NCSC warns AI-powered ransomware attacks on UK infrastructure likely by 2028

The National Cyber Security Centre, part of GCHQ, published its annual threat assessment, the State of the Cyber Nation report, on Nov. 3, 2026 and warned that AI-powered malware is highly likely to be used in ransomware attacks on Britain’s critical national infrastructure by 2028.

In his speech accompanying the report, NCSC Chief Executive Dr Richard Horne warned of a rise in cyber incidents in the coming months, and said the cause is not new AI attack methods but the discovery and exploitation of long-tolerated vulnerabilities at a new scale. “For decades, we have collectively got away with doing tech on the cheap,” Horne said. He added that organisations must treat security and resilience as a fundamental requirement rather than an afterthought.

The NCSC expects hostile actors using AI to expand the scale and speed of ransomware attacks, social engineering and vulnerability exploitation within the next two years. The agency said AI will help attackers scout targets and locate weaknesses in IT networks, and that the technology also writes malicious code to enhance the ransomware threat. The NCSC also warned that China and Russia will routinely use AI in their cyber operations by 2028. Ransomware cartels typically operating out of former Soviet Union states encrypt victims’ files with bespoke malware and demand cryptocurrency payments to unlock systems and return stolen data.

The annual report says AI is exposing years of technical debt and a failure to implement basic cyber protections rather than creating the weaknesses themselves. Horne urged organisations to address underinvestment in technology, avoid connecting technology unnecessarily to the internet, and make Cyber Essentials the starting point rather than the end goal for cybersecurity.

Britain’s critical national infrastructure includes energy, transport, defence, food, health and finance. Horne said British military communications networks face daily persistent and sustained attacks, with Russia among the perpetrators, and that Moscow’s campaigns stay below the threshold of armed conflict. He also cited European supermarket fridges heated by hackers to above 50C as a warning that companies and organisations should invest heavily in cyber resilience.

Recent discoveries show the vulnerability transformation is accelerating. Last month AI helped find a critical flaw in PHP, a computer language behind nearly 70 percent of websites worldwide. The Linux kernel project patched more than a thousand vulnerabilities last month, while technology providers are fixing hundreds of vulnerabilities in one update. The NCSC said state-sponsored hacks often use internet-facing applications and exploit vulnerabilities with available patches that have not been deployed quickly enough.

The government announced £60 million for the first phase of Cyber Shield, £70 million for the National Exposure and Real-Time Vulnerability Centre, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC. The NERV Centre will use AI to find vulnerabilities across critical infrastructure and the economy, expanding on current NCSC projects. The first phase of Cyber Shield will focus on detecting and blocking attacks, with the NCSC providing the platform and threat intelligence while security companies and open-source developers build AI agents.

Project DROMOS, first planned as a four-week pilot, was expanded into live government settings and uncovered hundreds of possible security flaws including critical vulnerabilities. The government is testing frontier AI systems to find weaknesses in its own networks. The NCSC said defenders will keep the structural advantage as AI transforms cybersecurity because they own and can change their environments, but the advantage is not guaranteed and needs clear direction, funding and disciplined adoption.

The Cyber Security and Resilience Bill and the forthcoming National Cyber Action Plan aim to strengthen UK defences and keep essential services running, and the measures aim to deter hostile state aggression. The budget revealed plans to consult on liability for technology companies whose insecure products cause cyber breaches. Last year the NCSC publicly called for a strategic policy agenda after efforts to address insecure technology stalled, and Ollie Whitehouse, the NCSC chief technology officer, wrote that incentives for adopting and sustaining secure solutions are not enough.

Security Minister Dan Jarvis said cyber threats are growing more sophisticated and that the UK is using AI to stay ahead of those seeking to do harm. Some companies have received advanced access to powerful AI models from OpenAI and Anthropic to help identify serious IT glitches. A Five Eyes intelligence alliance alert issued in June said AI would fundamentally transform cyber capabilities on offence and defence and that the timeline was months not years, preceding the NCSC warning.

The government urged Britons last month to keep up to nine litres of bottled water and enough food for three days to survive a serious emergency involving weather, cyber or other events. The defence secretary said Britain needed to prepare for state-sponsored terrorism targeting everyday infrastructure. UK ransomware victims have included Royal Mail, Capita and public bodies including councils.