UK Cyber Agency Says AI-Powered Malware Is 'Highly Likely' to Hit Britain's Critical Infrastructure in a Ransomware Attack by 2028
Britain's National Cyber Security Centre said on November 3 that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. NCSC chief Richard Horne warned of 'a real prospect of an unprecedented rise' in incidents, blaming not new AI attack methods but years of 'tech on the cheap' that AI can now find and exploit at scale.
Britain's cyber agency is not warning that AI will invent new attacks; it is warning that AI will find the weaknesses organisations have left unfixed for years, faster than they can patch them. The National Cyber Security Centre said in its State of the Cyber Nation report, published on November 3, that AI-powered malware is "highly likely" to be used in a ransomware attack on UK critical national infrastructure by 2028.
The warning#
Within the next two years, hostile actors' use of AI is highly likely to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation, the NCSC said. The report also says states including Russia and China will routinely use AI in their cyber activity, Infosecurity Magazine reported.
"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," NCSC chief executive Richard Horne said in his speech launching the report. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." He said that "for decades, we have collectively got away with doing tech on the cheap."
Horne pointed to the PHP2Shell vulnerabilities as a recent example, saying the NCSC had sent 110,000 proactive notifications and early warning alerts to UK organisations about them, Infosecurity Magazine reported.
What the government is funding#
The NCSC pointed to recently announced funding of £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and a new AI Cyber Security Centre of Excellence in Manchester run by the NCSC. Those sit alongside the AI security money in the UK Budget's AI package.
Limits#
- "Highly likely" is the NCSC's own assessment language; the report does not name specific targets or groups expected to carry out such an attack.
- The NCSC's release quotes Horne's speech as prepared; Infosecurity Magazine reported the same lines from the launch event.
- This report was published early on November 3, before our previous edition's research window; we include it now because we missed it.