UK cyber agency warns AI-powered ransomware will likely hit critical infrastructure by 2028
Britain's National Cyber Security Centre says AI will mostly speed up old attack methods, and it is urging organizations to fix known weaknesses before attackers find them faster.
Power stations, airports and hospitals are among the targets the agency named
Britain's top cyber authority has put a date on a warning that security experts have been making in general terms for a while. In its annual review published Tuesday, the National Cyber Security Centre, which is part of the GCHQ intelligence agency, said it is highly likely that AI-powered malware will be used in a ransomware attack on the country's critical national infrastructure by 2028, Infosecurity Magazine reported. The report names power stations, airports and hospitals as the kinds of targets at risk from financially motivated criminals.
The wording matters. The agency is not describing a brand-new kind of attack. NCSC chief executive Richard Horne said in a speech marking the report's release that long-tolerated weaknesses in software and networks are the source of the coming rise in incidents, and that AI lets attackers find and exploit those weaknesses at a scale that used to be unimaginable, according to an Associated Press account carried by Quartz. He did not point to new attack methods. The review's AI section says the technology's biggest effect will be to speed up and scale existing tactics.
You might be interested in
The agency's phrase for the problem is "tech on the cheap." Organizations that have put off updates, patching and basic security spending are the ones most exposed, the NCSC said, because AI tools make it easier to turn a known flaw into a working attack. The review urges companies to adopt Cyber Essentials, the government-backed minimum standard built around five controls: firewalls, secure configuration, security update management, user access control and malware protection.
The review also looks outward. It names China as the state best placed to use AI against critical infrastructure, and it warns that China, Russia and other governments will use what it calls AI cyber capabilities to pursue their geopolitical goals. The Register noted that the NCSC's more pessimistic 2028 scenario involves a sharp rise in the frequency and sophistication of attacks worldwide, with AI tools making it harder to tell who is behind them. Separately, the agency flagged continued state-backed espionage aimed at politicians and government officials.
There is some good news in the report as well. The NCSC said AI is already changing how vulnerabilities are found and fixed, and that its own use of AI has uncovered hundreds of potential security issues, including critical ones. It also expects that skilled people will still be needed to direct and check AI-assisted attacks, which means experienced operators stand to gain the most.
The government paired the warning with money. Coverage of the report from AI Weekly said the government is putting £60 million into the first phase of a national Cyber Shield aimed at developing "agentic" cyber defenses with industry, £70 million into a new vulnerability-tracking center at the NCSC, and setting up an AI Cyber Security Centre of Excellence in Manchester. The review puts the yearly cost of malicious cyber activity to UK organizations at about £14.7 billion.
Not everyone thinks the deadline is ambitious enough. Anthony Young, chief executive of the infrastructure security firm Bridewell, said the two-year window "feels generous," according to Infosecurity Magazine. For businesses and public bodies that run essential services, the practical message from the review is simple and not very glamorous: fix the old problems first, because the tools for exploiting them are getting cheaper.