Britain should prepare for an AI-powered cyberattack on its critical national infrastructure within the next two years, the UK’s National Cyber Security Centre (NCSC) has warned in its annual State of the Cyber Nation report, published on Tuesday.
The report judges it “highly likely” that a ransomware attack involving AI-powered malware will hit the nation’s critical infrastructure by 2028. It also warns that hostile actors’ use of artificial intelligence is set to increase the scale and efficiency of their operations over the same period, including ransomware attacks, social engineering and the exploitation of software vulnerabilities.
Richard Horne, the NCSC’s chief executive, said far too many organisations and supply chains in Britain had got away with “doing tech on the cheap” for decades, leaving them vulnerable. He warned of “a real prospect of an unprecedented rise in the number of cyber incidents” in the coming months.
But Horne was clear that the danger does not come from AI inventing entirely new forms of attack. “That is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable,” he said.
The NCSC, which is part of the GCHQ intelligence agency, singled out China as the state best equipped to use AI against British targets. “We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets, with their activity representing the most sophisticated and sustained cyber challenge the UK faces,” Horne said.
He also said Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat. Moscow, Beijing and Tehran have all repeatedly denied similar accusations in the past.
The warning comes after hacking attacks on supermarkets across Europe exposed weaknesses in IT systems. Horne said organisations needed to act urgently now, or explain later “when food isn’t on shelves, lights aren’t on, businesses have gone under … that we saw the warning signs, understood the risks and still didn’t make the right choices”.
The government has announced new investment to strengthen defences, including £60 million for the first phase of a national Cyber Shield to develop AI-driven cyber defence, £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to map weaknesses across critical infrastructure and the wider economy, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC. The measures sit alongside the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan.
The NCSC’s assessment is a forecast, not a report of a specific attack: no particular malware family, target or incident is named in the warning.
Sources: Reuters, “UK must expect AI-powered attack on critical infrastructure within two years, report says” (https://bworldonline.com/technology/2026/11/03/790991/uk-must-expect-ai-powered-attack-on-critical-infrastructure-within-two-years-report-says/); Infosecurity Magazine, “NCSC Chief Warns of AI Ransomware Threat to UK Critical Infrastructure” (https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/).
The featured image is a file photo of GCHQ headquarters in Cheltenham, taken in May 2017, not of the NCSC report itself.
