NCSC warns AI could fuel UK infrastructure ransomware by 2028

The NCSC warned on 3 November 2026 that AI-powered malware is highly likely to be used in a ransomware attack on the UK’s critical national infrastructure by 2028. Its *State of the Cyber Nation* report says hostile actors’ use of AI is likely to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation over the next two years.

The warning concerns a forecast, not a confirmed attack: NCSC chief executive Dr Richard Horne said AI would not create new ways to attack, but could help attackers find and exploit long-tolerated weaknesses at a scale that was previously unimaginable.

Horne urged organisations to address underinvestment in technology, avoid unnecessary internet connections and use Cyber Essentials as a starting point rather than the limit of their security measures. He called for resilience suited to each organisation’s size, complexity and risks, warning that failures could disrupt essential services and businesses. The report says organisations should make greater use of existing tools, standards and frameworks.

The government has also announced £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre to identify weaknesses across critical infrastructure and the economy, and an AI Cyber Security Centre of Excellence in Manchester.