AI’s ransomware encore is coming for UK infrastructure—and 2028 may be the cyber curtain call

AI-powered malware is “highly likely” to be used in a ransomware attack on UK critical national infrastructure by 2028, the National Cyber Security Centre said in its Annual Review 2026, also described as its annual State of the Cyber Nation report. The NCSC expects artificial intelligence to increase the scale and efficiency of ransomware operations, social engineering and the exploitation of software vulnerabilities.

NCSC chief executive Richard Horne said the danger comes primarily from longstanding weaknesses rather than newly invented attack methods. “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” Horne said. “But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.” He added: “For decades, we have collectively got away with doing tech on the cheap.”

Horne urged organizations to invest properly in their technology, remove unnecessary internet connections and treat the government’s Cyber Essentials certification as a starting point rather than the final objective. Leaders who fail to act could have to explain to investors, staff and customers why “food isn't on shelves, lights aren't on, businesses have gone under,” he warned.

The UK government last week announced £60 million (about $80 million) for the first phase of a national Cyber Shield, £70 million ($93 million) for a new National Exposure and Real-Time Vulnerability Centre and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC. The agency also warned that China, Russia and other nation-states will use “AI cyber” to pursue their geopolitical goals, while state-backed espionage increasingly targets politicians, government officials and other high-risk individuals through persistent spear-phishing and attempts to compromise messaging applications. In March, Dutch intelligence agencies said Russian state hackers were targeting officials, military personnel and civil servants worldwide by impersonating Signal support to hijack accounts.

Evidence indicates attackers are already using AI, although its adoption remains uneven. In May, Google’s Threat Intelligence Group said cybercriminals had used an AI model to find and weaponize a previously unknown flaw that bypassed two-factor authentication in a popular open-source administration tool—the first confirmed instance of AI-assisted zero-day development in the wild. A Cambridge University study of more than 90,000 cybercrime forum threads published the same month found that most criminals were using AI for spam and phishing rather than sophisticated attacks. UK Foreign Secretary Yvette Cooper warned that governments could repeat mistakes made during the dawn of the nuclear age if they delayed creating rules for artificial intelligence. “Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness,” the NCSC said.