IN Brief:
- The NCSC's 3 November State of the Cyber Nation assessment finds AI-powered malware in ransomware attacks against UK critical national infrastructure as highly likely by 2028.
- Automated vulnerability discovery and exploitation could intensify pressure on ageing IT and operational technology where exposed systems and weak maintenance create avoidable entry points.
- The agency advocates stronger cyber fundamentals and national detection capabilities, including the proposed Cyber Shield and vulnerability exposure centre.
The National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack against Britain’s critical national infrastructure by 2028. Its State of the Cyber Nation assessment, published on 3 November 2026, anticipates a faster and larger volume of hostile cyber activity as attackers adopt automated tools for discovering vulnerabilities, conducting social engineering, and exploiting access to vulnerable systems.
The forecast concerns faster exploitation of weaknesses that already expose networks and software. Artificial intelligence can reduce the time required to search for vulnerable products, correlate information about exposed equipment, and adapt hostile activity to different targets. Infrastructure operators face particular difficulty where asset inventories are incomplete, internet-facing services are unnecessarily accessible, or unsupported systems cannot be upgraded within operating constraints.
The NCSC, part of GCHQ, published the assessment alongside its annual review of the period from September 2025 to August 2026. Its chief executive, Dr Richard Horne, argued that established weaknesses in technology and operational practice are becoming easier to exploit at scale. The warning extends beyond conventional office networks to operational technology responsible for physical processes, where equipment may remain in use for long periods and upgrading a controller or communications system can require extensive operational planning.
Critical national infrastructure includes electricity networks, water services, transport, telecommunications, and other systems whose disruption can affect essential functions. Within those environments, remotely accessible engineering workstations, management interfaces, industrial gateways, and third-party maintenance connections may bridge otherwise separate administrative and operational systems. The exact exposure differs between facilities, but a compromised account or unpatched connection can provide an attacker with a route to systems whose interruption has consequences beyond the loss of business data.
AI-assisted reconnaissance could accelerate the exploitation of those exposed connections. Attackers already scan internet-facing services and compare product versions with public vulnerability records; automated collection and prioritisation could make the process cheaper and more repeatable across many organisations. The NCSC’s assessment identifies greater scale and efficiency in established intrusion methods, with the potential for more frequent attacks on organisations whose underlying weaknesses remain untreated.
Ransomware campaigns also depend on decisions made after access is obtained. Hostile operators may search for high-value systems, move between accounts, copy information, and attempt to interfere with recovery capability before disrupting operations. Automation can support parts of that process, although a particular actor’s degree of autonomous control and the reliability of AI-generated actions will vary. Claims that all future ransomware activity will be fully autonomous would therefore go beyond the NCSC’s published warning.
Restoring a compromised server is only one part of recovering industrial control operations. Operators may also need to maintain safe plant conditions, verify sensor and command data, and coordinate the restart of equipment that cannot be taken offline without an approved maintenance window. Effective contingency plans identify which connections can be isolated safely, who controls privileged engineering access, and whether offline configurations and recovery procedures can restore the plant to an accepted state.
Mixed-generation control equipment complicates that recovery and the work of closing vulnerabilities before an incident. Controllers, communications protocols, firmware and vendor support arrangements may all differ across one site. An update suitable for an office system can require testing against connected machinery, control logic and safety functions before deployment; accurate asset inventories, supplier coordination and interim access controls therefore become important where patches cannot immediately be applied.
Horne’s 3 November speech also highlighted the exposure created by networked physical systems, identifying electricity switching, water infrastructure, manufacturing lines, and refrigeration controls as areas requiring stronger technology foundations. He linked cyber resilience to routine decisions about investment, equipment life, and unnecessary connectivity, rather than treating an advanced security product as a substitute for managing known weaknesses. The NCSC continues to present Cyber Essentials as a starting point for security practice, not a sufficient end state for complex infrastructure.
The government’s proposed response includes the first phase of a national Cyber Shield, for which £60 million of investment was announced, and a £70 million National Exposure and Real-Time Vulnerability Centre intended to improve visibility of exploitable weaknesses across infrastructure and the wider economy. A new AI Cyber Security Centre of Excellence in Manchester is also planned. These are government commitments and developing capabilities; the announcement does not establish that they are fully deployed or that a particular reduction in incidents has already been achieved.
The Cyber Security and Resilience Bill would strengthen requirements affecting essential services and relevant suppliers, while the National Cyber Action Plan was still forthcoming at the time of the assessment. Those measures will intersect with procurement and maintenance contracts that determine how rapidly vulnerable equipment can be upgraded. Operators still need tested local recovery arrangements and appropriately controlled connections between administrative and operational networks, irrespective of the progress of national programmes.
Defence and national-security organisations face related challenges in their wider industrial base. Contractors and specialist equipment providers may hold technical information, operate production equipment, or support systems that connect to government customers. A cyber incident in a relatively small supplier can disrupt production or maintenance even when the customer’s principal network is unaffected. Supply-chain assurance consequently depends on the security of the organisations delivering components and services, as well as the systems installed within military facilities.
By 2028, the NCSC assesses AI-powered malware as highly likely to feature in a ransomware attack affecting UK critical national infrastructure. That projection gives infrastructure operators a defined planning horizon for identifying exposed assets, securing remote access, testing recovery procedures and agreeing support arrangements with suppliers. The agency has not identified a predetermined victim or attack date; the immediate work concerns existing weaknesses that attackers may soon be able to exploit more cheaply and at greater scale.
