AI-powered malware is “highly likely” to be used in a ransomware attack on the UK’s critical national infrastructure before the end of 2028, the National Cyber Security Centre said on 3 November. The judgement comes from a new assessment, Artificial intelligence and cyber intrusion, published alongside the NCSC’s annual review.
Launching the review, NCSC chief executive Richard Horne said the danger comes less from new kinds of attack than from old weaknesses that AI will find faster. “For decades we have collectively got away with tech on the cheap,” he said in his speech. He also argued that AI “has the potential to be one of the greatest opportunities in cyber defence”, and the government has put new money behind that idea.
In brief
- The NCSC judges it “highly likely” that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028.
- Horne says AI will mainly expose existing weaknesses faster, and calls on organisations to invest in the basics.
- Defences include a £60m Cyber Shield, a £70m NERV Centre, a new AI security centre in Manchester and the Cyber Security and Resilience Bill.
What the NCSC expects AI-powered malware to do by 2028
The assessment uses the intelligence community’s standard probability language. Its key judgements are that by 2028 it is “highly likely” that Russia, China and other nation states “will routinely use AI-cyber to achieve their geopolitical goals”, and “almost certain that many systems will remain vulnerable to attack from AI-cyber tools”. It is “likely” that attackers will turn AI on “known vulnerabilities in critical national infrastructure (CNI) legacy technology”, and on the new openings created when CNI operators deploy AI tools themselves.
The report sets out three scenarios, which it stresses “are not predictions”. In the baseline, defensive AI has shortened the time between a flaw being discovered and being fixed, but “implementation of defensive capabilities in UK CNI lags behind offensive ones”. In the pessimistic case, attackers’ capability “far outstrips the UK’s defensive ability”. In the optimistic case, AI development slows, allowing the UK to replace legacy systems, train its workforce and build “a robust regulatory framework”. The report warns that “the prospect for surprise is high.”
In his speech, Horne said China “highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure”. He listed the physical systems at stake: “Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating, refrigeration controls.”
Old weaknesses, found faster
Horne was explicit that the expected rise in incidents “is not because AI has invented new ways to attack us”. Instead, AI is getting better at finding long-standing flaws at scale. He said the Linux Kernel Project alone “patched more than a thousand vulnerabilities last month”, and that the NCSC had sent more than 110,000 proactive notifications and Early Warning alerts to UK organisations after a single PHP vulnerability.
The NCSC’s news release sets out what Horne wants from organisations: invest properly in their technology, keep systems off the internet unless they need to be connected, and treat Cyber Essentials as “the starting point for cyber security, not the end goal”.
The defences being built
The government’s response leans on AI as a defensive tool. On 24 October the Chancellor announced £60m for the first phase of a National Cyber Shield that will use agentic AI to improve UK cyber defences, including a £25m challenge fund for UK AI and security companies and scoping for a regulatory sandbox to deploy agentic security tools across critical infrastructure. A £70m National Exposure and Real-Time Vulnerability (NERV) Centre will use AI to find vulnerabilities across critical infrastructure and the economy. The NCSC will also run a new AI Cyber Security Centre of Excellence in Manchester.
“We’re using the power of AI to help stay ahead of those who seek to do us harm,” Security Minister Dan Jarvis said in the release. On the regulatory side, Horne said the Cyber Security and Resilience Bill “will establish a minimum level of resilience across our critical national infrastructure”, and the release points to a forthcoming National Cyber Action Plan. The NCSC’s posts on X on launch day promoted the Cyber Shield alongside the Department for Culture, Media and Sport.
The threat is real, but the fix is mostly unglamorous
The headline judgement is stark, but the report’s own logic points to a defence that is mostly within reach. If AI’s main effect is to find known weaknesses in old systems faster, then the most effective response is the dull work Horne listed: patching, replacing legacy kit, taking systems offline that need not be online, and meeting basic standards. That fits recent cases. The SafePay ransomware group hit 600 victims through old flaws, and inspectors recently found police data suppliers hit by multiple cyberattacks, a reminder of how exposed supply chains already are.
The new money is meaningful but modest against the scale of the job. The £60m Cyber Shield is a first phase, the sandbox is still being scoped, and the Action Plan has not been published. The Cyber Security and Resilience Bill sets minimum standards but will take time to bite, and the government is also consulting on who is liable for breaches. The report’s baseline scenario, in which defensive tools exist but CNI is slow to adopt them, describes the gap the UK most needs to close. The scenario framing matters here: the outcome by 2028 depends partly on how quickly operators act, not only on what attackers can do.
The Action Plan is the next marker
The next test is the National Cyber Action Plan, which Horne said is “to be announced soon”, and the Bill’s passage through Parliament. Both will show whether the UK’s defences can keep pace with the attacks the NCSC now expects within two years.
Sources
- NCSC: “Artificial intelligence and cyber intrusion”, 3 November 2026 (official assessment)
- NCSC: “Richard Horne’s speech at the NCSC Annual Review 2026 launch”, 3 November 2026 (official speech)
- NCSC: “Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years”, 3 November 2026 (official news release, PDF)
- GOV.UK: “Chancellor unveils Britain’s ambitious plan for AI”, 24 October 2026 (government announcement)
- @NCSC on X: annual review launch, 3 November 2026 (official account)
- @NCSC on X: Cyber Shield, 3 November 2026 (official account)
Related stories
- UK Budget Pledges to Consult on Who Is Liable for Cyber Breaches
- UK Plans £165m AI Biosecurity Drive and £120m for AISI Before Budget
- UK Cyber Security and Resilience Bill: Why MSPs Are About to Become the Front Line
- SafePay Ransomware Hit 600 Victims via Old Flaws, Agencies Warn
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
