Skip to main content
CISO Daily
Briefing

NCSC Warns of AI-Powered Ransomware Against UK Critical Infrastructure by 2028: What Boards Should Ask

6 min read
CISO Daily
NCSC Warns of AI-Powered Ransomware Against UK Critical Infrastructure by 2028: What Boards Should Ask

On 3 November 2026 the UK’s National Cyber Security Centre (NCSC), part of GCHQ, published a threat assessment titled Artificial intelligence and cyber intrusion, on the same day as its State of the Cyber Nation report. We did not open the full State of the Cyber Nation report. The headline for executives is not that AI has invented a new kind of attack. In the NCSC’s words, it is that long-tolerated vulnerabilities “can now be discovered and exploited at a scale that was once unimaginable”.

What the NCSC Said

The NCSC’s announcement says critical national infrastructure (CNI) should be braced for a ransomware attack involving AI-powered malware by 2028. It also says AI adoption by hostile actors is “highly likely” to increase the scale and efficiency of their operations, including ransomware, social engineering and vulnerability exploitation, within the next two years.

NCSC chief executive Dr Richard Horne, in remarks the NCSC released in advance, was due to frame this as “a moment of choice”. He was due to say the coming months carry a real prospect of an unprecedented rise in incident numbers, “not because AI has invented new ways to attack us” but because long-tolerated vulnerabilities “can now be discovered and exploited at a scale that was once unimaginable”. He described the era of “tech on the cheap” at the expense of security as over.

The Assessment Behind the Headline

The assessment is written in the NCSC’s formal intelligence language, where terms such as “highly likely” and “almost certain” correspond to defined probability ranges. It looks to 2028 through three scenarios (baseline, pessimistic and optimistic) which it describes as plausible possibilities, not predictions. It also states that the prospect for surprise is high.

Its key judgements include:

  • By 2028 it is highly likely that Russia, China and other states will routinely use AI-enabled cyber capability to pursue geopolitical goals, with the UK facing more attacks at greater speed and sophistication.
  • By 2028 it is almost certain that many systems will remain vulnerable to AI tools that find and exploit weaknesses. Because replacing a lost foothold costs attackers little, they can afford to be less cautious.
  • By 2028 it is likely that attackers will apply these tools to known vulnerabilities in legacy CNI technology, and to the new attack surface created by deploying AI tools inside CNI.
  • Between now and 2028 it is highly likely that AI-powered malware will have been used in a ransomware attack on UK CNI.

In the baseline scenario the NCSC also notes that internal patching and testing processes will need to evolve to keep pace with faster vulnerability discovery, and that defensive capability in CNI lags offensive capability.

What the Government Announced

The NCSC’s announcement states that the Chancellor announced the previous week: GBP 60 million for the first phase of a national Cyber Shield; GBP 70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy; and a new AI Cyber Security Centre of Excellence, run by the NCSC, in Manchester. It also points to the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan.

Why This Matters to a Board

Neither NCSC page we opened sets out a new legal requirement as of 2026-11-11, and our reading is that this is assessment and guidance, not regulation. The Cyber Security and Resilience Bill, which the news page mentions separately, is the legislative track. Our assessment is that its practical effect is on what a board can later say it knew. Dr Horne’s remarks explicitly name the audience: leaders who may have to explain to investors, shareholders, employees, customers and suppliers why services failed. A published government warning of this kind is hard to ignore in a later review of whether oversight was reasonable.

Horne was due to urge organisations to address three things: under-investment in technology, technology that is needlessly connected to the internet, and treating Cyber Essentials as the end goal rather than the starting point.

Our assessment is that the commercial reading follows from this. Ageing systems, internet-exposed services and slow patching cycles, often accepted as low-priority debt, are conditions the NCSC’s pages point to. The 2028 ransomware judgement on the assessment page refers to UK CNI. The NCSC’s separate two-year warning on ransomware and exploitation is not limited to CNI in the wording we read, and we did not open the full State of the Cyber Nation report, so we cannot say how it treats other sectors. Our assessment is that suppliers and customers of CNI operators carry indirect exposure.

Questions to Put to Management

  • Which of our systems are internet-facing, and for each, is that exposure a deliberate decision with a named owner?
  • How many end-of-life or unsupported systems support critical services, and what is the funded plan and date to retire them?
  • If vulnerabilities are found and weaponised faster, can our patching and testing process keep pace? What is the measured time from disclosure to fix for internet-facing systems today?
  • Where are we deploying AI tools inside the business, and has that new attack surface been assessed?
  • Do we hold Cyber Essentials, and what do we do beyond it, scaled to our size and risk?
  • Which of our critical suppliers are in CNI sectors, and what is our plan if they are disrupted?

Our Assessment

The NCSC has told the market, in unusually direct terms, that deferred security investment has a deadline. Nothing here is a prediction of a specific attack on a specific company, and the NCSC itself labels its 2028 scenarios as non-predictive. The defensible board position is to treat the report as a prompt to test basics (exposure, legacy, patch speed) and document the decisions taken.

This briefing is general information, not legal advice.

Sources