UK critical national infrastructure could face AI-powered ransomware attacks by 2028, the National Cyber Security Centre (NCSC) has warned, as advances in artificial intelligence threaten to expose longstanding cybersecurity weaknesses at an unprecedented speed and scale.The warning comes in the NCSC’s State of the Cyber Nation report, which assesses that hostile actors are highly likely to use AI to make cyber operations more efficient. Ransomware, social engineering, and vulnerability exploitation are among the activities expected to become more effective as the technology develops.For NCSC CEO Dr Richard Horne, the concern lies not only in what attackers might be capable of in two years’ time, but also in the condition of the systems they will be targeting.“For decades, we have collectively got away with doing tech on the cheap,” Horne said in remarks prepared to accompany the report.AI Threatens to Expose Cybersecurity WeaknessesThe NCSC’s assessment challenges the assumption that AI-powered cyberattacks will necessarily involve entirely new techniques. Instead, the technology could allow attackers to identify and exploit familiar vulnerabilities far more efficiently, compressing the time organisations have to respond.That could have significant consequences for critical infrastructure operators, where a successful attack may interrupt services relied upon by businesses and the public.Horne warned that the UK faced the prospect of an unprecedented increase in cyber incidents in the coming months, driven by weaknesses that had been tolerated for too long.The report also identified a potential divide between organisations able to use AI to strengthen their defences and those whose cybersecurity capabilities struggle to keep pace. As the technology becomes more accessible to hostile actors, existing differences in security maturity could become more consequential.The 2028 timeframe reflects the NCSC’s assessment of how the threat could develop. It does not mean that a specific attack is expected to occur in that year.Cybersecurity Underinvestment Comes Under ScrutinyHorne’s criticism of underinvestment places responsibility on organisational leaders, particularly those who have allowed ageing technology or inadequate security controls to remain in place.He urged businesses to reconsider whether systems need to be connected to the internet at all, while warning against treating basic cybersecurity certification as evidence that every relevant risk has been addressed.Cyber Essentials, he argued, should be the starting point.Beyond that foundation, organisations need protections appropriate to their size, complexity, and exposure. For those operating essential services, the consequences of failing to make those investments can extend well beyond the organisation itself.Horne warned that leaders could find themselves explaining the consequences to employees, customers and suppliers when disruption affects the services people depend on.His remarks reflect a wider challenge for enterprise cybersecurity. Security weaknesses that have been manageable under existing conditions may become harder to contain if attackers can discover and exploit them more quickly.Investment decisions made today will therefore influence how organisations withstand threats that are still developing.Cyber Resilience Requires More Than PreventionThe NCSC’s warning has also prompted calls for organisations to examine whether their recovery arrangements can withstand increasingly sophisticated attacks.Cynthia Overby, Director of Strategic Security Solutions, ZCOE, at Rocket Software, said the growing dependence on digital services means cybersecurity can no longer be separated from wider business risk.“Organisations must shift from asking ‘Are we protected?’ to ‘Can we prove that we understand our risk, that controls are working, and that operations can remain resilient when something goes wrong?’”For Overby, that requires a change in how organisations prepare for incidents. Rather than assuming prevention will always succeed, businesses should regularly test their response procedures and recovery capabilities. This includes the decisions and communications required when critical systems become unavailable.The concern is particularly relevant to essential services, where restoring operations can be as important as containing the initial compromise.AI may give attackers greater speed, but it also presents opportunities for defenders to improve vulnerability detection and response. The challenge is ensuring those capabilities are supported by sound security foundations rather than introduced as substitutes for them.Government Investment Targets National Cyber DefencesThe warning comes against a backdrop of further Government investment in cybersecurity capabilities.The Chancellor announced £60 million ($80.7 million) for the first phase of a national Cyber Shield, intended to strengthen the UK’s ability to defend against cyber threats, alongside £70 million ($94.1 million) for a National Exposure and Real-Time Vulnerability (NERV) Centre.The latter is intended to improve the identification of vulnerabilities across critical infrastructure and the wider economy. A new AI Cyber Security Centre of Excellence, operated by the NCSC, will also be established in Manchester to develop specialist AI security expertise within government.These commitments sit alongside the Cyber Security and Resilience Bill and the Government Cyber Action Plan, forming part of the Government’s broader response to evolving cyber risks.The announcements follow the UK Budget 2026, which placed AI infrastructure within the Government’s economic growth ambitions.Yet the NCSC’s warning makes clear that national investment cannot compensate for unresolved weaknesses within individual organisations. As AI changes the pace of cyber threats, the ability to maintain essential services will depend on whether businesses have addressed those vulnerabilities and tested their capacity to recover when attacks succeed. Prove control. Strengthen resilience. Govern cyber risk.Join CISOs, risk leaders and IT decision-makers exploring identity security, threat detection, incident response, and compliance across cloud, hybrid and distributed environments. !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
n.push=n;n.loaded=!0;n.version=’2.0′;n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,
document,’script’,’https://connect.facebook.net/en_US/fbevents.js’);
Click Here For The Original Source.
——————————————————–
