NCSC: AI-powered malware is "highly likely" to hit UK critical infrastructure in a ransomware attack by 2028

The UK’s National Cyber Security Centre, part of GCHQ, published a new assessment on 3 November. Its sharpest line is about ransomware. In the assessment, the NCSC writes: “It is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.” CNI is critical national infrastructure.

What “highly likely” means here

NCSC assessments use the PHIA probability yardstick, the shared scale for UK intelligence judgements. The yardstick graphic on the report page puts “highly likely” at 80 to 90 percent and “likely” at 55 to 75 percent. So this is a probability judgement about the next two years, not a report that such an attack has happened.

The assessment’s other key judgements, in its own words:

• By 2028 it is “highly likely” that Russia, China and other nation states “will routinely use AI-cyber to achieve their geopolitical goals”.
• By 2028 it is “almost certain that many systems will remain vulnerable to attack from AI-cyber tools which identify and exploit system weaknesses”.
• By 2028 it is “likely” that attackers will use AI-cyber capability against known vulnerabilities in CNI legacy technology and against the new attack surface that AI tools inside CNI create.

The assessment is built on three scenarios: baseline, pessimistic and optimistic. It says they “are not predictions” and that “the prospect for surprise is high”. In the baseline scenario, it says an organisation’s “internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery.”

What the NCSC asks defenders to do

The news release previews a launch speech by NCSC chief executive Dr Richard Horne. He is quoted in advance as saying the coming rise in incidents is “not because AI has invented new ways to attack us” but because tolerated vulnerabilities “can now be discovered and exploited at a scale that was once unimaginable”, and that “for decades, we have collectively got away with doing tech on the cheap.”

The release lists the choices he will urge:

• Invest properly in your technology.
• Do not keep technology “unnecessarily connected to the internet”.
• Treat Cyber Essentials as “the starting point for cyber security, not the end goal”, then build resilience to match your size, complexity and risk.

It also points to funding the Chancellor announced last week, including £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre. We covered that package in the UK’s AI funding for AISI and AI-run cyber defence.

Why this matters

The NCSC’s case is that AI speeds up finding and exploiting old weaknesses, and we have already seen pieces of that: AI-found PHP flaws probed four days before the patch and ransomware affiliates running intrusions through OpenCode, according to SOCRadar. If you build or run systems that critical infrastructure depends on, the NCSC’s advice is plain: shorten your patch and test cycle and take off the internet anything that does not need to be there.