AI Cyber Attacks on UK Infrastructure Likely by 2028, NCSC Warns

AI cyber attacks are set to hit the UK’s critical infrastructure within two years, according to the National Cyber Security Centre (NCSC). In its State of the Cyber Nation report published on Tuesday, November 3, the GCHQ agency says it is “highly likely” that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure by 2028.

The warning comes with a blunt message for companies and public bodies: years of “tech on the cheap” have left systems exposed, and AI tools can now find and exploit those weaknesses far faster than before.

What the NCSC Says About AI Cyber Attacks

An accompanying NCSC assessment on AI and cyber intrusion sets out its key judgements for 2028. It says Russia, China and other nation states will “highly likely” use AI routinely in cyber operations to reach their geopolitical goals, raising the scale and speed of sophisticated attacks against the UK.

The agency also judges it “almost certain” that many systems will still be open to AI tools that spot and exploit weaknesses. Because a lost foothold is cheap to replace, attackers are expected to take fewer precautions about being caught. Older technology in energy, water and transport, along with new AI tools deployed inside those networks, is flagged as a likely target.

The report describes three possible paths to 2028: a baseline where the threat clearly grows, a pessimistic case where AI attack tools spread much faster than UK defences, and an optimistic case where progress slows enough for defenders to catch up. The NCSC stresses these are scenarios, not predictions.

“A Moment of Choice” for Organisations

In a speech launching the report, NCSC chief executive Richard Horne is expected to say, “We must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

Horne is calling on leaders to invest properly in their technology, take systems off the internet when they do not need to be connected, and treat the government-backed Cyber Essentials scheme as a starting point rather than the finish line. According to the NCSC announcement, he will warn that leaders who fail to act may one day have to explain why “food isn’t on shelves” or “lights aren’t on.” Recent attacks such as the supermarket cyberattack that heated freezers in Belgium and Sweden show how quickly a breach can spill into daily life.

What the UK Is Doing About It

The government has earmarked £60 million for the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre, and a new AI Cyber Security Centre of Excellence in Manchester run by the NCSC. The Cyber Security and Resilience Bill and a National Cyber Action Plan are also in progress.

The numbers from the past year already show the pressure. Between September 2025 and August 2026, the NCSC incident team received 1,831 reports of cyber attacks, supported 337 incidents and classed 80 as nationally significant. It also warned 8,500 organisations about signs of a suspected compromise. The team says attackers have started adding AI tools to their work, but none of the uses it observed created a new class of attack.

What It Means Beyond the UK

The NCSC’s view matches a wider trend: AI is speeding up both attack and defence. Tech companies are responding in kind, with OpenAI recently raising its bug bounty rewards to get flaws reported before criminals find them. Supply chain risks also remain high, as Google’s move against Android TV box malware showed this week.

For most organisations, the advice is familiar: patch known flaws quickly, replace passwords with passkeys where possible, and cut unnecessary internet exposure before AI-driven attackers find the gaps.