The UK’s National Cyber Security Centre has judged that artificial intelligence-enabled malware is highly likely to feature in a ransomware attack against the country’s critical national infrastructure by the end of 2028.
The assessment, released on 3 November 2026 as part of the NCSC’s State of the Cyber Nation report, warns that hostile actors’ adoption of AI will almost certainly expand the scale and speed of cyber operations over the next two years.
Criminal groups and state-linked operators are expected to use the technology to intensify ransomware campaigns, social-engineering efforts and the discovery of exploitable weaknesses in existing systems.
Critical national infrastructure covers essential services such as energy supply, transport networks, hospitals, financial systems and food distribution.
The NCSC, which sits within the signals-intelligence agency GCHQ, stresses that the risk does not stem primarily from AI inventing wholly novel attack methods. Instead, the technology is projected to let attackers locate and weaponise long-tolerated vulnerabilities at a volume and pace previously unattainable.
NCSC chief executive Richard Horne has framed the situation as a moment of choice for organizations of every size.
In remarks prepared for the report’s launch, he noted that decades of underinvestment—described as “doing tech on the cheap”—have left networks exposed.
If leaders fail to strengthen defences, he suggested, they may later have to account for empty supermarket shelves, darkened homes and collapsed businesses.
The report identifies China as the most sophisticated and persistent cyber challenge facing the United Kingdom and the actor best positioned to apply AI against strategic targets, including critical infrastructure.
Both China and Russia are assessed as highly likely to employ AI routinely in pursuit of geopolitical objectives by 2028.
Russian activity is characterised as remaining below the threshold of armed conflict, while Iran continues operations aimed at the UK and individuals viewed as threats to the regime.
AI is expected to lower costs for criminal ransomware operators and raise the volume of attacks directed at less resilient targets.
It can assist with target selection, vulnerability scanning and the generation of malicious code, amplifying rather than replacing established techniques.
The warning accompanies government commitments to bolster cyber defences.
Recent announcements include funding for an initial phase of a national Cyber Shield, a new National Exposure and Real-Time Vulnerability Centre focused on critical systems, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC.
These steps form part of broader measures that also include a forthcoming Cyber Security and Resilience Bill.
The NCSC emphasises that the same AI capabilities creating the threat can strengthen defence if organisations adopt existing standards, tools and practices with urgency.
It urges boards and executives to treat security and resilience as core requirements rather than optional extras.
Failure to do so, the agency argues, risks an unprecedented rise in incidents that could disrupt everyday life across multiple sectors simultaneously.
The assessment uses the standard UK intelligence probability language in which “highly likely” denotes a high-confidence judgment.
It does not claim an attack has already occurred, but projects that one involving AI-powered malware against critical infrastructure is probable within the two-year window. Separate scenarios in the report explore more severe outcomes in which frontier AI systems proliferate beyond effective control, though these are presented as plausible possibilities rather than firm predictions.
