UK cyber agency says an AI-powered ransomware attack on critical infrastructure is highly likely by 2028

The UK's National Cyber Security Centre (NCSC) published its annual review, State of the Cyber Nation, on 3 November. It covers 1 September 2025 to 31 August 2026 and judges that hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations within two years, including ransomware, social engineering and the exploitation of vulnerabilities.

The agency also judges that AI-powered malware is highly likely to be used in a ransomware attack on the UK's critical national infrastructure by 2028. It says AI is not creating new methods of attack. Instead, it lets attackers find and exploit weaknesses that organisations have tolerated for a long time, at much greater scale.

According to the release, NCSC chief executive Richard Horne was set to call this "a moment of choice" in a speech to launch the report, and to urge organisations to take responsibility now. In the prepared remarks, he was to ask them to invest in technology properly, to avoid connecting systems to the internet when there is no need, and to treat the Cyber Essentials scheme as a starting point rather than the goal.

The government announced £60m for the first phase of a national Cyber Shield and £70m for a National Exposure and Real-Time Vulnerability (NERV) Centre to find weaknesses across critical infrastructure and the economy. A new AI Cyber Security Centre of Excellence, run by the NCSC, will be based in Manchester. The government is also taking forward the Cyber Security and Resilience Bill and a National Cyber Action Plan. The announcement gives no incident counts, and this brief does not draw on the full review.