The UK’s National Cyber Security Centre expects ransomware involving AI-powered malware to strike Britain’s critical national infrastructure by 2028. Its warning puts a near-term deadline on a familiar problem: organisations carrying security weaknesses they have delayed fixing.
In a statement published on 3 November, the agency described that outcome as highly likely. The warning accompanies its State of the Cyber Nation report and calls for urgent investment in resilience. It is an assessment of future risk, rather than an announcement that such an attack has already happened.
The statement previews remarks from NCSC chief executive Richard Horne urging organisations to remove unnecessary internet connections and treat Cyber Essentials as a starting point, with further protections matched to their size, complexity and risk.
Faster attacks still depend on people
The report’s AI threat assessment says the largest change will be the acceleration of established attack methods. It identifies reconnaissance, social engineering, vulnerability discovery and exploit development as areas where models can help operators work faster.
That assessment contains an important limit: human operators are still expected to direct, check and adapt model outputs. The NCSC considers AI more likely to become part of attackers’ workflows than to conduct complete attacks autonomously. Skilled operators stand to gain the most.
The agency also expects AI-assisted vulnerability research to shorten the time defenders have to install fixes. It cautions that a model finding a weakness does not automatically mean the weakness is exploitable or presents an immediate threat.
A separate chapter, The age of autonomous attack, describes a darker 2028 scenario involving uncontrolled automated actors. The NCSC explicitly presents this as a plausible pessimistic scenario to illustrate the consequences of inaction, not a prediction. It should not be read as evidence of an existing autonomous attacker.
Reduce exposure before the workload grows
For security teams, the agency’s earlier guidance on preparing for a vulnerability patch wave, published on 1 May, supplies practical priorities: identify externally exposed systems, minimise that exposure and plan to deploy updates more frequently and at scale.
Where resources are limited, it recommends prioritising external attack surfaces before working inwards. Unsupported technology may require replacement rather than another patch. Automatic updates and secure hot patching can reduce the workload where appropriate, while safety-critical systems and operational technology require consideration of disruption and operational risk.
