NCSC says AI-powered ransomware on UK infrastructure is 'highly likely' by 2028

The UK’s National Cyber Security Centre (NCSC) published its Annual Review 2026, covering 1 September 2025 to 31 August 2026, together with a separate assessment, Artificial intelligence and cyber intrusion. Both appeared on 3 November. The assessment states: “It is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI”, meaning critical national infrastructure.

The assessment uses the PHIA probability yardstick and sets out three scenarios, which it says “are not predictions” but “plausible possibilities in the medium-term”. In the baseline, the global threat from AI-enabled cyber capability keeps rising, and by 2028 it is highly likely that Russia, China and other nation states will routinely use it. It also says it is almost certain that many systems will remain vulnerable to AI-driven attack tools, and likely that attackers will apply them to known vulnerabilities in infrastructure. In the pessimistic scenario, capability spreads faster than UK defences can respond, reaching non-state and inexperienced actors, and attribution becomes harder; the document says China “has likely played a role in disseminating advanced capability to other actors”. Russian actors, it says, have adapted and retrained open-source AI models for intelligence work. In the optimistic scenario, development slows and the UK builds countermeasures.

The assessment’s most speculative claim sits in the pessimistic case, where it describes an autonomous AI attacker: “It is a realistic possibility that such an entity could self-replicate and conduct cyber attacks at will, with no apparent motivation or restraint.” It adds that “the prospect for surprise is high” and that the situation “is likely to be worse than is currently known”. The NCSC did not publish incident-level evidence for that scenario in the pages read here.

In an NCSC statement, chief executive Dr Richard Horne said the UK faces “a real prospect of an unprecedented rise in the number of cyber incidents”, and urged organisations to fix foundational weaknesses first. The same release set out £60 million for the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability Centre, and an AI Cyber Security Centre of Excellence in Manchester. Security minister Dan Jarvis said the annual report shows threats “growing more sophisticated”.

The warning followed a run of vendor reports of attackers already using agent tools such as ARTEX. The NCSC had issued a joint warning with its Five Eyes partners in June.