The Pulse
NCSC Says AI-Powered Malware Is Highly Likely to Feature in UK Infrastructure Ransomware Attack by 2028
The UK’s National Cyber Security Centre says it is highly likely that AI-powered malware will have been used in a ransomware attack on critical national infrastructure between now and 2028. Its assessment describes plausible scenarios, not
AI.info Team · Written with AI · fact-checked ·
On 3 November 2026, the UK’s National Cyber Security Centre (NCSC) published an assessment judging it highly likely that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI) by 2028. The assessment describes how cyber threats could develop across three scenarios; the agency stresses that these are plausible possibilities, not predictions. Its central concern is that AI will help attackers find and exploit weaknesses faster, while many organisations still rely on vulnerable technology.
The 2028 judgment is a likelihood, not a countdown
The NCSC assessment does not say a specific attack is planned, or that AI will independently take control of infrastructure. It judges that “it is highly likely” AI-powered malware will have been used in a ransomware attack on UK infrastructure between now and 2028. A separate key judgment says attackers are likely to target known weaknesses in legacy systems and openings created when infrastructure operators introduce AI tools.
The agency uses calibrated probability terms in its assessments. Its three scenarios—baseline, pessimistic and optimistic—are intended to help examine possible paths for AI-enabled cyber threats, rather than forecast one certain outcome. The report identifies geopolitical tensions, infrastructure security, AI development, access to cyber tools and workforce skills as factors that could shape the threat.
AI raises the speed and scale of familiar attacks
The NCSC’s account focuses less on entirely new attack methods than on faster, more efficient use of existing ones. It says AI can assist with reconnaissance, social engineering, vulnerability discovery and exploit development. Human operators highly likely remain essential to direct and check the work, and the agency says skilled attackers stand to gain the most from those efficiencies.
AI-assisted discovery may also give attackers more opportunities to exploit systems before owners install fixes. The assessment cautions that not every vulnerability identified by an AI system will be immediately dangerous or exploitable. But it says system owners will face pressure to shorten the time between discovering a flaw and deploying a patch.
In its 2026 annual review, the NCSC separately judges China highly likely to have both the intent and the strongest position to use AI against critical infrastructure and other strategic targets. In its AI and cyber intrusion assessment, the agency also judges it highly likely that Russia, China and other nation states will routinely use AI-cyber for geopolitical goals by 2028, raising the scale and speed of sophisticated attacks against the UK.
Old systems remain a central weakness
The threat extends beyond malware itself. The NCSC says attackers are likely to apply AI-cyber capability against known vulnerabilities in legacy CNI technology and new opportunities in the attack surface created by deploying AI tools within CNI. In the report’s baseline scenario, defensive AI tools help some organisations, but the adoption of defensive capabilities across UK infrastructure lags behind offensive use.
The agency’s other scenarios illustrate how different conditions could change the outcome. In its pessimistic case, AI cyber tools become widely available and attacks grow more frequent; the report also describes an uncontrolled automated actor as a realistic possibility, not an established event. Its optimistic case depends on infrastructure operators replacing aging systems, training workers and applying security measures consistently.
Horne points to underinvestment and basic fixes
In remarks prepared for the report’s launch, NCSC chief executive Dr Richard Horne is set to speak about organisations’ security investment. The NCSC says he will urge organisations to address underinvestment, avoid connecting technology to the internet unnecessarily and make Cyber Essentials a starting point for cyber security, not the end goal. In the prepared remarks, Horne says:
“For decades, we have collectively got away with doing tech on the cheap.”
Dr Richard Horne, chief executive of the NCSC
The government has also announced £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre to identify weaknesses across infrastructure and the wider economy. For the NCSC, the near-term test is whether operators can find and fix existing weaknesses before attackers do.