AI shrinks patch windows to minutes, warns UK military cyber chief, as 'hunt forces' head abroad

While many of us are check up on our clients’ two factor authentication protocols and software updates, British military cyber specialists are being sent into partner countries to track down hostile hackers before they can even reach UK defence networks. The officer in charge says the pace of the threat has changed beyond recognition.

Major General Mike Fayers, who leads the Defence Cyber and Electromagnetic Force (DCEMF), called the teams "hunt forces" in an interview with The Times published on Sunday, his first since taking the job. Soldiers, sailors and aviators have been deployed across Europe and Asia, and one mission was under way as he spoke.

He says the operations only happen with the host country's agreement. Teams can go in by land, sea or air, can target state-backed groups or criminal gangs, and often need sign-off from defence secretary Wes Streeting. A typical scenario, Fayers suggested, would be Russian operators using compromised servers in a European country as a launchpad against Britain.

For the insurance market, the most telling part of the interview was vulnerabilities. Fayers said AI is now exploiting weaknesses faster than his teams have ever seen. Flaws that once left "a few days" to fix now demand a response in "double-digit minutes", he said.

That sits awkwardly with a lot of commercial cyber wordings. Insurers typically ask policyholders to declare their patching policies and commit to fixing critical flaws within set timeframes, and coverage disputes become more likely when those commitments slip .

The benchmark most UK firms work to is Cyber Essentials, the government-backed baseline scheme, which gives organisations 14 days to apply critical and high-risk security updates . If a dedicated military team now measures its window in minutes, a business working to that fortnight is in a very different race.

Fayers also admitted he worries that malware is still hiding somewhere in defence systems, waiting to "go bang" if war breaks out. The MoD runs the largest IT estate in government, he said, and some of its operational technology is older than he would like. Anyone who has risk-surveyed a food plant or a distribution warehouse will know the feeling.

Read : Fridge hackers reach the UK - and the coverage gap comes with them

The fridge attacks come

The interview comes after a month in which hackers repeatedly took over internet-connected refrigeration across Europe. Somewhere between 350 and 700 French supermarkets lost stock overnight on 11 to 12 October, depending on whose count you use. A second wave hit stores in at least seven countries at the start of November, and a small number of UK meat processors were caught up, although the National Cyber Security Centre (NCSC) said the national impact was minimal.

On the night of 1 to 2 November, attackers also got into cold rooms used by France's national blood service, the Établissement Français du Sang, at three sites run by contractors. Temperature settings were reportedly pushed as high as 110C. The service said no blood products were lost.

Fayers said the blood bank attack showed "the scale and the speed of the challenge" his force faces. NCSC chief executive Richard Horne was blunter last week, describing the fridge attacks as "just the foothills". The French units, he said, had been connected directly to the internet with default passwords, and too many UK organisations had spent decades doing "tech on the cheap".

Read : French fridge hack tests line between cyber and property cover

The refrigeration campaign has already shown how easily a cyber-triggered physical loss falls between two policies. Cyber policies typically exclude physical losses, while property policies with spoilage cover frequently carry cyber exclusions .

Attribution matters too. Since March 2023, Lloyd's has required standalone cyber policies written by its syndicates to exclude losses from state-backed cyber attacks . If investigators eventually trace the fridge campaign to a government, that clause becomes a central question for claims teams.

When the attacks reached the UK, MS Amlin lead cyber underwriter Monica Tigleanu warned that "hospitals, hotels, pharmaceutical and vaccine cold chains, and food manufacturers could all face comparable exposures". The French blood bank incident is exactly that kind of loss. Aon 's David Molony, head of cyber solutions for EMEA, has said most UK retailers do not have the specialist perishable goods cover that would respond, as IB reported .

In May 2025 the MoD said its networks had faced more than 90,000 "sub-threshold" attacks in two years , roughly double the two-year period. The NCSC's 2026 Annual Review logged 1,831 attack reports from UK organisations in the year to August, with 337 needing hands-on support and 80 classed as nationally significant.

Read : NCSC warns of 'unprecedented' rise in cyber incidents, even as serious breaches fall

From the board room to the router

The DCEMF was set up under the 2025 Strategic Defence Review and now numbers more than 700 regulars, reservists and civil servants. Fayers hopes it will grow, but he was clear the military cannot carry the load alone. "This is not just an MoD issue, this is a whole-of-UK challenge," he said.

His own summary was that preparation has to run from the board room to the router at . For brokers heading into renewals, that translates into some practical questions for commercial clients. Which operational kit is reachable from the internet? Who patches it, and how quickly? And has anyone read the cyber and property wordings side by side before the overnight attack, rather than after it?