Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
- AI-powered malware highly likely to be used in ransomware attack on Britain’s critical national infrastructure by 2028, new report warns.
- Head of GCHQ’s National Cyber Security Centre to warn that the era of “tech on the cheap” at the expense of security is over.
- New State of the Cyber Nation report calls on organisations to make “significant changes” to avert a future where AI is used against the UK economy and society.
The UK’s critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, a new report published today [Tuesday 3 November] by the National Cyber Security Centre (NCSC), part of the UK’s signals intelligence agency GCHQ, warns.
The NCSC’s State of the Cyber Nation warns that within the next two years, AI adoption by hostile actors is “highly likely” to increase the scale and efficiency of their operations, including ransomware attacks, social engineering, and vulnerability exploitation.
In a speech to launch the report, the CEO of the NCSC, Dr. Richard Horne, is set to say that the AI revolution must force UK organisations to reckon with their current state of cyber security, as new technologies will expose vulnerabilities, failings, and underinvestment at an unprecedented speed and scale in the years ahead. The head of the UK’s cyber agency will also outline how artificial intelligence represents a critical opportunity to improve the UK’s collective cyber resilience. However, organisations must take urgent action to address foundational investments and weaknesses or risk adversaries exploiting them instead.
The warning comes as the government is investing in the UK’s defence and resilience capabilities, including greater investment in cyber defence, while taking action through the introduction of the Cyber Security and Resilience Bill and the forthcoming National Cyber Action Plan to strengthen the UK’s defences, deter hostile state aggression, keep essential services running, and protect the British people.
Alongside calls for organisations to strengthen their resilience, last week the Chancellor also announced greater investment in capabilities to help the UK harness AI for cyber defence, including £60 million into developing the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy, and the establishment of a new AI Cyber Security Centre of Excellence, run by the National Cyber Security Centre in Manchester, to develop world-leading AI security expertise within government.
This year’s report suggests that the UK is at a point of “enormous consequence” for cyber security and that organisations across the UK must leverage the tools, standards, and frameworks that already exist and are proven to protect them from conventional and AI-powered cyber attacks.
The NCSC is imploring organisations across the UK to face what Dr. Horne is calling “a moment of choice.” In his speech to launch the report, NCSC’s CEO is expected to say:
In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear, that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.
“For decades, we have collectively gotten away with doing tech on the cheap.
“We can be a nation where leaders of all organisations actively choose to invest with urgency… And where all organisations make security and resilience a fundamental requirement, not an afterthought.
“The collective result would be a source of enduring national strength for us all.
Dr. Horne will urge all organisations across the country to “take the responsibility now to make different choices,” including addressing the failure to adequately invest in their technology, avoiding unnecessary connections of technology to the internet, and making Cyber Essentials the starting point for cyber security, not the endpoint, with organisations building greater resilience according to their size, complexity, and risk.
He will emphasize that failing to make these choices will result in leaders “having to look their investors, shareholders, employees, customers, suppliers, in the eye and explain…when food isn’t on shelves, lights aren’t on, businesses have gone under.”
In their tenth year, the National Cyber Security Centre plays a more important role than ever before, defending our security on the cyber frontline.
“The NCSC’s latest annual report shows cyber threats are growing more sophisticated. We’re using the power of AI to help stay ahead of those who seek to do us harm, with a new national Cyber Shield and an AI Cyber Security Centre of Excellence.
Source: UK NCSC (Cyber) (2026-11-03)
