The UK’s National Cyber Security Centre (NCSC), part of the signals intelligence agency GCHQ, has warned that the country must be prepared for cyberattacks using artificial intelligence against its critical national infrastructure (CNI) within the next two years.
In its annual State of the Cyber Nation report and a separate assessment titled “Artificial Intelligence and Cyber Intrusion”, the NCSC stated that it is highly likely that AI-powered malware will be used in a ransomware attack against Britain’s critical infrastructure — including power stations, airports, hospitals and other key facilities — by the end of 2028.
The centre notes that over the next two years hostile actors are “highly likely” to expand the scale and efficiency of their operations with the help of AI. This applies to ransomware, social engineering and vulnerability discovery. China is identified as the best-positioned actor with the intent to use AI against UK CNI, with its activity described as “the most sophisticated and sustained cyber challenge” facing the country. Russia is also listed among the key threats.
NCSC Chief Executive Richard Horne, speaking at the report’s launch, stressed:
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that this is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
Horne also said that for decades British organisations had “got away with doing tech on the cheap” at the expense of security. That era, he said, is over. The report calls on organisations to make “significant changes” and invest in resilience, otherwise AI will be used against the UK’s economy and society.
Against the backdrop of the warning, the government has announced additional investment in cyber defence: £60 million for the first phase of a national Cyber Shield (using agentic AI for defence), £70 million to establish the National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities, and a new AI Cyber Security Centre of Excellence in Manchester under the NCSC.
According to the NCSC, during the reporting period (to August 2026) it received around 1,831 reports of cyberattacks, 80 of which were classified as nationally significant. The annual cost of malicious cyber activity is estimated at approximately £14.7 billion.
The NCSC emphasises that AI does not create fundamentally new attack methods, but it dramatically accelerates and scales the exploitation of long-standing weaknesses in outdated systems and supply chains. The centre is urging organisations to use existing cybersecurity standards and frameworks and to treat resilience as a basic requirement rather than an optional extra.
