- AI-powered malware is considered highly likely to feature in a ransomware attack against UK critical national infrastructure by 2028.
- Hospitals, airports, power stations and essential services face growing exposure as AI helps attackers identify vulnerabilities and develop malicious software faster.
- The NCSC has warned that Russia and China are likely to use AI more routinely in cyber operations.
Britain could face a new generation of cyberattacks capable of disrupting hospitals, airports and power stations as artificial intelligence makes it easier for hackers to identify weaknesses and develop malicious software.
The National Cyber Security Centre (NCSC) has warned that it is highly likely AI-powered malware will be used in a ransomware attack against the UK's critical national infrastructure (CNI) between now and 2028.
The assessment, published in the agency's annual State of the Cyber Nation report, raises concerns about the country's readiness to defend essential services against increasingly sophisticated digital threats.
The warning covers infrastructure across sectors including energy, transport, defence, food, healthcare and finance.
Richard Horne, chief executive of the NCSC, said organisations could no longer afford to neglect investment in technology and cybersecurity.
“For decades, we have collectively got away with doing tech on the cheap,” he said.
He warned that the country faced the prospect of an unprecedented increase in cyber incidents in the coming months, as AI makes it possible to discover and exploit weaknesses that organisations have left unresolved for years.
Horne said businesses and public institutions needed to make different investment choices, warning that failure to act could leave leaders explaining to customers and employees why essential services had been disrupted, food was unavailable and businesses had collapsed.
How could AI-powered malware disrupt Britain's essential services?
Ransomware is a form of cybercrime in which attackers gain access to an organisation's systems, encrypt files or lock users out of their networks and demand payment to restore access. Criminal groups may also threaten to publish stolen information if their demands are not met.
Artificial intelligence could make these attacks more effective by helping hackers automate several stages of an intrusion.
According to the NCSC, AI can help attackers identify potential targets, locate weaknesses in computer networks and write malicious code. This could allow them to operate more quickly and target a greater number of organisations.
The concern extends beyond conventional IT systems. Modern infrastructure increasingly relies on connected technology to control physical processes, including electricity generation, manufacturing operations, heating and refrigeration.
A successful attack could therefore disrupt services that people depend on in their everyday lives.
Recent cyberattacks on supermarket refrigeration systems across Europe illustrate the potential consequences. In October, hackers manipulated refrigeration controls at French supermarkets, causing temperatures in some units to rise above 50°C and forcing retailers to discard food stocks. A second wave of suspected attacks was reported across several European countries in November.
The NCSC has cited such incidents as a warning that organisations must take the security of connected equipment more seriously.
The agency also highlighted the growing threat from state-backed actors. It warned that Russia and China are highly likely to use AI more routinely in cyber operations by 2028.
Horne described Chinese cyber activity as the most sophisticated and sustained cyber challenge facing the UK. He also warned that Russian operations against British interests were part of wider efforts to increase pressure through activity below the threshold of armed conflict.
What is Britain doing to strengthen its cyber defences?
The warning comes as the government increases investment in cybersecurity and national resilience.
Recent funding announcements include £60m for the first phase of a national Cyber Shield initiative to strengthen the UK's ability to use AI in cyber defence. A further £70m has been allocated to a National Exposure and Real-Time Vulnerability Centre, intended to identify weaknesses across critical infrastructure and the wider economy.
The government has also announced plans for an AI Cyber Security Centre of Excellence.
Anne Keast-Butler, director of GCHQ, said cybersecurity had become part of the country's national defence and called on organisations to protect their customers, services and livelihoods.
The challenge is not simply to develop stronger security tools, but to ensure that organisations actually use them to identify and fix weaknesses before attackers do.
Last month, AI-assisted research helped uncover a serious vulnerability in PHP, a programming language used by a large proportion of the world's websites. The discovery highlighted how quickly AI could identify previously overlooked security flaws, creating opportunities for both attackers and defenders.
Cybersecurity experts have warned that organisations need access to equally capable technology to identify vulnerabilities and strengthen their systems before malicious actors exploit them.
For Britain, the NCSC's warning presents a race against time. AI could give attackers the ability to move faster, but the country's critical infrastructure operators still have an opportunity to close longstanding security gaps.
Whether that happens before 2028 could determine how exposed essential services are to the next major wave of cybercrime.
