AI Risks: NCSC Warns of Ransomware Threat to Critical Infrastructure by 2028

The UK’s National Cyber Security Centre (NCSC), part of GCHQ, published the State of the Cyber Nation report and a related assessment of AI-related threats on November 3, 2026. According to the NCSC, AI risks mainly involve hostile actors potentially increasing the scale and effectiveness of ransomware, social engineering, and vulnerability exploitation over the next two years.

AI Risks and Attacks by 2028

According to the NCSC forecast, it is highly likely that AI-powered malware will be used in a ransomware attack against the UK’s critical national infrastructure by 2028. This is an assessment of future risk, not an announcement of a specific incident.

The center did not say that such an attack is already underway, nor did it identify a specific malware family, vulnerability, or confirmed case of exploitation. The announcement also does not attribute the anticipated attacks to any particular state or hacking group.

The NCSC expects AI to be used in social engineering and in finding or exploiting existing security weaknesses. For organizations, this is therefore not information about a new flaw requiring emergency patching, but a strategic warning about the possible acceleration of known attack methods.

Focus on Technical Debt and Internet-Exposed Systems

The NCSC links the worsening risk mainly to long-standing security weaknesses, insufficient investment, and systems exposed to the internet. It recommends that organizations address long-standing weaknesses, reduce unnecessary internet exposure of systems, and build resilience beyond the basic Cyber Essentials standard.

Practical priorities for organizations include basic cyber hygiene, network segmentation, vulnerability management, and ransomware preparedness. For critical infrastructure operators and large organizations, the key point is that the forecast highlights the combination of new attacker tools with existing weaknesses in defenses.

What Comes Next

Further details may come from the full Artificial intelligence and cyber intrusion assessment, including the methodology and scenarios on which the NCSC based its analysis. Specific steps by the UK government will also be monitored, including the Cyber Shield, NERV Centre, and AI Cyber Security Centre of Excellence initiatives.

For an immediate technical response, any future NCSC warnings about specific campaigns, actors, or exploited vulnerabilities will be particularly relevant. The current announcement does not contain such a technical indicator.

Verified and updated: 03. 11. 2026 06:34