UK Cyber Chief Warns Critical Infrastructure to Brace for AI-Powered Ransomware by 2028

The UK's National Cyber Security Centre (NCSC), part of GCHQ, warns that the country's critical infrastructure should prepare for a ransomware attack involving AI-powered malware. According to the State of the Cyber Nation report, published on 3 November 2026, this scenario is "highly likely" by 2028.

What the report says

According to the NCSC, over the next two years hostile actors adopting AI are "highly likely" to increase the scale and efficiency of their operations. The agency names ransomware, social engineering and vulnerability exploitation. Alongside the report, the NCSC also published its annual review for 2026.

The centre stresses that the UK is at a point of "enormous consequence" for cyber security. The NCSC also sees AI as an opportunity to improve collective resilience, but says organisations must urgently address foundational investments and weaknesses, or adversaries will exploit them instead.

Richard Horne's speech

NCSC chief Dr Richard Horne warns of a real prospect of an "unprecedented rise in the number of cyber incidents". He says the cause is not that AI has invented new ways to attack, but that vulnerabilities tolerated for far too long can now be discovered and exploited at enormous scale.

For decades, we have collectively got away with doing tech on the cheap. - Richard Horne, CEO of the NCSC

Horne urged leaders to "take the responsibility now" and make different choices. His specific requests included adequate investment in technology, avoiding unnecessary connection of systems to the internet, and treating Cyber Essentials certification as a starting point rather than an end goal. He also warned that leaders who fail to act will have to explain to investors, employees and customers "when food isn't on shelves, lights aren't on, businesses have gone under".

Government response

The government points to the Cyber Security and Resilience Bill and the forthcoming National Cyber Action Plan. The Chancellor announced £60 million a week earlier for the first phase of a national Cyber Shield, and £70 million for the NERV Centre (National Exposure and Real-Time Vulnerability Centre), which is meant to identify vulnerabilities across critical infrastructure and the whole economy.

Security Minister Dan Jarvis argues that threats are growing more sophisticated and that the government is itself using AI to stay ahead of attackers. He pointed to the Cyber Shield and the new centre in Manchester as examples.

What it means for Polish firms

The warning concerns the UK, but the mechanism the NCSC describes is not specifically British: older, poorly secured systems are expected to become easier to find and exploit with the help of AI. The agency's recommendations are ordinary and technical: use tools, standards and frameworks known to work, and limit unnecessary connectivity of systems to the internet.

One caveat: this is a probability assessment prepared by the agency, not a description of an event that has already happened. The report does not claim that such an attack has taken place.