NCSC warns AI ransomware could hit UK infrastructure by 2028

The UK’s National Cyber Security Centre (NCSC) says AI-powered malicious software is “highly likely” to be used in financially motivated attacks on critical national infrastructure by 2028. The warning covers facilities including power stations, airports and hospitals. The NCSC also expects states such as Russia and China to use AI routinely in cyber operations.

Chief executive Richard Horne said AI could help attackers find and exploit long-standing weaknesses at a scale that was previously unimaginable, raising the prospect of a sharp increase in cyber incidents. He stressed that AI had not invented new attack methods: risks include outdated systems, delayed upgrades, insecure technology and services, excessive access and inadequate monitoring.

At the launch of the NCSC’s annual review in London on 3 November, Horne said the agency had sent 110,000 proactive notifications and Early Warning alerts to UK organisations in response to PHP vulnerabilities. He pointed to government cyber and AI security investments, including funding for a national Cyber Shield, a National Exposure and Real-Time Vulnerability Centre and an AI Security Institute.

The government has also announced a National Agentic Security Unit to monitor and respond to uncontrolled AI bots, and a 75% discount on Cyber Essentials certification for micro, small and medium-sized businesses.

Bridewell chief executive Anthony Young said the NCSC’s two-year warning “feels generous”, arguing that attackers are already using AI and that vulnerability discovery is outpacing some organisations’ ability to test and deploy patches. He cited attacks on supermarket refrigeration systems as an example of risks to connected operational technology. The NCSC urged organisations to assess their cybersecurity and use established tools and standards to improve resilience.