The National Cyber Security Centre said on 3 November that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. The warning accompanied its State of the Cyber Nation report and gives operators of essential services a two-year horizon for the threat. The NCSC is part of GCHQ, the UK’s signals intelligence agency.
Key points
- The NCSC expects hostile actors’ use of AI to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.
- Chief executive Richard Horne is expected to urge organisations to invest in security and remove unnecessary internet connections.
- The government has announced £60 million for the first phase of a Cyber Shield and £70 million for a vulnerability centre.
The NCSC’s 2028 ransomware horizon
Critical national infrastructure includes services in energy, transport, defence, food, health and finance, The Guardian reported. Ransomware typically involves gaining access to a victim’s systems, encrypting files and demanding payment. The NCSC expects AI to help attackers find targets and network weaknesses and write malicious code, according to the newspaper. Its forecast concerns the use of AI-powered malware in an attack, rather than an assertion that AI will invent a new kind of attack.
The NCSC’s assessment also says hostile actors’ adoption of AI is highly likely to make ransomware attacks, social engineering and the exploitation of vulnerabilities more efficient and more extensive within the next two years. For organisations responsible for essential services, the warning concerns weaknesses in systems they already operate. Horne, the centre’s chief executive, is expected to say that vulnerabilities tolerated over many years could be found and exploited at a scale previously out of reach.
Malicious cyber activity costs UK organisations an estimated £14.7bn each year, according to an NCSC estimate reported by Computer Weekly. The centre received 1,830 reports of cyber attacks during the past year and classified 80 as nationally significant, the publication reported. It also reported the NCSC’s assessment that state-backed attacks it has seen so far have mostly exploited familiar weaknesses rather than used advanced autonomous AI.
Horne presses organisations on existing weaknesses
Horne is due to launch the report in a speech on 3 November. “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” he is expected to say. He plans to attribute that prospect to AI making longstanding vulnerabilities easier to discover and exploit. The distinction matters for the measures he is asking organisations to take: he is urging them to address inadequate investment in their technology and avoid connecting systems to the internet unnecessarily.
Horne is also expected to tell organisations to treat Cyber Essentials, a cyber security scheme, as a starting point rather than a complete defence, and to build resilience appropriate to their size, complexity and risk. The NCSC is calling for significant changes in how organisations protect themselves from both conventional and AI-powered attacks. It says existing tools, standards and frameworks can help them do so.
Recent attacks on supermarket refrigeration systems in Europe destroyed millions of euros of food, Computer Weekly reported. The publication described the security of systems controlling electricity switches, dams, manufacturing lines, heating and refrigeration as an area where investment in resilience has received less attention. Horne is expected to warn that service failures would leave leaders answering to investors, employees, customers and suppliers about choices they made after receiving warnings.
The NCSC’s warning reaches beyond civilian services. Horne is expected to say that Russia is making sustained attempts to penetrate UK military communications networks and that Iran is conducting malicious cyber operations globally, including against UK targets, Reuters reported. He is also expected to say China “highly likely has the intent and is best positioned to use AI” against UK critical infrastructure and other strategic targets. Moscow, Beijing and Tehran have previously denied similar allegations, Reuters reported.
Cyber Shield and the £70 million vulnerability centre
The government is introducing the Cyber Security and Resilience Bill and has identified a National Cyber Action Plan as another part of its response. Its defence investments sit alongside the NCSC’s call for operators to strengthen their own systems. The agency is urging organisations to invest adequately in their technology, avoid unnecessary internet connections and use Cyber Essentials as a starting point, while the government’s announced spending is directed at national capabilities.
The Chancellor has announced £60 million to develop the first phase of a national Cyber Shield. Computer Weekly reported that the programme is intended to use agentic AI for cyber defence at national scale. The announcement also included £70 million for a National Exposure and Real-Time Vulnerability Centre, intended to identify weaknesses across critical infrastructure and the wider economy.
The focus on essential services also appears in earlier Bank of England advice to banks to plan for recovery from AI-enabled cyberattacks. In its assessment of the wider threat, the NCSC expects organisations with stronger security programmes and resources to be better able to detect attacks, prioritise weaknesses and automate defences, while weaker organisations are likely to struggle to keep pace, Computer Weekly reported.
The government’s announcement also provides for an AI Cyber Security Centre of Excellence in Manchester. The NCSC will run the centre, which is intended to develop AI security expertise within government.
