The United Kingdom’s National Cyber Security Centre (NCSC) has warned that artificial intelligence (AI) could make cyberattacks against essential services faster and more dangerous. The agency believes it is highly likely that AI-powered malware will be used in a ransomware attack targeting the country’s critical national infrastructure by 2028. The warning is a prediction about growing cybersecurity risks, not confirmation that such an attack has already happened.
The warning was issued on November 3, 2026, when the NCSC published its 2026 annual cybersecurity review. The report explains that advances in artificial intelligence could help hackers discover software vulnerabilities, develop malicious tools, and carry out existing types of cyberattacks more efficiently. It also highlights the growing risks facing critical national infrastructure as cybercriminals and state-supported attackers gain access to more powerful AI technology.
Critical infrastructure includes essential services that people depend on every day, such as electricity networks, hospitals, water supplies, transportation systems, telecommunications, and financial services. A successful cyberattack against these systems could interrupt important operations and affect businesses, public services, and ordinary citizens.
The NCSC believes AI could significantly increase the speed and scale of cyberattacks by improving methods hackers already use. Attackers may use AI to examine computer networks, identify software vulnerabilities, create malicious code, and develop convincing messages designed to trick people into revealing sensitive information. These capabilities could allow criminals to target more organizations in less time. However, the agency expects AI to accelerate existing attack methods rather than automatically carry out every stage of a sophisticated cyberattack without human involvement.
One major concern is ransomware, a type of malicious software that can lock computer files, disrupt systems, or steal sensitive information while criminals demand payment. With AI assistance, attackers may become better at identifying vulnerable networks, preparing convincing phishing messages, and developing software designed to exploit security weaknesses. TechBonafide has previously reported on Medusa ransomware attacks targeting critical infrastructure, highlighting why ransomware was already a serious threat before the latest concerns about AI-powered attacks.
The warning does not mean that a major AI-powered ransomware attack on British infrastructure has already occurred or that one is guaranteed by 2028. According to the NCSC’s latest incident-management figures, the agency supported 337 cyber incidents during its reporting year, including 80 classified as nationally significant. The agency also explained that the use of AI observed during its incident investigations had not produced a fundamentally new category of cyberattack. Its latest prediction therefore highlights the risk of increasingly advanced attacks rather than confirming that such an incident has already taken place.
The report also raises concerns about state-supported cyber operations. In its AI-cyber threat assessment, the NCSC identifies China as particularly well positioned to use advanced artificial intelligence in operations involving critical national infrastructure and other strategic targets. The agency also expects China, Russia, and other countries to use AI more routinely in cyber operations by 2028. These predictions concern future capabilities and potential threats, rather than confirming that any particular country has carried out the ransomware attack described in the warning.
NCSC Chief Executive Richard Horne has warned that many organizations have relied on outdated technology and insufficient cybersecurity investment for years. These weaknesses could become more dangerous as AI tools allow attackers to find and exploit security problems at a much faster rate.
Older computer systems are especially vulnerable when known security weaknesses remain unpatched or when equipment no longer receives important updates. Organizations that continue using outdated technology without adequate protections may become easier targets for AI-assisted attacks. The NCSC also warns that introducing AI tools into critical infrastructure could create additional security risks if the new systems are not properly protected.
However, artificial intelligence is not only helping attackers. Cybersecurity teams can also use AI to detect suspicious activity, examine large amounts of network information, discover software weaknesses, and respond to potential threats more quickly. TechBonafide previously explored how AI can help counter AI-powered cyberattacks in its coverage of Thales’ cybersecurity approach, which highlights the growing role of automated defenses alongside human security experts.
The challenge is ensuring that businesses and public institutions improve their defenses as quickly as attackers improve their methods. Organizations with modern security systems and trained employees may be better prepared, while those with limited resources could struggle to keep up.
The NCSC is encouraging organizations to strengthen their cybersecurity defenses before more advanced threats emerge. Important steps include installing security updates, replacing unsupported systems, enabling multi-factor authentication on sensitive accounts, monitoring suspicious activity, and maintaining secure backups that are regularly tested. The agency’s guidance on mitigating malware and ransomware attacks also recommends preparing and testing incident-response plans so organizations can restore essential operations if a serious cyberattack occurs.
Security specialists also emphasize the importance of protecting supply chains. A security weakness affecting a software vendor, cloud provider, or IT service partner could expose a much larger organization to disruption, even when its own systems have strong protections. TechBonafide previously covered a Notepad++ software-update supply-chain attack, illustrating how attackers can exploit trusted technology delivery systems. Although that case was not an attack on UK critical infrastructure, it demonstrates why organizations must also examine the security of their external technology partners.
The NCSC’s warning sends a clear message to organizations responsible for essential services: cybersecurity weaknesses need attention now, not in 2028. Although AI may help attackers identify vulnerabilities and launch attacks more efficiently, timely security updates, stronger account protection, reliable backups, and well-tested recovery plans can still reduce the potential damage. For the UK, strengthening these defenses will be an important part of protecting critical infrastructure as AI-powered cyber threats continue to develop.
