Britain's National Cyber Security Centre has warned that an artificial intelligence-powered ransomware attack on the country's critical national infrastructure is highly likely by 2028, as hostile states and cybercriminals gain tools to exploit weaknesses in essential services.
In an assessment published on 3 November 2026, the GCHQ agency said AI is likely to increase the speed and scale of cyber operations. Its judgement is a forward-looking assessment, not confirmation that an attack has already happened.
Intelligence agency warns of AI-powered ransomware threat
The NCSC assessment, Artificial Intelligence and Cyber Intrusion, judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028. It does not identify a particular target, date or perpetrator. Ransomware can disrupt systems and data, with potentially wider consequences when essential services are involved.
China, Russia and hostile cyber activity
The agency assesses that China, Russia and other states will highly likely use AI-enabled cyber tools routinely to pursue geopolitical objectives by 2028. It identifies China as a particularly sophisticated and sustained cyber challenge and describes risks associated with Russian and Iranian-linked activity. The NCSC does not attribute a specific future ransomware incident to any of these states.
Legacy systems and AI-driven vulnerability discovery
The report warns that outdated technology, weak configuration and unnecessary internet connectivity can leave critical systems exposed. AI could accelerate the identification and exploitation of longstanding weaknesses. Introducing AI into operational systems may also create additional points of exposure unless properly secured.
NCSC chief calls for urgent investment
NCSC chief executive Dr Richard Horne warned that organisations must address underinvestment in cyber resilience and make security a leadership priority. The agency recommends foundational controls, careful management of connected systems, appropriate patching, access restrictions and recovery planning. Cyber Essentials is described as a starting point, not a complete guarantee.
Government sets out cyber defence initiatives
The NCSC announcement refers to £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre and plans for an AI Cyber Security Centre of Excellence in Manchester. The Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan also form part of the Government response. These are announced investments and planned capabilities, not completed protections.
Economic consequences of cyber disruption
The NCSC annual review estimates malicious cyber activity costs UK organisations £14.7 billion annually. It cites the 2025 Jaguar Land Rover cyber incident, for which the company reported approximately £196 million in direct cyber-related costs, as an example of disruption spreading across supply chains. That incident is not presented as an AI-powered critical-infrastructure attack.
What highly likely means
The NCSC uses standardised probabilistic language in intelligence assessments. Highly likely is a judgement about probability, not a guarantee or confirmation of a scheduled attack. Its report examines alternative scenarios and acknowledges uncertainty about the speed of AI adoption by attackers and defenders.
What happens next
Operators of essential services, businesses and public bodies are being urged to review legacy technology, close known security gaps and prepare for recovery from incidents. Further scrutiny will focus on delivery of the Government’s cyber programmes and the progress of proposed legislation.