NCSC says AI-powered attack on UK critical infrastructure likely by 2028

The UK could face AI-driven cyber attacks targeting its critical national infrastructure (CNI) by 2028, with the National Cyber Security Centre (NCSC) – a branch of the UK’s wider Government Communications Headquarters (GCHQ) – warning that hostile states and cyber criminals are increasingly capable of exploiting vulnerabilities at unprecedented speed and scale.

In its 2026 Annual Review, published on 3 November and titled ‘The State of the Cyber Nation’, the NCSC identifies AI as a significant force multiplier in the cyber threat landscape, with the potential to increase the sophistication, frequency and effectiveness of attacks against the UK’s defence, government and essential services that existing defensive capabilities may struggle to match.

The assessment raises particular concern for the UK’s defence and national security environment, where military networks, essential civilian services, government systems and communications infrastructure are now increasingly interconnected and reliant on resilient digital technologies.

A successful attack against these systems could have consequences extending beyond data theft or financial disruption, potentially affecting operational readiness, national resilience and the continuity of essential services.

The assessment warns that it is highly likely that AI-powered malware will be used in a ransomware attack against UK CNI by 2028. The rising accessibility of advanced AI tools could also lower the technical barriers to conducting complex cyber operations, allowing hostile actors to increase the frequency and effectiveness of their attacks.

NCSC Chief Executive, Dr Richard Horne, has highlighted the danger posed by organisations failing to address longstanding cyber weaknesses in their digital infrastructure, describing it as a potential “moment of choice”. He warned that vulnerabilities which have been tolerated for years could now be discovered and exploited “at a scale that was once unimaginable”.

The growing threat of autonomous cyber attacks against the UK

AI is expected to enhance established cyber-attack methods, allowing hostile actors to automate vulnerability discovery, surveillance and reconnaissance, social engineering and malware development. This could enable more sophisticated attacks to be conducted at greater speed, placing additional pressure on organisations that are already struggling to address existing security weaknesses.

The NCSC also warns of a worst-case scenario involving an advanced AI that is capable of self-replication and conducting cyber attacks autonomously. Horne warned that organisations must make “significant” changes to protect critical systems, adding that they can no longer rely on “technology on the cheap”.

Particular concerns surround operational technology controlling physical infrastructure, including electricity networks, manufacturing facilities and other essential services. Weak security across these environments could create opportunities for attackers to cause large-scale disruption that extends beyond the digital domain.

Russia, China and Iran: Hostile states intensify the cyber threat

The rising AI threat comes against a backdrop of sustained cyber activity from hostile states, with the NCSC warning that adversaries increasingly use cyber operations to advance geopolitical and military objectives.

China represents the UK’s most “sophisticated and sustained” cyber challenge, according to the report. The NCSC believes Beijing is best positioned to exploit AI capabilities against CNI, government systems and strategic defence networks, presenting a significant long-term security concern.

Russia remains a major threat, with persistent attempts to penetrate UK military networks and communications systems. The agency also highlights Moscow’s growing use of cyber operations as part of wider hybrid warfare campaigns that are designed to disrupt institutions and undermine national security while remaining below the threshold of conventional armed conflict.

Iran-linked groups also remain active, conducting malicious cyber operations against British organisations and individuals perceived as threats to the Iranian regime.

The NCSC assesses that Russia and China are highly likely to routinely employ AI-enabled cyber capabilities to advance their own geopolitical objectives, potentially increasing the scale and effectiveness of existing attacks.

For the UK defence sector, this reinforces the importance of protecting military communications, sensitive information, data and CNI against an increasingly sophisticated range of digital threats.

Building Britain’s defences against sophisticated AI-powered cyber attacks

Horne has called for organisations to abandon what he described as decades of reliance on “tech on the cheap”, highlighting outdated systems, inadequate investment in security and insufficient protection for physical infrastructure.

He warned that failure to act could have serious real-world consequences. “When food isn’t on the shelves, when lights aren’t on, businesses have gone under,” he said.

The NCSC is also highlighting the defensive potential of AI, including automated vulnerability detection and faster security updates. The government’s proposed National Cyber Shield and National Exposure and Real-Time Vulnerability Centre are intended to bolster protection across critical infrastructure and the wider UK economy.

For the UK’s defence and security community, the message is clear: investment in cyber resilience, secure technology and the wider protection of military and civilian infrastructure must keep pace with the rapidly evolving AI-driven capabilities of prospective hostile state or criminal actors.