The United Kingdom’s National Cyber Security Centre has issued two distinct forecasts about AI-enabled attacks on critical infrastructure, including a ransomware scenario it rates as highly likely before 2028.
One assessment concerns attackers using artificial intelligence (AI) cyber capabilities against known weaknesses in legacy critical national infrastructure (CNI) technology. In a July 8, 2026, parliamentary answer, the government relayed the NCSC’s view that such attacks were highly likely by 2028.
The NCSC annual review makes a separate forecast: It places a ransomware attack on UK CNI using AI-powered malware in the highly likely category before 2028. Both assessments describe potential attacks, not incidents reported as having occurred.
The NCSC says AI could speed up several parts of an attack, including choosing targets, identifying network vulnerabilities and developing malicious code. The agency has identified known flaws in older systems as a persistent exposure. Chief Executive Dr. Richard Horne has also pointed to long-standing weaknesses and technology choices shaped by cost. A June speech cited Volt Typhoon, attributed in 2024, as an earlier case involving U.S. critical infrastructure.
In a June 17 release, the NCSC said it handled more than 200 cyber incidents affecting critical national infrastructure and its supporting ecosystem during the 12 months through May 2026. Around 75% were believed to have links to state actors.
Alan Woodward, a professor of cybersecurity at Surrey University, told The Guardian that advanced AI could help defenders find and fix flaws. He warned that if defenders lacked access to such tools, attackers could gain an advantage: “the bad guys will beat them to it.” The NCSC’s warning echoes Australia’s assessment that AI could shorten the time needed to exploit cyber flaws.
A Guardian preview published Nov. 2 said Horne was scheduled to speak Tuesday, Nov. 3, alongside the annual review. The outlet said he was expected to discuss the prospect of more cyber incidents in the near term.
