The National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack against the UK’s critical national infrastructure by 2028.
In its annual review, the agency says Russia, China and other states are highly likely to routinely use AI in cyber operations to pursue their geopolitical goals by then. AI is already helping attackers identify security weaknesses, select victims and work more efficiently, raising concerns about the speed and scale of future attacks.
Targets
The warning concerns systems that keep essential services running, from electricity and water supplies to healthcare and transport. The risks extend beyond conventional IT networks to operational technology: the equipment and software used to monitor and control physical processes.
In his speech accompanying the review, NCSC Chief Executive Dr Richard Horne highlighted electricity switching, sluice gates, dam operations and heating and refrigeration controls. These systems can receive less attention than traditional IT when organisations make security and investment decisions.
Hospital networks and airport systems can also face cyber threats, with disruption potentially affecting patients, passengers and the services they rely on. These are examples of vulnerable services, rather than a list of specific targets identified in the NCSC’s forecast.
Recent attacks on refrigeration systems at European supermarkets show how cyber incidents can cause physical damage and losses. Reports described temperatures being raised remotely, spoiling food and leaving stores having to discard stock. The reporting cited here does not establish that AI was used in those attacks.
The NCSC also warns that state-backed cyber operations increasingly serve wider political and strategic objectives. It describes China’s adversarial cyber activity as the most sophisticated and sustained cyber challenge facing the UK. According to the agency, China collects large amounts of information through its cyber capabilities and uses those data to train models, improve its capabilities and generate intelligence.
Russia remains a concern. Horne said UK military networks face persistent attempts to gain access, including Russian campaigns deliberately kept below the threshold of armed conflict.
AI-driven defence
Horne warned that AI could expose longstanding security weaknesses at a speed and scale that organisations are not prepared to handle. His message was that years of deferred investment and weak security practices have left too many systems exposed.
AI-assisted research into PHP offers a recent example of how these tools can help find serious flaws. Researchers using AI contributed to the discovery and investigation of two critical vulnerabilities in the widely used server-side programming language. PHP released fixes on October 21, 2026. The PHP Foundation’s account also makes clear that human researchers and maintainers remained central to validating reports and developing patches.
The UK government has announced several initiatives intended to strengthen cyber defences:
- £60 million for the first phase of the National Cyber Shield: The programme will use agentic AI to improve cyber defences. The allocation includes a £25 million challenge fund for UK AI and cybersecurity innovators.
- £70 million for the NERV Centre: The National Exposure and Real-Time Vulnerability Centre will deploy AI tools to identify weaknesses across critical infrastructure and the wider economy.
- An AI Cyber Security Centre of Excellence in Manchester: Run by the NCSC, the centre will train and develop government specialists in AI and cybersecurity.
The NCSC’s warning is a forecast, not a declaration that a particular attack is inevitable. Its immediate message to organisations is practical: address known weaknesses, modernise ageing systems and improve security before attackers can exploit those gaps at greater speed.
