The UK National Cyber Security Centre ( NCSC ) warned on Tuesday that critical national infrastructure in the UK should be prepared for possible ransomware attacks driven by AI malware by 2028.
According to the annual "Cyber Nation State of Mind" report released by NCSC, in the next two years, malicious actors are "highly likely" to increase the scale and efficiency of their operations using AI, which includes ransomware, social engineering, and exploitation of software vulnerabilities. This organization is affiliated with the UK signals intelligence agency GCHQ.
"Today, we released our 2026 annual review: 'The State of the Online Nation,'" wrote NCSC on X. "Britain is facing a moment of choice. The future of cyber resilience is not predetermined."
NCSC CEO Richard Horne stated in the speech draft prepared for the report release that threats come more from existing vulnerabilities rather than new attack techniques.
Horne said, "In the coming months, we may face an unprecedented increase in the number of cyber incidents. However, it must be clear that this is not because AI has invented new ways to attack us. It is because vulnerabilities that have been tolerated for too long can now be discovered and exploited on a scale that was once unimaginable."
"For decades, we have collectively been using technology in a low-cost manner," he added.
Horne urges all organizations to seriously invest in technological development, to stop unnecessarily connecting systems to the internet, and to regard the government's Cyber Essentials certification as the starting point, not the end point, of security efforts. He warns that if leaders do not take action, they may have to explain to investors, employees, and customers why there is 'no food on the shelves, the lights are not on, and the business has collapsed.'
The UK government announced last week that it will invest 60 million pounds (approximately 80 million US dollars) in the first phase of its national Cyber Shield, and 70 million pounds (about 93 million US dollars) in a new National Exposure and Real-Time Vulnerabilities Center, which will identify weaknesses in critical infrastructure. At the same time, a new AI Cybersecurity Excellence Center will be established in Manchester, to be operated by NCSC.
AI and Cyberattacks
At the time of this warning, there is increasing evidence that attackers are already using AI. In May, Google's Threat Intelligence team stated that cybercriminals had exploited a AI model to discover and weaponize an previously unknown vulnerability, thereby bypassing the two-factor authentication in a popular open-source management tool; this is the first time Google has confirmed the existence of zero-day vulnerabilities aided by AI in the real world.
However, a study published by the University of Cambridge in the same month analyzed over 90,000 posts from online crime forums and found that most criminals use AI primarily for spamming and phishing, rather than for complex attacks.
British officials have also issued warnings before. In July, Foreign Secretary Yvette Cooper stated that countries must reach an agreement on AI security measures before the frontline AI systems change warfare, crime, and society. She wrote, "We cannot wait until there is a new 'Hiroshima' to take action."
