBvQWlJOXprYjM0MHpNa0E4Q05LYTg4WG8?oc=5). Taken together, these reports are not a forecast to debate; they are a prompt to execute. ## Why this matters for boards and operators For technology leaders, the signal is clear: assume adversaries will use automation and AI to compress dwell time, personalise lures and probe controls at scale. Whether the specific inflection point is ‘within two years’ or ‘by 2028’ as reported by [Reuters](https://news.google.com/rss/articles/CBMizgFBVV95cUxQTjFmQ0ExbUxlWldEekp5T3NVZUc2Mm92VzBUdzJBUUtGVHJjVEhzRmRPSXJTaW1SdFJRTDd0SDNhWGxfc0VJOXJSSFBzX1NfWTVYU2I4Xy1Xa1FPajdrOWVMOHhMeVF2cFlvRGhReXZnOHdRLWxkTGQzV2d5MjBRNkFzZmNick93VXZIdXJSbTk4OWNadkFkUW41RjJCME9FdlZ5ZGFMV0NMM2FuQnRTSmNGcktqR0pNNnZsRl9zTmpMbGZ1T1NiZ2MyLW9Qdw?oc=5) and [AP News](https://news.google.com/rss/articles/CBMivAFBVV95cUxNaGx3eWwwYzBFUHZMcktMZFJxU1JEclEyZnZNTDVRNkg3c1dQeEY1WUItTTFhN3ZXZE00dm43MGgxbTR4SU1MZm9KOGpTLUxjTThXX0V1X0N3YXZmVW1BMjVwNnJ1VmY3dTFKaTc3dEZtREN3WDhYWm82UndfWEZnR3BiU0hsN2gweENzRGJxcWVmWnkwMFV2cWsycVQzbU9pNk13R1VWNVM2cWotd25maDdEZldfeF9TRkw5aQ?oc=5), the preparation window is short. This matters because recovery from attacks on critical infrastructure is not purely a technology task; it is a continuity, safety and trust issue. It affects contracts, insurance, compliance, and public confidence. And it reshapes how we value security investments: controls that slow or contain automated intrusion attempts become directly tied to operational resilience and board‑level risk appetite. In practical terms, the old ‘good enough’ assumptions about identity, segmentation and monitoring will not hold. When attack speed accelerates, the spread between detection and response becomes the decisive metric. Our job is to narrow that spread while hardening the blast radius. AYAN’S TAKE I’d rather over-prepare now than explain later why basic identity, segmentation and detection weren’t in place. ## Prepare for AI-powered cyberattacks: a 90‑day plan Days 0–30: stabilise identity, ring‑fence the crown jewels. • Identity and access: enforce phishing‑resistant MFA for admins, rotate privileged credentials, disable stale accounts, and ensure joiner‑mover‑leaver processes are clean. Map and lock down break‑glass accounts. Wherever feasible, require device trust and conditional access for sensitive operations. • Segmentation: identify your tier‑0 assets and the systems that directly control or monitor operations. Isolate management planes; separate production from corporate IT; restrict east‑west traffic. Implement least privilege on service accounts and APIs touching those assets. The question of who should own these decisions is covered in [Do You Need a CTO Yet?](https://thepracticalcto.com/blog/fractional-virtual-or-full-time-cto/). • Monitoring quick wins: ensure high‑fidelity logging is enabled and retained for identity providers, endpoint protections, and critical network choke points. Baseline admin behaviour. If logs are not trustworthy or centralised, fix that now—nothing else will matter. Days 31–60: add AI-aware detection and harden your software supply chain. • Detection and response: tune detections for unusual admin behaviour, rapid lateral movement and automated reconnaissance patterns. Augment the SOC with model‑assisted playbooks to triage, correlate and respond faster; the aim is to keep pace with attacker velocity, not to chase perfection. • Phishing and social engineering: run targeted simulations that reflect more convincing, adaptive lures. Measure time‑to‑report as much as click‑rate; speed is your friend. Adjust controls (e.g. restricted access for newly observed domains) based on findings. • Software integrity: mandate code‑signing for internal tools, scripts, and deployment artefacts. Validate build pipelines end‑to‑end; restrict who can sign and who can release. Treat unsigned or unexpected binaries as high‑risk by default. Days 61–90: rehearse the worst day and close structural gaps. When the need is senior judgement on specific decisions rather than ongoing leadership, [virtual CTO services](https://thepracticalcto.com/services/virtual-cto/) are the lighter option. • Incident response: run a full exercise that assumes AI‑enabled intrusion paths (for example, rapid password spraying plus tailored phishing plus automated privilege escalation). Include executives, legal and communications. Time each decision point. Update playbooks and SLAs accordingly. • Data and blast radius: review backup immutability, access separation and restore drills for critical systems. Test segmentation under stress: can you operate in degraded mode without reconnecting unsafe networks? • Threat modelling: update scenarios to include automated content generation, LLM-enabled malware and higher‑volume credential attacks. Use them to prioritise control gaps and budget requests. ## Costs, governance and operating model choices Value: the primary return here is reduced time‑to‑detect and smaller blast radius for attacks that are expected to accelerate. The business benefit is continuity under stress. That is measurable: mean time to respond, privileged access reductions, coverage of code‑signed artefacts, and exercise outcomes. Risk: tie this programme to the external signal. Reuters and [Computer Weekly](https://news.google.com/rss/articles/CBMirgFBVV95cUxNN2lzMWwxbm5oTWdGLUdnX3JJR21tdHFGTGZpLTljd0tTYjJDdjNVMmF1c1M4ODN6a2d4R2dLTlpJRm9FLXN4MlMzUHVDTU9mWHJ1MnNRRVIwV2pMR24tN3dHdXQ2U3o5NHppSGR6U0lyaFZWVnRxNzhRbGU1V3E1OEFBVTMzOVRYR2NzUDJVSmNrbVVSbEtMRFZiNi1hODR1VXRLeEJmRW1wVnpVSGc?oc=5) report a two‑year expectation for AI‑powered attacks on UK critical infrastructure, while [AP News](https://news.google.com/rss/articles/CBMivAFBVV95cUxNaGx3eWwwYzBFUHZMcktMZFJxU1JEclEyZnZNTDVRNkg3c1dQeEY1WUItTTFhN3ZXZE00dm43MGgxbTR4SU1MZm9KOGpTLUxjTThXX0V1X0N3YXZmVW1BMjVwNnJ1VmY3dTFKaTc3dEZtREN3WDhYWm82UndfWEZnR3BiU0hsN2gweENzRGJxcWVmWnkwMFV2cWsycVQzbU9pNk13R1VWNVM2cWotd25maDdEZldfeF9TRkw5aQ?oc=5) and [The Guardian](https://news.google.com/rss/articles/CBMixwFBVV95cUxObVNSQVUzUFl2ZHdCNlAtOGQtRTVmekF0NUU4cDlHYlFTYkw3U1lPYUpRVmVGQ3hzWnFqcUVEdkV3dlNpWVJoWERHRFgzQVBJXzVjUTZIcUgyMTF1MG5ZZGlHaE52MXhXTEsxQmRxUDhvVkplSUd3MG5FRVUyeGtPczlqZWthYnZDY3NZcmVtUjVKUnZVUjUyNWQ5dFE1UzFNczVyNXQ4V0RGb0JTc214bkotWnRTMXZvbFV0d2o1VjdJOEpXc1hZ?oc=5) cite ‘by 2028’. Align board risk posture and investment timing with that range. Cost: this is not a new platform binge. Most actions leverage existing identity, network and SOC tooling. Budget for three areas: identity hardening (licensing and engineering effort), logging and storage uplift to keep useful telemetry, and time for realistic exercises. Redirect spending from low‑signal tools to improvements that measurably cut detection and response time. Governance: make this a named programme with executive sponsorship. Assign an accountable owner for identity, segmentation, and detection respectively. Require monthly metrics to the board: percent of privileged accounts on phishing‑resistant MFA; number of unsigned artefacts eliminated; mean time to contain in exercises. Reference the [National Cyber Security Centre](https://news.google.com/rss/articles/CBMirgFBVV95cUxQV24yNXJ1SVVXeXI4VUJvQ1hUYmhiXzBueTc4cERpTmV5V0w2U3UzNG5qS1VVMVphVWRHU2xoVVNJUVZjUDY3dWtKWVU4ZTYyN25KTTVNa2hRYUNkODFCTnVXR1M5Mm55bXNjallpaWtSM2c0VVdKYk1sTERQUEc3bmN1MWMyRGV4eGgtazdGSExtMVJBY1JvXzVoUjhWLUtrNmNlZmcybnNZTlAzcEE?oc=5) warning in risk registers so the timeline stays visible. ## What CTOs should do this week 1\) Convene a 60‑minute session with security, operations and legal to agree the 90‑day plan, owners and metrics. Put exercise dates in diaries now. 2\) Issue two directives: a) all admin accounts must move to phishing‑resistant MFA with device trust where possible; b) all internal executables and scripts must be code‑signed within 60 days, with release gates enforcing it thereafter. 3\) Ask for three one‑page maps: a tier‑0 asset map, the current segmentation of those assets, and the logging coverage for identity, endpoints and network choke points. These will drive immediate prioritisation. 4\) In the SOC, add model‑assisted playbooks for common intrusion steps (privilege escalation, lateral movement, data staging) and measure time‑to‑triage weekly. Pair this with targeted phishing simulations tuned for more convincing content. 5\) Set the expectation with the board: based on reports from [Reuters](https://news.google.com/rss/articles/CBMizgFBVV95cUxQTjFmQ0ExbUxlWldEekp5T3NVZUc2Mm92VzBUdzJBUUtGVHJjVEhzRmRPSXJTaW1SdFJRTDd0SDNhWGxfc0VJOXJSSFBzX1NfWTVYU2I4Xy1Xa1FPajdrOWVMOHhMeVF2cFlvRGhReXZnOHdRLWxkTGQzV2d5MjBRNkFzZmNick93VXZIdXJSbTk4OWNadkFkUW41RjJCME9FdlZ5ZGFMV0NMM2FuQnRTSmNGcktqR0pNNnZsRl9zTmpMbGZ1T1NiZ2MyLW9Qdw?oc=5), [Computer Weekly](https://news.google.com/rss/articles/CBMirgFBVV95cUxNN2lzMWwxbm5oTWdGLUdnX3JJR21tdHFGTGZpLTljd0tTYjJDdjNVMmF1c1M4ODN6a2d4R2dLTlpJRm9FLXN4MlMzUHVDTU9mWHJ1MnNRRVIwV2pMR24tN3dHdXQ2U3o5NHppSGR6U0lyaFZWVnRxNzhRbGU1V3E1OEFBVTMzOVRYR2NzUDJVSmNrbVVSbEtMRFZiNi1hODR1VXRLeEJmRW1wVnpVSGc?oc=5) and [AP News](https://news.google.com/rss/articles/CBMivAFBVV95cUxNaGx3eWwwYzBFUHZMcktMZFJxU1JEclEyZnZNTDVRNkg3c1dQeEY1WUItTTFhN3ZXZE00dm43MGgxbTR4SU1MZm9KOGpTLUxjTThXX0V1X0N3YXZmVW1BMjVwNnJ1VmY3dTFKaTc3dEZtREN3WDhYWm82UndfWEZnR3BiU0hsN2gweENzRGJxcWVmWnkwMFV2cWsycVQzbU9pNk13R1VWNVM2cWotd25maDdEZldfeF9TRkw5aQ?oc=5), the threat window is measured in years, not decades. Your programme should be as time‑bound as the risk. AYAN SARKAR Chief Technology & AI Officer and Co-Founder, Webskitters. Writing about AI strategy, technology architecture and leadership. [Follow on LinkedIn ↗](https://in.linkedin.com/in/ayansarkar-webskitters) [All articles ↗](https://thepracticalcto.com/blog/) READ NEXT TECHNOLOGY LEADERSHIP / THE PRACTICAL CTO ### [Do You Need a CTO Yet? Fractional, Virtual or Full-Time](https://thepracticalcto.com/blog/fractional-virtual-or-full-time-cto/) Not every business needs a full-time CTO, but every business with material technology risk needs someone accountable for it. How to choose the right model. TECHNOLOGY LEADERSHIP / THE PRACTICAL CTO ### [CTO vs CIO vs Chief AI Officer: Who Owns AI?](https://thepracticalcto.com/blog/cto-vs-cio-vs-chief-ai-officer/) CTO vs CIO vs Chief AI Officer, a practical look at what each role owns, why AI cuts across all three, and how to decide who should be accountable in your organisation. [All articles ↗](https://thepracticalcto.com/blog/) [Discuss this thinking ↗](https://thepracticalcto.com/contact/) **Categories:** Technology Leadership ---