NCSC warns of AI-powered ransomware risk to UK critical infrastructure by 2028
Britain's National Cyber Security Centre judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028, in an assessment published on 3 November 2026.
This is a risk assessment, not an announcement that such an attack has already occurred. The paper explores three plausible scenarios, ranging from slower offensive development to capabilities spreading faster than defences.
The agency expects AI to accelerate vulnerability discovery and exploitation of ageing systems. Its annual review also stresses that successful attacks continue to exploit familiar weaknesses: missing patches, poorly protected systems and equipment exposed to the internet. For organisations, its documented priority remains strengthening these protections and preparing for incidents.