Britain’s National Cyber Security Centre warned Tuesday that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028, as automated tools make it cheaper and faster to find and exploit weaknesses in aging systems.
The new NCSC assessment, published November 3, does not predict a particular attack or claim that AI has invented a new class of cyber weapon. Its central finding is more immediate: attackers can use AI to scale familiar work such as vulnerability discovery, exploitation and social engineering, while many essential systems will remain exposed.
The agency judges it highly likely that Russia, China and other nation states will routinely use AI-enabled cyber capabilities for geopolitical objectives by 2028. It considers it almost certain that many systems will still be vulnerable to tools that discover and exploit weaknesses, and likely that attackers will target both known flaws in legacy infrastructure and new attack surfaces created by AI deployments inside critical services.
AI changes the cost and speed of intrusion
The assessment focuses less on exotic autonomous attacks than on the economics of access. When software can search for weaknesses, assemble exploit chains and replace lost footholds more quickly, an attacker has less reason to preserve a hard-won access path. The NCSC expects hostile operators to take more risks because a blocked route can be replaced at lower cost.
That shift matters for organizations that have historically relied on obscurity, slow-moving attackers or the assumption that old weaknesses are unlikely to be found. NCSC chief executive Richard Horne described the problem as the end of “tech on the cheap”: vulnerabilities tolerated for years can be discovered and exploited at a scale that manual operations could not sustain.
AI is also expected to widen the pool of capable operators. Open-source models can be adapted for reconnaissance, coding and analysis without a state or criminal group building a frontier model from scratch. The NCSC says Russian actors have highly likely already used that route to support intelligence requirements, pre-positioning, espionage and intellectual-property theft.
Defensive AI can shorten the time between discovery and patching, but the benefit depends on deployment and configuration. A tool that identifies a flaw faster does not help if an organization cannot test, approve and install the fix before an attacker reaches the same target. The report therefore treats patching capacity, asset knowledge and operational discipline as the limiting factors, not just access to a capable model.
The risk extends into physical operations
Critical infrastructure is not limited to power stations. In remarks reported by The Associated Press, Horne pointed to electricity switching, water-facility sluice gates, dam controls, manufacturing lines, heating systems and refrigeration as examples of digital technology controlling physical processes.
That list explains why ordinary cyber hygiene can become a public-safety issue. A compromised refrigeration controller can spoil food without touching a corporate finance system. A remote-management path into a water facility can disrupt operations even if the attacker never deploys sophisticated custom malware. Legacy operational technology often has long replacement cycles, narrow maintenance windows and safety constraints that make rapid patching harder than it is on an office laptop.
The NCSC expects attackers to exploit known vulnerabilities in that environment while also probing the AI systems that operators add for monitoring, maintenance or automation. Those deployments can introduce model endpoints, data pipelines, service accounts and new connections between information-technology and operational-technology networks. An AI defense project can therefore expand the attack surface if its identity, network and data controls are weaker than those protecting the process it monitors.
Three scenarios, not a single forecast
The report models three plausible paths to 2028. Its baseline assumes a larger global AI-cyber threat, persistent geopolitical tension and routine state use of AI-enabled operations. A pessimistic scenario has offensive capability proliferating faster than UK defenses can adapt. An optimistic scenario assumes slower AI-cyber development gives defenders time to deploy effective countermeasures.
Five variables determine which path becomes more likely: geopolitical tension, the quality of UK critical-infrastructure defenses, the pace of AI development, the availability of cyber-capable AI tools and the supply of workers who understand both AI and security. The NCSC stresses that these are scenarios rather than predictions and that surprise remains likely.
This distinction is important for planning. “By 2028” is not a deadline after which the danger suddenly begins, and the report does not say every ransomware group can autonomously compromise industrial systems today. It says the direction is sufficiently clear that waiting for a landmark incident would leave organizations trying to modernize under pressure.
What operators should change now
The most useful response is to reduce the weaknesses that automation can find and exploit. For critical-infrastructure operators and enterprises with operational technology, that means turning a broad AI warning into a short list of measurable work:
- Map internet-reachable assets and remote-management paths. Include vendor appliances, cellular gateways, engineering workstations, VPN concentrators and cloud dashboards. Remove public exposure that is not operationally necessary.
- Measure patch latency, not just patch compliance. Track the time from disclosure to inventory, risk decision, deployment and verification. For systems that cannot be patched quickly, document segmentation, access restrictions and monitoring as compensating controls.
- Separate business IT from physical-control networks. Restrict identities and protocols that can cross the boundary, and test whether a compromised enterprise account can reach engineering or safety systems.
- Inventory AI services as production dependencies. Record the models, gateways, agents, service accounts, data stores and external tools each deployment uses. Apply least privilege and preserve logs that connect prompts or agent actions to operating-system and network activity.
- Rehearse operation without the digital control plane. Validate immutable backups, manual procedures, replacement hardware and communications plans before an incident takes scheduling, refrigeration or industrial controls offline.
- Prioritize identity and recovery alongside detection. Faster vulnerability discovery will not prevent attackers from using valid credentials or existing access. Strong authentication, separated administrative accounts and tested recovery remain essential.
The agency specifically urges organizations to eliminate unnecessary internet connections and treat the UK’s Cyber Essentials baseline as a starting point rather than a complete resilience program. The appropriate control set will vary by an organization’s size and risk, but the report leaves little support for postponing foundational inventory, patching and segmentation work while waiting for a more advanced AI security product.
The UK is funding a defensive response
The warning arrives with new government investment. According to the NCSC announcement, £60 million will fund the first phase of a national Cyber Shield, while £70 million will support a National Exposure and Real-Time Vulnerability Centre intended to identify weaknesses across critical infrastructure and the wider economy. A new AI Cyber Security Centre of Excellence in Manchester is also planned.
Those programs could improve shared visibility and defensive tooling, but they do not replace work inside individual organizations. A national system can surface a vulnerable device or active campaign; the operator still needs an accurate inventory, authority to take a system offline, a tested maintenance path and a fallback when equipment cannot be fixed immediately.
The NCSC’s 2028 horizon is therefore best read as a planning window, not a distant warning. AI may accelerate the attacker, but the report’s most consequential risks still begin with familiar conditions: exposed systems, old software, excessive access and recovery plans that have never been tested.
