UK warns AI cyberattacks could threaten critical infrastructure

Britain’s government is escalating its rhetoric and policy push to shield critical national infrastructure (CNI) from AI-driven cyber threats. On 3 November 2026, officials published cybersecurity policy papers alongside an Autumn Budget 2026 update that allocates almost £200 billion for AI-enabled government cyber projects.

The National Cyber Security Centre (NCSC) warned that it is highly likely AI-powered malware will be used in a ransomware attack against UK CNI between now and 2028, and that China, Russia and other nation states are likely to use AI-enabled cyber tools to pursue geopolitical goals in the UK. The agency also said many systems will remain vulnerable to AI-empowered attacks.

A Manchester-based NCC Group survey of MPs found concerns about the UK’s CNI posture: about half described local risks as not keeping pace, with only 22% confident in the nation's readiness and 47% believing the country would be unprepared to fight off a major CNI attack.

In response, the government is revamping the Network and Information Systems (NIS) framework; the Cyber Security and Resilience Bill, replacing NIS 2018, would extend coverage to data centres, MSPs and certain “critical suppliers”, introduce stricter breach reporting and higher penalties. Separate policy papers outline a new vendor risk management framework addressing national security risks posed by suppliers and agentic AI resilience measures.

The Autumn Budget also pledged £2.4 billion to help micro-, small and medium-sized businesses achieve Cyber Essentials certifications, alongside national facilities like a National Exposure and Real-Time Vulnerability Centre (NERV), a National Cyber Shield for AI-driven defense training, and a National Agentic Security Unit to counter rogue AI.