Britain’s National Cyber Security Centre (NCSC) judged Tuesday that AI-powered malware is highly likely to be used in a ransomware attack on the country’s critical national infrastructure by 2028. Ransomware is malicious software that locks or steals an organization’s data until a payment is made. The agency’s chief executive told leaders the root cause is not new AI tricks but years of underinvestment in technology.
What Happened
The NCSC, part of the signals-intelligence agency GCHQ, launched its annual review, “The State of the Cyber Nation,” in London. It covers Sept. 1, 2025, to Aug. 31, 2026, the agency’s tenth year. In its announcement, the NCSC also judged that over the next two years hostile actors’ use of AI will highly likely increase the scale and efficiency of ransomware, social engineering and the exploitation of software flaws.
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” Chief Executive Richard Horne said in his launch speech. He tied that to “vulnerabilities that have been tolerated for far too long,” which AI lets attackers find and exploit at a pace he called once unimaginable. The review’s foreword puts it plainly: AI did not create these weaknesses; it revealed them.
Horne said China “highly likely has the intent and is best positioned to use AI” against strategic targets, describing it as the most sophisticated and sustained cyber challenge the U.K. faces. In a pessimistic scenario for 2028, the review says China “has likely played a role” in supplying AI tools that help attackers hide their activity, The Register reported.
The announcement points to measures in the previous week’s Budget: £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre to find weaknesses across critical infrastructure and the wider economy, and an NCSC-run AI Cyber Security Centre of Excellence in Manchester. The Primary Wire reported on that package last week.
Why It Matters
“For decades, we have collectively got away with doing tech on the cheap,” Horne said, according to the NCSC. He urged leaders to “invest with urgency,” replace end-of-life systems, avoid connecting technology to the internet unnecessarily and treat Cyber Essentials, the government-backed baseline certification, as a starting point.
The warning is about exposure most organizations already carry. Horne cited the NCSC’s response to the recent PHP flaw, which The Primary Wire reported in October: more than 110,000 proactive notifications and Early Warning alerts to U.K. organizations. U.S. operators run many of the same vendor products, so faster AI-assisted exploitation of known flaws reaches them too. The NCSC puts the yearly cost of malicious cyber activity to U.K. organizations at almost $20 billion, AP reported.
What to Watch
Horne pointed to a forthcoming National Cyber Action Plan and the Cyber Security and Resilience Bill, which would raise requirements for critical infrastructure operators. The Register reported that Cyber Shield will be delivered in stages over five years and that a government pilot called Project DROMOS, which used AI to scan government code, found hundreds of potential security issues, including critical ones. Next is whether Cyber Shield and the NERV Centre become working services.
