NCSC Says AI-Powered Malware Is 'Highly Likely' to Hit UK Critical Infrastructure by 2028

The UK's National Cyber Security Centre assesses that AI-powered malware will very probably be used in a ransomware attack on critical national infrastructure before 2028, according to the Guardian's report on its annual review.

The National Cyber Security Centre (NCSC), part of the GCHQ intelligence agency, has judged it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028, according to the Guardian's report on the agency's annual review. The UK definition of critical national infrastructure spans energy, transport, defence, food, health and finance, and the report names power stations, airports and hospitals as examples of potential targets. The NCSC's review, which covers the period from 1 September 2025 to 31 August 2026, is a forecast of risk rather than a record of an attack that has already happened.

According to the Guardian, the NCSC expects AI to help attackers scout targets, locate weaknesses in IT networks and write malicious code, making ransomware more effective. The review also warns that Russia and China will begin to use AI "routinely" in cyber-attacks. In a speech accompanying the review, NCSC chief executive Richard Horne is due to say the UK faces a "real prospect of an unprecedented rise in the number of cyber incidents", driven by AI's ability to uncover weaknesses that have been "tolerated for far too long". As an example of that capacity, the Guardian notes that AI helped find a critical flaw last month in PHP, a language used by almost 70% of websites.

Horne is also expected to point to recent cyber-attacks on supermarket fridges and freezers in Europe, which raised cooling temperatures above 50C, as a warning to organisations to invest in cyber resilience. Alan Woodward, a professor of cybersecurity at the University of Surrey, told the Guardian that AI can help defenders find and patch flaws but that governments and companies need access to cutting-edge models so attackers do not get there first. The details above rely on the Guardian's account of the review and speech; readers should consult the NCSC's own publication for the full wording of its assessment.