Britain's National Cyber Security Centre (NCSC) warned on November 3, 2026, that AI-powered malware is highly likely to be used in a ransomware attack against the country's critical national infrastructure by 2028, raising concerns about the security of essential services and the growing capabilities of cybercriminals and hostile states.
The warning, issued alongside the agency's latest annual review, reflects a significant shift in the cybersecurity threat landscape. Artificial intelligence could enable attackers to identify vulnerable systems, develop malicious tools and conduct operations more quickly and at a greater scale than before.
However, the assessment does not mean such an attack has already occurred or that one is inevitable. As The Associated Press reported, the agency's central concern is that AI could make longstanding security weaknesses substantially more dangerous.
How AI Could Make Cyberattacks Faster and Harder to Defend Against
AI is changing cybersecurity primarily by accelerating techniques attackers already use, rather than necessarily creating entirely new methods of intrusion.
According to the NCSC's assessment of AI's impact on cyber threats, malicious actors can use the technology to support reconnaissance, identify software vulnerabilities, produce convincing phishing messages and assist with malicious code development.
Traditionally, identifying weaknesses across complex networks could require substantial time and specialist expertise. AI-assisted tools may reduce some of that workload, potentially enabling attackers to investigate more systems and exploit poorly maintained defenses more rapidly.
That distinction matters because many successful cyberattacks continue to involve known vulnerabilities, stolen credentials, weak access controls or deceptive communications. AI could increase the efficiency of those techniques without eliminating the need for human expertise.
The problem of critical software vulnerabilities requiring emergency security patches illustrates why timely maintenance remains important. AI-assisted vulnerability discovery could reduce the time organizations have to identify and address weaknesses before attackers attempt to exploit them.
Why Human Operators Still Matter
Although AI systems can automate parts of cyber operations, that does not establish that fully autonomous attacks are routinely capable of compromising complex infrastructure without human direction.
Target selection, operational decisions, adapting to unexpected defenses and assessing results can still involve human operators. The NCSC's projections concern how these capabilities may develop through 2028, not proof that every anticipated capability is already deployed at scale.
What the UK's Latest Cybersecurity Figures Reveal
The NCSC's annual review provides context for the warning by documenting the volume and seriousness of cyber incidents affecting British organizations.
During the reporting period from September 1, 2025, through August 31, 2026, the agency received 1,831 reports of cyberattacks. Of those, 337 incidents required NCSC incident-management support, including 80 classified as nationally significant.
These figures, detailed in the agency's incident-management reporting, demonstrate the scale of the existing cybersecurity challenge. They must not, however, be interpreted as 1,831 successful compromises or as evidence that all reported incidents involved artificial intelligence.
The agency also highlighted the substantial economic burden of cybercrime, citing an estimated annual cost of £14.7 billion to the United Kingdom.
That estimate concerns the broader financial impact of cybercrime, rather than losses caused specifically by AI-powered attacks.
For infrastructure operators, the broader warning is that existing security problems could become harder to manage as attackers gain access to faster and more capable tools.
Why Critical Infrastructure Faces Particular Risks
Critical national infrastructure includes systems essential to daily life and economic activity, such as electricity networks, water services, transportation and other vital operations.
Unlike conventional corporate IT systems, some infrastructure environments depend on operational technology that monitors or controls physical equipment. These systems can include industrial controllers, sensors, refrigeration equipment and other machinery connected to wider networks.
A cybersecurity incident affecting such equipment may create consequences beyond stolen information or disrupted office computers. Depending on the systems involved and the effectiveness of protective controls, an intrusion could interfere with physical processes or interrupt services.
Recent attacks affecting supermarket refrigeration systems in France illustrate how digital disruption can affect equipment used in ordinary commercial operations. The incidents provide relevant context, but they do not establish that AI was responsible or that an equivalent attack has occurred against British critical infrastructure.
Legacy equipment, incomplete network segmentation and dependence on third-party suppliers can complicate infrastructure security. Some operational systems are also difficult to update without carefully managing the potential consequences for service continuity.
These characteristics can make resilience particularly important, even where organizations have not experienced a confirmed compromise.
What Organizations Can Do Before the Threat Escalates
The NCSC's message is not that organizations must wait for entirely new defensive technology. It is that known weaknesses need greater attention before AI increases the speed at which attackers can exploit them.
Practical priorities include keeping software and devices updated, identifying internet-exposed systems, restricting administrator privileges and applying appropriate access controls.
Organizations also need tested backups, effective monitoring, incident-response procedures and clear visibility into the security of suppliers that can access important systems.
For operational technology environments, protective measures must account for equipment compatibility, safety requirements and the need to maintain essential services during maintenance or recovery.
AI can support defenders by assisting with threat analysis, suspicious activity detection and vulnerability prioritization. However, automated tools do not eliminate the need for reliable security practices, skilled personnel or human oversight.
As Reuters reported, NCSC Chief Executive Richard Horne warned that decades of underinvestment in technology and cybersecurity had left organizations and supply chains exposed to weaknesses that AI could help attackers discover and exploit more efficiently.
The concern extends beyond large infrastructure operators. Smaller suppliers and service providers can become important parts of the security picture when they maintain connections to essential systems.
What the 2028 Forecast Does—and Does Not—Mean
The NCSC's prediction is a forward-looking intelligence assessment. Its judgment that AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028 expresses an assessed probability, not certainty.
It does not identify a guaranteed target, establish an exact date or demonstrate that a particular infrastructure operator has already been compromised through the capabilities described in the forecast.
British officials have also highlighted cyber threats associated with state-linked actors, including China and Russia. Such assessments concern the capabilities and activities attributed to particular actors and should not be confused with independent proof that those actors will carry out the specific attack predicted for 2028.
Developments worth monitoring include evidence of AI-assisted intrusions affecting operational technology, the emergence of more autonomous malicious tools, confirmed exploitation of critical vulnerabilities and changes in official defensive guidance.
Ultimately, the warning identifies a potentially dangerous imbalance: attackers may be able to exploit familiar weaknesses faster than inadequately prepared organizations can correct them. Whether that risk produces a major infrastructure incident will depend on future attacker capabilities, defensive investment and the effectiveness of security measures implemented before 2028.
0 Comments