// AI threat desk · 4 Nov 2026
Home/AI-ATK · AI-Powered Attacks
AI-Powered AttacksMediumAICVSS not assigned

NCSC warned AI ransomware could target UK critical infrastructure by 2028

The NCSC said AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028. It published the warning on Nov 3, 2026.

· 2 min read
AI-generated image of security analysts monitoring a ransomware incident in a dim operations centre
AI-generated image, not a photo of the event.
Key takeaways
  • AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028.
  • Hostile actors are highly likely to use AI within two years to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.
  • The UK government is investing £60 million in the first phase of a national Cyber Shield.

The UK National Cyber Security Centre warned on Nov 3, 2026, that AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028.

The NCSC said hostile actors are highly likely to use AI within two years to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. The warning applies to organizations supporting Britain’s critical infrastructure and the wider economy.

The NCSC is part of GCHQ, the UK’s signals intelligence agency. Its State of the Cyber Nation report said organizations must make significant changes to prevent AI from being used against the UK economy and society, while also describing AI as an opportunity to improve collective cyber resilience.

On this page

AI could scale existing ransomware and vulnerability attacks

The NCSC said AI is more likely to enhance and scale existing tactics and techniques than find entirely new vulnerabilities. That includes increasing the scale and efficiency of ransomware, social engineering and vulnerability exploitation.

The NCSC said organizations should use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting unintended activity.

NCSC called for investment and fewer internet connections

The NCSC said organizations should address underinvestment in technology, avoid connecting technology to the internet unnecessarily and make Cyber Essentials their starting point for cybersecurity.

UK is funding cyber defenses and vulnerability discovery

The government is investing £70 million in a National Exposure and Real-Time Vulnerability Centre to identify vulnerabilities across critical infrastructure and the economy.

The NCSC said the government is developing the first phase of a national Cyber Shield with £60 million in funding and is establishing an AI Cyber Security Centre of Excellence in Manchester.

The UK government is introducing the Cyber Security and Resilience Bill and the National Cyber Action Plan to strengthen the country’s defenses. It is also establishing an AI Cyber Security Centre of Excellence in Manchester, run by the NCSC, to develop AI security expertise within government.

The NCSC said organizations must take urgent action to address foundational investments and weaknesses or risk adversaries exploiting them. The government is investing £60 million in the first phase of a national Cyber Shield and £70 million in a National Exposure and Real-Time Vulnerability Centre.

What to do now

  1. Prepare for a wave of patches that will address decades of technical debt.

FAQ

What did the NCSC warn about AI-powered ransomware?

The NCSC said AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028.

Who could be affected by AI-powered cyberattacks?

Britain’s critical national infrastructure, organizations supporting it and the wider UK economy could be affected by ransomware, social engineering and vulnerability exploitation assisted by AI.

What did the NCSC tell organizations to do about autonomous AI?

The NCSC said organizations should use safeguards, sandboxing and active oversight to limit unintended activity from autonomous systems.

What is the UK government doing in response?

The government is introducing the Cyber Security and Resilience Bill and National Cyber Action Plan, while funding a national Cyber Shield and a National Exposure and Real-Time Vulnerability Centre.

Sources

  1. NCSC Annual Review 2026, NCSCPrimary
  2. Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years, NCSCPrimary
  3. UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028, SecurityWeek
  4. NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure, Infosecurity Magazine
  5. UK Cyber Chief Warns of Unprecedented Threat as Hostile Nations Weaponize AI, NTD News
  6. UK Cyber Chief: State Actors Linked to 75 Percent of Critical Infrastructure Cyber Incidents, theepochtimes
How we checked this story
ClaimSourceStatus
NCSC said AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028.NCSCConfirmed
NCSC said hostile actors are highly likely to use AI within two years to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.NCSCConfirmed
NCSC said AI is more likely to enhance and scale existing tactics than discover entirely new vulnerabilities.NCSC, via SecurityWeekAttributed
Richard Horne said tolerated vulnerabilities could be discovered and exploited at an unimaginable scale.Richard Horne, via SecurityWeekAttributed
NCSC chief Richard Horne said the UK faces a real prospect of an unprecedented rise in cyber incidents.Richard Horne, via Infosecurity MagazineAttributed
NCSC said hostile states including Russia and China will routinely use AI to pursue geopolitical goals.NCSC, via Infosecurity MagazineAttributed
NCSC said organizations must urgently address underinvestment and foundational weaknesses to prevent adversaries exploiting them.NCSCConfirmed
NCSC urged organizations to avoid unnecessarily connecting technology to the internet and make Cyber Essentials their starting point.NCSCConfirmed
NCSC said the UK government is investing £60 million in the first phase of a national Cyber Shield.NCSCConfirmed
NCSC said the government is investing £70 million in a National Exposure and Real-Time Vulnerability Centre.NCSCConfirmed
NTD News reported that hackers remotely controlled commercial refrigeration systems across seven European countries and the UK.NTD NewsAttributed
The Epoch Times reported that the NCSC managed more than 200 incidents affecting UK critical infrastructure and supporting organizations between June 2025 and May 2026.NCSC, via theepochtimesAttributed
NCSC said organizations should use safeguards, sandboxing and active oversight to limit unintended activity from autonomous systems.NCSCConfirmed
NCSC is part of GCHQ, the UK’s signals intelligence agency.NCSCConfirmed
NCSC said organizations must make significant changes to avert AI being used against the UK economy and society.NCSCConfirmed
NCSC published its State of the Cyber Nation report on Tuesday, 3 November 2026.NCSCConfirmed
ncsc.gov.uk published its report on Nov 3, 2026.ncsc.gov.ukConfirmed
ncsc.gov.uk published its report on Nov 3, 2026.ncsc.gov.ukConfirmed

Could not verify

  • Whether AI-powered attacks against UK critical infrastructure have already occurred is not established
  • How many UK organizations could be affected by 2028 is not established
  • Whether any specific state or criminal group will conduct the predicted attacks is not established
  • Whether the reported refrigeration incidents were AI-powered is not established
ransomware
See all in AI-Powered Attacks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok