NCSC warns of AI-powered ransomware threat to UK infrastructure

The National Cyber Security Centre (NCSC) says it is “highly likely” that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. Its State of the Cyber Nation report warns that underinvestment has left essential services vulnerable to tools that can discover and exploit weaknesses faster and at greater scale.

Russia, China and other nation states are expected to routinely use AI in cyber operations to pursue geopolitical goals. Older technology in energy, water and transport networks, alongside newly deployed AI tools, presents likely targets. The NCSC outlines scenarios ranging from accelerating threats to slower progress that allows defenders to catch up, stressing that these are scenarios rather than predictions.

NCSC chief executive Richard Horne is urging leaders to invest in technology, disconnect systems that do not need internet access and treat the Cyber Essentials scheme as a starting point. The government has earmarked £60 million for the initial phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre. A new NCSC-run AI Cyber Security Centre of Excellence is also planned in Manchester.

Between September 2025 and August 2026, the NCSC received 1,831 attack reports, supported 337 incidents and classified 80 as nationally significant. Although attackers have begun using AI tools, the agency says none of the observed uses created a new class of attack.