NCSC: AI-powered malware will likely hit UK critical infrastructure by 2028

AI-powered malware will “highly likely” be used in a ransomware attack on UK critical national infrastructure by 2028, the National Cyber Security Centre said on 3 November, The Guardian reported. The NCSC, part of GCHQ, made the judgement in its annual State of the Cyber Nation report. It is a forecast, and the report does not say such an attack has happened.

The NCSC expects financially motivated hackers to aim at power stations, airports and hospitals. Within two years, it says, AI will raise the scale and efficiency of ransomware, social engineering and the exploitation of vulnerabilities. Nation states, Russia and China among them, will use AI routinely to pursue geopolitical goals.

Old weaknesses, found faster

Dr Richard Horne, the NCSC's chief executive, launched the report in London. In his view AI adds no new attack methods. It lets attackers find and exploit weaknesses organisations have tolerated for years “at a scale that was once unimaginable”.

“For decades, we have collectively got away with doing tech on the cheap,” Horne said. He listed end-of-life systems, delayed upgrades, poor access control, buying on price alone and weak monitoring.

Horne's advice, if you run IT at a company:

• invest properly in technology;
• do not connect systems to the internet without need;
• treat Cyber Essentials as a baseline, not a finish line;
• build resilience to match your size, complexity and risk.

The NCSC has already sent 110,000 proactive notifications and Early Warning alerts to UK organisations about the PHP2Shell vulnerabilities. Bill Gates warned about AI cyberattacks in October, and OpenAI has shown Astra, a model that builds attacks without human help.

What the government is paying for

The Chancellor announced the money on 24 October:

• £60m for the first phase of a national Cyber Shield, including a £25m Challenge Fund for UK AI and cyber firms;
• £70m for a National Exposure and Real-Time Vulnerability (NERV) Centre to find weaknesses across critical infrastructure;
• an extra £120m for the AI Security Institute;
• £40m for a National Agentic Security Unit that will watch for and respond to an uncontrolled AI agent or bot;
• £24m for AI-based defences in the public sector.

The £40m unit is meant for cases where an AI agent acts out of anyone's control. The NCSC will also run a new AI Cyber Security Centre of Excellence in Manchester. Cyber security minister Baroness Lloyd announced a 75% discount on Cyber Essentials certification for small businesses, which brings the price to £80 to £125 plus VAT. More than 230 businesses have signed a Cyber Resilience Pledge to refer suppliers for free certification.

Anthony Young, chief executive of security firm Bridewell, said the two-year window “feels generous”. He pointed to attacks on supermarket refrigeration systems and said many attacks still exploit basic weaknesses.

The 2028 date is an NCSC forecast. No AI-powered ransomware attack on UK critical infrastructure has been reported.