BUSINESSDevelopments · · 2 min read · Source: National Cyber Security Centre (NCSC)
NCSC: AI-powered ransomware on infrastructure expected by 2028
The UK's National Cyber Security Centre (NCSC) released its annual review on November 3, 2026. It says AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028.
Key facts
- The NCSC published its "State of the Cyber Nation" report as part of its Annual Review 2026 on November 3, 2026.
- The agency says a ransomware attack using AI-powered malware on UK critical infrastructure is highly likely by 2028.
- The government had announced £60 million for a Cyber Shield and £70 million for a vulnerability center the week before.
What the NCSC expects
The "State of the Cyber Nation" report is part of the NCSC Annual Review 2026 and covers September 2025 to August 2026. Its key assessments:
- By 2028, a ransomware attack using AI-powered malware on UK critical infrastructure is "highly likely."
- Within two years, attackers will use AI to scale up and speed up ransomware, social engineering such as phishing, and the exploitation of vulnerabilities.
- NCSC chief executive Richard Horne stresses that AI is not inventing new attacks. It lets attackers exploit long-tolerated weaknesses at unprecedented scale.
What the agency advises organizations
The recommendations are deliberately basic:
- Close the gaps left by years of underinvestment in technology and security.
- Don't connect systems to the internet unless they need to be.
- Treat the UK's Cyber Essentials baseline as a starting point, not the goal.
- Use proven standards and tools; they protect against both conventional and AI-powered attacks.
- Build in security from the start, not as an afterthought.
What the government plans
The week before, the government announced £60 million for the first phase of a national Cyber Shield and £70 million for a center to find vulnerabilities across critical infrastructure. A new AI Cyber Security Centre of Excellence run by the NCSC is also being set up in Manchester.
What this means for you
- The agency sees AI mainly as an amplifier: known weaknesses get exploited faster and at larger scale.
- The best defense is still basic hygiene: updates, few exposed entry points, security built in from the start.
- The assessment is about the UK, but attack patterns don't stop at borders.
How to use this
List which of your systems are reachable directly from the internet and where two-factor sign-in is still missing. Close whatever doesn't need to be open first.
Luigi's take
The most sober line in the report is the most important one to me: AI is not inventing new attacks, it is making old ones cheaper. That is good news, because there are known defenses against old attacks. The bad news is that the grace period for postponed updates and weak passwords is getting shorter, in small companies too.
My advice: take an hour this week and go through two questions. Which of our systems are directly exposed to the internet without needing to be? And where is two-factor sign-in still missing? It isn't an AI project, but it is exactly the kind of preparation the NCSC means.
Source
This article was researched and written with AI assistance. Responsible: Luigi Lugmayr.
