Back

NCSC: AI Ransomware on UK Infrastructure Highly Likely by 2028

lite News Desk 2 min read

A ransomware attack involving AI-powered malware against the UK’s critical national infrastructure is highly likely by 2028, according to the National Cyber Security Centre (NCSC). The forecast forms part of its assessment of artificial intelligence and cyber intrusion, published on 3 November 2026.

The assessment uses highly likely to denote an estimated probability between 80% and 90%, rather than certainty. Its judgments cover AI-enabled cyber threats through 2028, including how attackers might use the technology and the continuing role of human operators.

According to the NCSC, AI’s main role is to make established cyber methods faster and increase their scale. Those methods include gathering information about targets, social engineering, finding vulnerabilities and writing code to exploit them. The centre assesses that people are likely to remain necessary for directing operations and adjusting them, rather than AI carrying out every stage independently.

For critical infrastructure, the NCSC assesses that attackers are likely to apply AI to known flaws in older technology by 2028. It also identifies exposure introduced by infrastructure operators’ own deployment of AI tools as another likely target.

In the centre’s terminology, a vulnerability is a defect in a process or system that can provide an attacker with access. Once a vendor releases a fix, the weakness is classed as known, also called n-day. According to the assessment, systems can remain exposed if the update has not been applied.

The NCSC also assigns a highly likely rating to routine AI use in cyber operations by Russia, China and other states by 2028. Its assessment links that anticipated use to more sophisticated attacks against the UK being conducted at greater speed and scale.

Alongside those judgments, the report presents three scenarios for the medium term. The NCSC says these describe plausible possibilities, not predictions, and that the pace of AI development leaves substantial room for developments that were not anticipated.

For organisations, the centre’s guidance is to remedy basic security gaps, address insufficient investment in technology and remove internet connections that are not needed. It said Cyber Essentials should provide an initial security baseline, with additional protections matched to each organisation’s risk, complexity and size.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Binance said its zero-knowledge proof for ten tokens was expected by November 3, with checks showing backing of at least 1:1.

  2. Binance said it had replenished about 90% of the affected assets by October 31, with its treasury and user fund covering the losses.

  3. Drupal recommends updating Commerce Core to a fixed release and reviewing orders for inconsistencies.

  4. Apple says the reported exploitation was extremely sophisticated and involved selected targets using iOS versions earlier than iOS 27.

  5. The flaw affects Brotli data processed by Node.js’s zlib module, with crashes, memory disclosure or code execution possible for attacker-supplied input.