Why Has the UK Issued an AI-Powered Cybersecurity Warning?
AI-powered ransomware is becoming a serious concern for national cybersecurity, according to a new assessment from the UK's National Cyber Security Centre (NCSC). Published on November 3, 2026, the report warns that AI-powered malware is highly likely to have been used in a ransomware attack against UK critical national infrastructure by 2028.
The assessment examines how artificial intelligence could change the scale, speed and effectiveness of cyber operations. It highlights risks involving vulnerability discovery, social engineering, ransomware and attacks against systems that support essential public services.
However, the report does not announce that an attack will definitely happen on a specific date. It presents intelligence-based judgements about the likelihood of future threats and explores three possible scenarios for the cyber threat landscape in 2028.
The warning is important because critical infrastructure includes services that people and businesses depend on every day, such as energy, healthcare, transport, communications and water. A successful cyberattack against these systems could create consequences beyond data theft or temporary website disruption.
What Does the NCSC Report Actually Predict?
The NCSC assessment, titled Artificial Intelligence and Cyber Intrusion, examines current AI-enabled threats and possible developments through 2028. Its findings suggest that artificial intelligence could make existing cyberattack techniques faster, more accessible and easier to scale.
One of its key judgements states that it is highly likely AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure between now and 2028.
The report also makes several other important assessments:
- Nation-state activity: Russia, China and other nation-states are highly likely to use AI cyber capabilities more routinely to pursue geopolitical objectives by 2028.
- Vulnerability exploitation: It is almost certain that many systems will remain vulnerable to AI tools that identify and exploit security weaknesses.
- Critical infrastructure: Attackers are likely to target known weaknesses in older infrastructure technology and new vulnerabilities introduced through AI deployments.
- Growing attack scale: AI could help attackers conduct more sophisticated operations while reducing the time and effort required for certain activities.
These assessments should be understood using the NCSC's probability language. They represent intelligence-based judgements rather than guarantees that every organisation will experience an attack.
How Could Artificial Intelligence Make Ransomware More Dangerous?
Ransomware is malicious software that prevents an organisation from accessing its systems or data, often by encrypting files. Attackers typically demand payment in exchange for restoring access or threatening to publish stolen information.
AI does not need to invent an entirely new form of malware to increase this threat. It can make several stages of an existing attack process more efficient.
1. Faster vulnerability discovery
Attackers need an entry point before they can compromise an organisation. This may involve an unpatched software vulnerability, an exposed remote access service, a misconfigured system or stolen login credentials.
AI tools can help analyse code, examine software behaviour and identify potential weaknesses across large environments. This could reduce the time attackers need to find systems that have not received important security updates.
The NCSC is particularly concerned about organisations that continue to rely on older technology. Some legacy systems cannot be updated easily because they support essential operations or depend on specialised equipment.
2. More convincing social engineering
Social engineering involves manipulating people into revealing information, opening malicious files or approving unauthorised actions. Attackers may impersonate colleagues, suppliers, technical support teams or senior executives.
AI can help criminals create convincing messages, adapt language for different targets and automate parts of their communication. This could make phishing campaigns more difficult to recognise, particularly when messages contain accurate organisational details.
However, AI-generated messages are not automatically successful. Security awareness, identity verification and strong authentication remain important ways to reduce the risk.
3. More efficient attack operations
Cyberattacks often involve repetitive activities, including analysing systems, organising stolen information and preparing communications. AI-assisted tools may automate parts of these tasks, allowing attackers to work across more targets with less manual effort.
This does not mean every ransomware operation will become fully autonomous. Human operators may still make decisions about targets, access, financial demands and the deployment of malicious software.
4. Greater pressure on incident response
When attackers can identify weaknesses and move quickly, defenders may have less time to investigate suspicious activity and contain an incident. Organisations with outdated monitoring systems or slow patching processes could struggle to respond before an intrusion causes serious disruption.
Why Is Critical Infrastructure Particularly Vulnerable?
Critical national infrastructure includes the systems and services necessary for a country's functioning. In the UK, this covers sectors such as energy, water, transport, healthcare, communications and other essential services.
Many infrastructure environments contain a combination of modern IT systems and older operational technology. Operational technology controls or monitors physical processes, including industrial equipment, power systems and building infrastructure.
These environments can be difficult to secure because availability and safety are often more important than making frequent software changes. Some equipment may have long replacement cycles, specialised maintenance requirements or limited compatibility with modern security tools.
The growing connection between operational technology, cloud platforms and AI-enabled systems introduces additional security considerations. A vulnerability in a connected service could potentially create an entry point into a wider environment if network separation and access controls are inadequate.
This is why the NCSC's warning goes beyond conventional computer systems. A serious incident involving critical infrastructure could affect the availability of essential services and potentially create physical consequences.
What Are the Three Cyber Threat Scenarios for 2028?
The NCSC report explores three possible scenarios to help organisations understand how the AI-enabled cyber threat landscape could develop. These scenarios are plausible possibilities, not predictions of exactly what will happen.
Baseline scenario: An increased global cyber threat
In this scenario, AI capabilities become increasingly available to both attackers and defenders. Cybercriminals and state-linked groups use AI to improve their operations, while organisations also adopt defensive technologies to detect and respond to threats more efficiently.
The overall threat increases, but improvements in defensive capabilities help limit some of the potential damage.
Pessimistic scenario: Attackers move faster than defenders
This scenario describes a situation in which AI cyber capabilities spread faster than organisations can strengthen their security. More attackers gain access to advanced tools, while outdated systems and weak security practices remain widespread.
Under this possibility, cyberattacks could become more frequent and sophisticated. The report also considers the potential for AI-assisted operations to affect physical environments through connected infrastructure and automated systems.
Optimistic scenario: Stronger defensive capabilities
In the more optimistic scenario, the development of offensive AI capabilities slows sufficiently for organisations and governments to strengthen their defences. Better security practices, improved monitoring and coordinated responses help reduce the impact of emerging threats.
The purpose of these scenarios is to support preparation rather than predict a single outcome. Organisations should consider how their security plans would perform under different conditions.
How Is the UK Government Responding to the Threat?
The UK government has announced several investments aimed at strengthening national cyber defence and improving the use of AI in security operations.
Among the measures outlined in the 2026 Budget are:
- £60 million National Cyber Shield: Funding for AI-enabled defensive capabilities designed to help organisations detect and respond to cyber threats more effectively. The programme includes a £25 million AI and Cyber Security Challenge Fund.
- £70 million NERV Centre: The National Exposure and Real-Time Vulnerability Centre will use AI tools to help identify and reduce vulnerabilities across critical infrastructure and the wider economy.
- £24 million for public-sector cyber defence: Additional investment to strengthen technology used by public services, including local authorities, hospitals and schools.
- £40 million National Agentic Security Unit: Funding to develop capabilities for detecting, investigating and responding to risks involving rogue or uncontrolled agentic systems.
The government has also announced plans for a Centre for Cyber and AI Excellence in Manchester to develop specialist expertise outside London. These initiatives are separate measures and should not be confused with the NCSC's threat assessment itself.
They reflect a broader strategy: using AI to improve defensive capabilities while addressing the vulnerabilities that attackers may exploit.
What Should Businesses and Organisations Do Now?
The NCSC warning is relevant to more than government agencies and large infrastructure providers. Businesses, schools, healthcare organisations and technology companies also depend on connected systems that could be targeted by cybercriminals.
Organisations do not need to wait until 2028 to improve their security. Many of the weaknesses highlighted in the assessment already exist and can be addressed through established cybersecurity practices.
Review and patch vulnerable systems
Maintain an accurate inventory of software, devices and connected services. Identify systems that are no longer supported and prioritise security updates for internet-facing applications, remote access services and critical infrastructure components.
Strengthen identity and access controls
Use multi-factor authentication for important accounts, especially administrator access and remote connections. Remove unused accounts, restrict permissions and review unusual login activity.
Improve network separation
Separate critical systems from ordinary office networks wherever possible. Restrict communication between IT and operational technology environments so that a compromised workstation cannot automatically access sensitive infrastructure.
Prepare for ransomware incidents
Maintain protected backups of essential data and regularly test recovery procedures. Backups should be isolated from ordinary user accounts so attackers cannot easily delete or encrypt them during an intrusion.
Strengthen employee awareness
Provide regular training on phishing, impersonation and suspicious requests. Employees should know how to verify unexpected payment instructions, password-reset requests and messages that appear to come from senior staff.
Monitor systems continuously
Use security monitoring to identify unusual access, unexpected changes and suspicious activity. Establish an incident response process that defines who investigates, who makes decisions and how essential services will continue during an attack.
Does the NCSC Warning Mean an AI Ransomware Attack Is Certain?
No. The assessment does not say that a specific attack is scheduled or that a particular organisation will be compromised by 2028. Its statement that AI-powered malware is highly likely to have been used in a ransomware attack against UK critical infrastructure is a probability judgement based on the agency's assessment of the threat landscape.
The distinction matters because cybersecurity forecasts describe risks that organisations can prepare for. They are not evidence that an attack has already occurred or that every predicted scenario will become reality.
The more practical message is that AI may increase the speed and scale of existing cyber threats. Organisations that continue to rely on outdated technology, weak authentication and limited monitoring could face greater exposure as attackers adopt more capable tools.
What the 2028 Warning Means for the Future of Cybersecurity
The NCSC assessment highlights a changing balance between attackers and defenders. Artificial intelligence can help security teams analyse threats and respond faster, but the same technology can also help malicious actors identify weaknesses and automate parts of their operations.
The challenge is not simply to adopt more AI tools. Organisations must first establish strong security foundations, including reliable patch management, controlled access, network separation, tested backups and effective incident response.
The UK's 2028 warning should therefore be treated as a preparation signal, not a prediction of inevitable disaster. The organisations that address existing weaknesses now will be in a stronger position to manage the next generation of AI-enabled cyber threats.
Official Sources and Further Reading
- National Cyber Security Centre – Artificial Intelligence and Cyber Intrusion: https://www.ncsc.gov.uk/report/artificial-intelligence-and-cyber-intrusion
- National Cyber Security Centre – Cyber Chief: UK Facing AI-Powered Attacks on Critical Infrastructure Within Two Years: https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
- UK Government – Budget 2026: https://www.gov.uk/government/publications/budget-2026-document/budget-2026-html
- UK Government – New Government-Backed Cyber Security Protections Could Save UK Businesses Thousands: https://www.gov.uk/government/news/new-government-backed-cyber-security-protections-could-save-uk-businesses-thousands
- National Cyber Security Centre – NCSC Annual Review 2026: https://www.ncsc.gov.uk/collection/annual-review-2026/understanding-threat/cyber-threat-uk
