UK Cyber Agency Warns AI-Powered Ransomware Is Highly Likely to Hit Critical Infrastructure by 2028

Britain’s National Cyber Security Centre said on November 3 that ransomware using AI-powered malware was highly likely to have targeted U.K. critical national infrastructure by 2028. The assessment describes a future threat, rather than a confirmed attack.

A forecast about capability, not a confirmed breach

The NCSC is part of the UK’s GCHQ intelligence agency. Its November 3 assessment considers developments through 2028 under baseline, optimistic and pessimistic scenarios. The agency describes those scenarios as plausible futures rather than guaranteed outcomes. Its most striking judgment is that ransomware using AI-powered malware will highly likely have been used against UK critical national infrastructure within that period.

Critical infrastructure includes systems whose disruption can spread far beyond one organization. Energy networks, transport operators, health services and the suppliers behind them are connected to everyday economic activity. Even where an attack never reaches an industrial controller, unavailable administrative systems can slow deliveries, prevent payments or force a company to stop operations as a precaution.

The financial exposure is larger than an IT bill

That risk matters especially for industries with older equipment. Industrial systems are often designed to operate for decades, while ordinary corporate software is replaced much more frequently. A control network may have limited maintenance windows or depend on a vendor whose product is no longer supported. The NCSC’s warning therefore lands on a difficult management question: which modernization costs should be paid now to reduce the probability of a much larger interruption later?

The same debate has been developing across the wider AI economy. Our previous reporting on AI monitoring and security gaps examined why access controls and oversight must be built into systems rather than added only after deployment. In operational technology, that principle is particularly important because security failures can affect physical services, not just information.

What the NCSC is asking organizations to change

Richard Horne, the NCSC’s chief executive, said the era in which organizations could accept cheap technology at the expense of security had to end. The agency wants leaders to address fundamental weaknesses: unsupported systems, unnecessary internet exposure, excessive privileges and unreliable recovery plans. It argues that proven defensive practices remain valuable even as attackers adopt more capable AI tools.

These are management decisions as much as technical ones. An inventory of critical assets is essential because an organization cannot patch or isolate systems it does not know it operates. Reliable backups need to be tested against actual restoration requirements, while network segmentation can reduce the damage if one account or device is compromised. Procurement teams should also review how vendors support security updates throughout the expected life of a product.

A two-sided technological race

The UK government has announced investments in cyber resilience, including an initial national Cyber Shield, a real-time vulnerability capability and an AI cyber-security center of excellence. Those initiatives may improve coordination, but no national program can replace the day-to-day decisions made by operators responsible for individual networks.