LONDON, November 3, 2026 — Britain’s critical infrastructure could face ransomware attacks involving artificial intelligence within the next two years, according to a warning from the country’s National Cyber Security Centre (NCSC), which says hostile governments and criminal groups are increasingly using AI to make cyber operations faster and more effective.
NCSC chief executive Richard Horne issued the warning on Tuesday as the agency released its annual State of the Cyber Nation report. The assessment says AI-powered malware is highly likely to be used in a ransomware attack against UK critical national infrastructure by 2028.
The warning covers essential services and systems that support everyday life, including electricity networks, water facilities, manufacturing operations, transportation-related infrastructure and refrigeration systems.
But the concern is not simply that artificial intelligence will invent entirely new forms of cybercrime.
Instead, the NCSC says AI could help attackers identify weaknesses that organisations have left unresolved for years, automate parts of existing attack methods and exploit vulnerabilities at a scale that traditional security teams may struggle to match.
Horne urged businesses and public institutions to stop treating cybersecurity as an optional expense, warning that outdated technology and inadequate investment could eventually disrupt essential services and damage the wider economy.
The assessment comes as governments and businesses worldwide face questions about how to protect increasingly connected infrastructure in an era when AI is becoming a tool for both cyber defence and malicious activity. <Cite refs={[“turn788365search0″,”turn788365news7″,”turn788365search1”]} />
NCSC Says AI Could Industrialise Existing Cyber Threats
The central finding of the NCSC report is that artificial intelligence is likely to increase the scale, speed and efficiency of cyber operations.
Rather than assuming attackers will suddenly develop completely unfamiliar methods, the agency expects AI to improve techniques that already exist.
These include ransomware, social engineering, vulnerability discovery and other forms of unauthorised access.
AI can assist with tasks that previously required considerable human time and expertise. This could allow malicious actors to examine more potential targets, process information faster and coordinate activity across multiple organisations.
The consequences could be particularly serious when organisations rely on older technology that has not received adequate security updates.
Horne said longstanding weaknesses could now be discovered and exploited at a scale that was previously difficult to achieve.
His criticism was directed not only at government agencies but also at businesses of every size that have prioritised lower technology costs over long-term security and resilience.
The NCSC’s message is that cybersecurity must become part of the basic cost of operating an organisation, rather than an expense considered only after an incident occurs. <Cite refs={[“turn788365search0″,”turn788365search4”]} />
Why 2028 Has Become an Important Warning Point
The NCSC’s assessment identifies 2028 as a significant point in its projections of the cyber threat landscape.
It says AI adoption by hostile actors is highly likely to increase the scale and efficiency of their operations by then.
The agency also assesses that AI-powered malware is highly likely to have been used in a ransomware attack against UK critical infrastructure between now and 2028.
This is a forward-looking intelligence assessment, not a confirmed prediction that a particular attack will happen on a specific date.
The report considers three possible scenarios:
- Baseline scenario: AI increases the global cyber threat, allowing state-linked groups and criminals to conduct more efficient operations against vulnerable organisations.
- Pessimistic scenario: AI capabilities spread faster than defensive systems can adapt, increasing the frequency and sophistication of attacks.
- Optimistic scenario: Organisations modernise outdated systems, improve cybersecurity education and adopt effective safeguards, allowing defenders to manage emerging threats more successfully.
The scenarios are intended to help policymakers and organisations consider different possible futures. They are not statements that any one outcome is guaranteed.
The report also acknowledges that developments in AI are moving quickly, making it difficult to predict exactly how the technology and its misuse will evolve. <Cite refs={[“turn788365search3”]} />
China, Russia and Iran Feature in Britain’s Cybersecurity Assessment
The report also identifies geopolitical competition as a major factor shaping the UK’s cyber threat environment.
The NCSC describes Chinese cyber activity as the most sophisticated and sustained state-linked cyber challenge facing Britain.
It assesses that China is highly likely to have both the intention and the capability to use AI for operations against UK critical infrastructure and other strategic targets.
Russia is also identified as a significant concern. The report describes sustained Russian cyber activity and campaigns intended to advance geopolitical objectives without necessarily crossing the threshold of conventional armed conflict.
Iran is identified as another source of malicious cyber activity, including operations targeting the UK and individuals considered threats by the Iranian government.
These assessments are attributed to British intelligence authorities. They should not be interpreted as proof that every cyber incident originates from a particular country or that every activity attributed to a state has been independently established in public.
China, Russia and Iran have historically rejected various allegations of malicious cyber activity made by Western governments.
The wider issue is that governments increasingly view cyber capabilities as instruments of national influence, intelligence gathering and strategic pressure.
The NCSC believes AI could make those capabilities more accessible and efficient, increasing the importance of protecting essential systems. <Cite refs={[“turn788365search1″,”turn788365search3″,”turn788365news7”]} />
Supermarket Refrigeration Attacks Show How Digital Disruptions Can Affect Daily Life
One example highlighted by Horne involved recent cyberattacks affecting refrigeration systems at supermarkets in France.
The incidents demonstrated how digital systems connected to physical equipment can create consequences beyond computers and online services.
Supermarket refrigeration is essential for preserving food. If the systems controlling it are disrupted, retailers may face operational problems and difficulties maintaining suitable storage conditions.
Horne cited the incidents as an example of how cyber activity can affect civilian infrastructure and ordinary economic activity.
The wider concern extends to other automated systems used in modern society.
These include electricity switching equipment, water-management infrastructure, dam operations, manufacturing lines and heating and cooling controls.
Such systems are increasingly connected to digital networks, making cybersecurity an important part of their safe and reliable operation.
The issue is not that every connected system is automatically vulnerable. Rather, organisations must understand the risks created by their technology and ensure that security arrangements keep pace with changes in how equipment is operated.
The supermarket incidents have also reinforced the importance of protecting older operational technology, which may have been designed before today’s cybersecurity risks became as prominent. <Cite refs={[“turn788365news7″,”turn788365search4”]} />
Poland’s Electricity Grid Attack Raised Wider European Concerns
The NCSC also referred to a December 2025 incident involving Poland’s electricity infrastructure.
British and European authorities attributed the attempted attack to Russia’s Federal Security Service, commonly known as the FSB.
According to the UK assessment, a successful attack could have left approximately 500,000 people without electricity during winter.
The incident illustrated the potential consequences of hostile activity directed at infrastructure that supports households, businesses and public services.
Electricity networks are particularly important because disruptions can affect multiple sectors simultaneously.
A power outage can interrupt communications, transport operations, water services, business activity and other essential functions.
The incident is part of a broader European concern about cyber operations directed at energy infrastructure and other strategically important systems.
It also demonstrates why governments increasingly consider cybersecurity a matter of national resilience rather than simply an IT management issue. <Cite refs={[“turn788365news7″,”turn788365search1”]} />
AI-Assisted Vulnerability Discovery Is Increasing Pressure on Organisations
Another development highlighted in the reporting is the use of AI to identify software vulnerabilities.
During the week before the NCSC announcement, governments and technology companies worked on urgent security updates after AI-assisted research identified two serious weaknesses in PHP, a programming language used by a large number of websites.
The flaws raised concerns about unauthorised access to affected systems and the importance of applying security updates promptly.
The example illustrates a central point in the NCSC’s assessment: AI can make it easier to discover weaknesses that may have existed in software for years.
That does not mean every AI-discovered vulnerability will automatically become a successful cyberattack.
Software developers and security teams can also use AI to identify problems, assess risks and improve defensive responses.
However, organisations that delay updates or operate unsupported technology may have less time to address weaknesses before malicious actors attempt to exploit them.
The NCSC argues that this changing environment makes basic cybersecurity practices and timely maintenance more important than ever. <Cite refs={[“turn788365news2″,”turn788365search0”]} />
Jaguar Land Rover Attack Demonstrates the Economic Cost of Cybercrime
The financial consequences of cyberattacks are another major concern in the report.
The NCSC estimates that malicious cyber activity costs UK organisations almost US$20 billion annually.
One prominent example was the 2025 cyberattack affecting carmaker Jaguar Land Rover.
The incident caused significant disruption to the company’s operations and affected suppliers across its wider business network.
The NCSC said Jaguar Land Rover suffered more than US$260 million in direct losses.
The impact extended beyond the company itself, affecting supply chains and contributing to wider economic disruption in the UK.
The case demonstrates why cybersecurity cannot be treated as a problem affecting only the organisation directly targeted.
Modern businesses depend on suppliers, logistics providers, cloud services, software platforms and other interconnected systems.
A serious incident affecting one organisation can therefore create problems for businesses that depend on it.
For manufacturers, financial institutions and other large employers, the cost of inadequate cybersecurity can include operational delays, lost revenue, recovery expenses and damage to customer confidence. <Cite refs={[“turn788365news7″,”turn788365news8”]} />
UK Records 1,831 Cyberattack Reports in Its Latest Annual Review
The warning comes as the NCSC reports a substantial volume of cyber incidents during its latest reporting period.
Its annual review covers the period from September 1, 2025, to August 31, 2026.
During that period, the agency’s incident management team received 1,831 reports of cyberattacks, of which 80 were classified as nationally significant.
The figures demonstrate the scale of the cybersecurity challenge facing Britain.
However, the number of reports should not be interpreted as a count of successful attacks against critical infrastructure alone. It covers a wider range of incidents reported to the NCSC.
The agency’s role includes helping organisations respond to significant cyber incidents, coordinating national-level responses and supporting improvements in the UK’s overall cyber resilience.
The latest review also reflects the changing responsibilities of the agency as AI, cloud computing and increasingly connected systems become more important to the country’s economy and public services. <Cite refs={[“turn788365search0″,”turn788365news8”]} />
Britain Is Expanding Its Cyber Defence Investment
The UK government is also increasing investment in cybersecurity capabilities.
According to the NCSC announcement, the Chancellor recently outlined several initiatives intended to improve national cyber defence.
These include:
- £60 million for the first phase of a national Cyber Shield: An initiative intended to strengthen the UK’s ability to identify and respond to cyber threats.
- £70 million for a National Exposure and Real-Time Vulnerability Centre: Known as the NERV Centre, it is intended to help identify weaknesses across critical infrastructure and the wider economy.
- An AI Cyber Security Centre of Excellence in Manchester: A new initiative led by the NCSC to develop expertise in using and securing artificial intelligence.
The government is also advancing the Cyber Security and Resilience Bill and preparing a National Cyber Action Plan.
The proposed measures are intended to strengthen the security of essential services, improve national preparedness and make it more difficult for hostile actors to disrupt important systems.
The investment reflects a growing recognition that cyber defence requires continuous attention as technology and threats evolve.
However, funding and new institutions alone cannot guarantee protection. Organisations still need to implement appropriate safeguards and maintain them over time. <Cite refs={[“turn788365search0”]} />
The NCSC’s Advice: Modernise Systems and Strengthen Basic Security
Despite the attention surrounding AI, the NCSC is emphasising the importance of established cybersecurity practices.
The agency says organisations should address fundamental weaknesses rather than relying exclusively on advanced technology to protect themselves.
Its recommendations include:
- Keep software and devices updated: Security updates help address known weaknesses in operating systems, applications and connected equipment.
- Limit administrative access: Organisations should ensure that powerful system permissions are restricted to authorised personnel who genuinely need them.
- Maintain secure backups: Important files and data should be backed up so organisations can recover information following disruption.
- Improve technology investment: Businesses should avoid depending indefinitely on outdated systems that are difficult to maintain securely.
- Strengthen organisational resilience: Cybersecurity should be supported by appropriate planning, staff awareness and tested arrangements for maintaining essential services.
The NCSC also recommends that organisations use Cyber Essentials as a starting point rather than treating basic certification as the end of their security responsibilities.
The appropriate level of protection depends on the organisation’s size, complexity and exposure to risk.
For the public, the wider lesson is that cybersecurity is connected to the reliability of services people use every day, including banking, communications, retail and utilities. <Cite refs={[“turn788365search0″,”turn788365search3”]} />
Singapore and Southeast Asia Face Similar AI Security Questions
Although the NCSC’s assessment focuses on the UK, the underlying issues are relevant to Southeast Asia.
Countries across the region are investing in artificial intelligence, cloud computing, digital banking and data centre infrastructure. As more essential services depend on connected systems, cybersecurity becomes increasingly important to economic and public-sector resilience.
Singapore, for example, has been examining how to manage the risks created by increasingly autonomous AI systems.
WWC One Media reported on the issue in Singapore Reports No Rogue AI Attack on Government Agencies — But Stronger Safeguards Are Coming.
The report explained how Singapore authorities are considering safeguards that limit what AI agents can access and which actions they are authorised to perform.
The wider international debate is also shifting from AI-assisted activity to increasingly autonomous systems.
In October, WWC One Media examined INTERPOL’s warning in INTERPOL Warns Agentic AI Could Automate Cyberattacks as Criminals Scale Scams at Machine Speed.
That coverage explored how AI could make familiar criminal methods more scalable, even when humans remain involved in directing malicious activity.
Financial institutions are another area of concern. WWC One Media previously covered the cybersecurity investigation involving South Korean banks in CrowdStrike Links South Korean Bank Hacks to Possible China-Based Suspect Using AI Tools.
The case added to regional discussion about how AI-assisted tools could affect financial-sector security.
For Southeast Asian governments, the UK warning is therefore a reminder that digital transformation needs to be accompanied by investment in cybersecurity, trained personnel and reliable infrastructure.
Why Critical Infrastructure Protection Is Becoming a National Priority
The NCSC’s warning reflects a broader change in how governments understand national security.
Electricity networks, water facilities, manufacturing systems and communications infrastructure are no longer viewed only as physical assets. Their digital controls and connected software are also essential parts of their operation.
A cyber incident affecting one system can create consequences elsewhere.
For example, an interruption to electricity could affect telecommunications and refrigeration. A disruption to a major digital service could interfere with business operations and public access to information.
This interconnectedness makes resilience important.
Organisations must consider not only how to prevent incidents but also how to maintain essential services if an incident occurs.
The UK is responding through investment in cyber defence, vulnerability assessment and stronger organisational requirements.
Other countries are pursuing their own approaches, but the shared challenge is similar: keeping essential services reliable while technology becomes more complex.
The Bigger Test Is Whether Organisations Act Before an Attack
The NCSC’s 2028 warning is not a declaration that Britain will inevitably suffer a particular cyberattack.
It is an assessment that AI is likely to make existing threats more efficient and that weaknesses left unresolved today could become more serious in the near future.
For Horne and the NCSC, the greatest concern is that organisations may understand the risks but continue postponing the investment needed to address them.
The potential consequences go well beyond stolen information or temporary website outages. Critical infrastructure disruptions can affect food availability, electricity, water services, manufacturing and the wider economy.
The UK government’s new funding programmes and proposed legislation are intended to improve the country’s ability to respond.
But the effectiveness of those measures will depend on whether individual organisations modernise their systems, strengthen security practices and prepare for disruptions before they occur.
Artificial intelligence can support faster innovation and stronger cyber defence. It can also give malicious actors more efficient ways to exploit weaknesses.
The next two years may therefore become an important test of whether governments and businesses can keep defensive capabilities moving at the same pace as the technology they are trying to protect.
Can Britain modernise its critical infrastructure quickly enough to stay ahead of AI-powered cyber threats by 2028—or will years of underinvestment leave essential services exposed to risks that organisations already know are coming?
