UK Faces Likely AI Cyberattacks on Critical Infrastructure by 2028

Britain's critical infrastructure—power grids, hospitals, transport networks, and financial systems—faces a realistic prospect of AI-driven ransomware attacks within two years, according to a formal warning from the National Cyber Security Centre (NCSC). The agency published its "State of the Cyber Nation" report and NCSC CEO Dr. Richard Horne delivered the assessment publicly, identifying state-sponsored actors from China, Russia, and Iran as the primary threats driving this accelerating danger.

What the NCSC Report Actually Says

The NCSC's report centers on a clear, timed projection: AI-powered malware is likely to be deployed against UK critical national infrastructure (CNI) by 2028. According to AP News, the report does not claim AI will invent new attack methods from scratch. Instead, NCSC analysts determined that AI enables adversaries to dramatically expand the scale and speed of operations built on already-known vulnerabilities—vulnerabilities that organizations have often tolerated rather than patched.

The report presents three scenarios for how AI will reshape the cyber threat landscape by 2028. The most probable scenario, the NCSC concluded, is a global increase in AI-enhanced cyber capabilities, primarily propelled by geopolitical competition and rapid improvements in the AI systems that hostile nations already possess and deploy.

Dr. Horne stated plainly: "We face a real prospect of an unprecedented rise in the number of cyber incidents." He described the threat not as hypothetical but as a foreseeable outcome if organizations do not substantially change how they approach security investment.

State Actors: China, Russia, and Iran

The NCSC report singles out China as the most sophisticated state threat to the UK's critical infrastructure, according to AP News. Chinese cyber actors are described as particularly well-positioned to exploit CNI vulnerabilities using AI-augmented tools at scale.

Russia, while also named prominently, is characterized as maintaining active operations targeting UK military networks. The NCSC additionally flagged Iran as a growing concern, noting that Iranian actors have been expanding their malicious cyber operations on a global level.

Dr. Horne put the state-actor threat in direct terms: "AI will enable hostile states to scale up their capabilities and exploit previously tolerated weaknesses." The NCSC's position is that the combination of adversarial AI capability and persistent unpatched vulnerabilities in UK infrastructure creates a compounding risk accelerating toward the 2028 window.

The "Doing Tech on the Cheap" Problem

A pointed theme running through the NCSC's findings is that UK organizations across both public and private sectors have routinely underinvested in cybersecurity. Dr. Horne characterized this as a culture of "doing tech on the cheap," a practice the report frames as directly contributing to the vulnerability the country now faces.

The NCSC's message to organizational leaders was direct: insufficient security spending is not a defensible position. According to the NCSC's own published statements, as cited by AP News, Dr. Horne challenged executives and board members: "We must be clear that failing to invest in security means leaders will eventually have to explain why they did not act."

He pressed the stakes further with a concrete scenario: "What will you say when food isn't on shelves, or lights aren't on because we failed to recognize the risks?" That framing—food supply and electricity as tangible consequences of cyber inaction—reflects the NCSC's effort to make the abstract threat legible to decision-makers outside the technical community.

Government Investment: Cyber Shield and NERV Centre

The report does not simply diagnose the threat; it points to specific government funding commitments intended to shore up national defenses. The NCSC outlined a £60 million investment to roll out a national Cyber Shield initiative, designed to provide systematic protection for organizations operating within critical sectors.

In addition, the government has committed £70 million toward establishing the National Exposure and Real-Time Vulnerability Centre, referred to as the NERV Centre. Its mandate is to identify vulnerabilities across the economy and within critical infrastructure systems before adversaries can exploit them.

Both programs represent layered defensive approaches. The Cyber Shield addresses organizational resilience broadly, while the NERV Centre focuses on real-time identification of exposures—precisely the class of weaknesses the NCSC warns AI-equipped state actors are now primed to find and weaponize faster than defenders can close them.

Recent Incidents Illustrate the Stakes

The report's release followed a period in which high-profile cyber incidents demonstrated real-world consequences across Europe. The NCSC pointed to cyberattacks on supermarkets as one illustration of how failures in digital security translate directly into disrupted daily life for consumers. Those incidents underscored that the threat is not limited to government networks or defense systems but extends to the supply chains that stock shelves and the logistics systems that keep economies moving.

That context makes the 2028 timeline feel less like a distant forecast and more like a near-term planning horizon. The NCSC's framing in the report is consistent: organizations that treat security as an afterthought today are the organizations most likely to face an AI-enabled attack before the decade ends.

What Organizations Are Being Asked to Do

The NCSC's guidance, as reported by AP News and reflected in the agency's own published communications at ncsc.gov.uk, centers on a fundamental reassessment of cybersecurity investment priorities. The central asks are to move security from a peripheral budget item to a board-level strategic concern, to address long-tolerated vulnerabilities proactively rather than waiting for a breach to force the issue, and to engage with the national programs—including the Cyber Shield—being built to support that work.

Dr. Horne's message is consistent across the report: the technology landscape is shifting in ways that make previously acceptable risk tolerances no longer acceptable. AI is changing the calculus of how quickly, cheaply, and effectively hostile actors can turn known weaknesses into live incidents. The NCSC's warning is that the window for getting ahead of that shift is measured in months, not years.

Sources referenced