The UK's National Cyber Security Centre (NCSC) warned on Tuesday that Britain's critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028.

Critical national infrastructure encompasses the essential systems and services — including energy, water, transport and healthcare — whose failure or disruption would have a serious impact on the country.

In its 2026 annual review, the State of the Cyber Nation report, the agency said hostile actors' use of artificial intelligence is "highly likely" to increase the scale and efficiency of their operations within the next two years, including through ransomware, social engineering and the exploitation of software vulnerabilities. The NCSC, which is part of GCHQ, the UK's signals intelligence service, said the country "faces a moment of choice" and that "the future of cyber resilience is not set." The full report is available on the NCSC website.

The agency announced the review's publication in a post on X:

Today, we've published our 2026 annual review: The State of the Cyber Nation. The UK faces a moment of choice. The future of cyber resilience is not set. Read the report now: @GCHQ @DanJarvisMBE pic.twitter.com/mIFWrBB5Yt
— NCSC UK (@NCSC) November 3, 2026

The threat stems less from new attack techniques than from old weaknesses, NCSC chief executive Richard Horne said in prepared remarks for a speech launching the report.

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," Horne said. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

"For decades, we have collectively got away with doing tech on the cheap," he added.

Horne urged organizations to invest properly in their technology, to stop connecting systems to the internet unnecessarily, and to treat the government's Cyber Essentials certification as the starting point for their security rather than the end goal. He warned that leaders who fail to act could find themselves having to explain to investors, staff and customers why "food isn't on shelves, lights aren't on, businesses have gone under."

The warning came days after the government announced £60 million (about $80 million) for the first phase of a national Cyber Shield and £70 million ($93 million) for a new National Exposure and Real-Time Vulnerability Centre, which will identify weaknesses across critical infrastructure. A new AI Cyber Security Centre of Excellence, run by the NCSC, will be based in Manchester. The two timelines now run in parallel, and how quickly the new centre and the wider Cyber Shield take shape — alongside organizations' uptake of measures like Cyber Essentials — will be among the visible markers as the 2028 horizon the NCSC describes approaches.

AI and cyberattacks

The warning follows growing evidence that attackers are already putting AI to work. In May, Google's Threat Intelligence Group said cybercriminals had used an AI model to find and weaponize a previously unknown flaw — a zero-day — that allowed them to bypass two-factor authentication in a popular open-source administration tool. The company said it was the first time it had confirmed AI-assisted zero-day development in the wild.

A Cambridge University study of more than 90,000 cybercrime forum threads, published the same month, found, however, that most criminals were using AI for spam and phishing rather than sophisticated attacks.

UK officials have sounded the alarm about the risks posed by artificial intelligence before. In July, Foreign Secretary Yvette Cooper warned that governments must agree on AI safeguards before frontier systems transform warfare, crime and society.

"We cannot afford to wait for an AI equivalent of Hiroshima before we act," she wrote.