Britain’s cyber defense agency has put a deadline on a threat it says is no longer hypothetical: within two years, artificial intelligence is “highly likely” to be used in ransomware attacks against the country’s critical national infrastructure, including power grids, water systems, dams and manufacturing plants.
The National Cyber Security Centre, part of the signals intelligence service GCHQ, issued the assessment in its annual State of the Cyber Nation report published Tuesday. The warning covers the period through 2028 and frames AI less as a novel weapon than as an accelerant applied to weaknesses that have gone unfixed for years.
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” NCSC chief executive Richard Horne said in prepared remarks for a speech launching the report. “But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
Horne added that “for decades, we have collectively got away with doing tech on the cheap.” The agency describes AI as a force multiplier that lets attackers identify targets, draft convincing phishing messages, uncover software flaws and build exploits faster, while humans still direct the operations.
A threat measured in speed
The report identifies industrial control systems as the most exposed targets: the networks governing electricity supply, water treatment, dams, factories and heating, ventilation and refrigeration equipment. Horne cited a recent incident in which refrigeration systems at a French supermarket chain were hit by a cyberattack, pointing to how digital intrusions can spill over into physical operations and disrupt daily life and commerce.
The NCSC also flagged state actors as a growing part of the problem. It rated Chinese cyber activity as a leading threat to the UK, said Russia continues to mount operations below the threshold of armed conflict, and described Iran as carrying out attacks aimed at British targets. The agency warned that China, Russia and other nations are expected to fold “AI cyber” into their geopolitical strategies, with the speed at which they adopt new tools increasingly determining their effectiveness.
“Technology has always influenced cyber security. What is different today is the pace,” the report said.
State-backed espionage remains a persistent concern as well. The NCSC reported sustained spear-phishing against politicians, government officials and other high-risk individuals, along with an increase in attempts to compromise messaging applications. The agency referenced warnings from Dutch intelligence services that Russian hackers had impersonated support staff at the encrypted messaging app Signal in efforts to hijack accounts.
The bill for neglected systems
The financial toll is already substantial. According to the NCSC, malicious cyber activity costs British businesses and institutions roughly $20 billion a year. Jaguar Land Rover, the British automaker, absorbed more than $260 million in direct losses from a cyberattack last year, with damage spreading to suppliers and the wider supply chain.
Horne warned that leaders who postpone upgrades or defer security spending could eventually have to explain to investors, employees and customers why “food isn’t on shelves, lights aren’t on, businesses have gone under.”
The government has moved to fund defenses. Last week it announced £60 million (about $80.5 million) for the first phase of a national Cyber Shield, £70 million (about $93.9 million) for a new National Exposure and Real-Time Vulnerability Centre tasked with finding weaknesses across critical infrastructure, and a new AI Cyber Security Centre of Excellence in Manchester to be run by the NCSC.
The agency advised organizations to apply system updates promptly, restrict administrator access and back up critical data regularly, and said its Cyber Essentials certification should be treated as a baseline rather than a finish line.
Spending versus patching
The warning lands as corporate budgets for AI-driven security are climbing. Gartner forecasts global spending on AI cybersecurity of $51.3 billion in 2026, rising to $86 billion in 2027. A World Economic Forum survey found 87% of respondents viewed AI-related vulnerabilities as the fastest-growing cyber risk in 2025, and 94% expected AI to have the greatest impact on cybersecurity in the year ahead.
ItemFigureAnnual cost of malicious cyber activity to UK firms and institutionsAbout $20 billionJaguar Land Rover direct losses from 2025 attackMore than $260 millionCyber Shield, first phase£60 million (about $80.5 million)National Exposure and Real-Time Vulnerability Centre£70 million (about $93.9 million)Forecast global AI cybersecurity spending, 2026$51.3 billionForecast global AI cybersecurity spending, 2027$86 billion
Note: Spending forecasts from Gartner were published before the NCSC’s warning.
Evidence that attackers are already leaning on AI has been accumulating. In May, Google’s Threat Intelligence Group said criminals had used an AI model to find and weaponize a previously unknown flaw that bypassed two-factor authentication in a widely used open-source administration tool, the first confirmed case of AI-assisted zero-day development in the wild. A Cambridge University study of more than 90,000 cybercrime forum threads published the same month found most criminals were still using AI for spam and phishing rather than sophisticated intrusion.
Security vendors have documented similar patterns. Sophos found that operators of the Aur0ra ransomware strain used AI models including Cursor to move deeper into compromised networks, feeding in stolen credentials and letting the tools map systems and obtain administrator privileges with limited human oversight. CrowdStrike’s 2026 threat report counted an 89% increase in AI-enabled attacks in 2025.
What it means for markets
For investors, the assessment sharpens a divide between companies that can afford to modernize and the operators of aging infrastructure that cannot. Utilities, water authorities and manufacturers face pressure to raise security budgets at a time when many are already stretched, and insurers are likely to scrutinize control-system exposure more closely. Cybersecurity vendors stand to benefit from the spending shift, though the report makes clear that buying tools is not the same as closing gaps.
The practical question the agency poses is whether defenders can patch faster than attackers can exploit. Britain’s new vulnerability-scanning center may shorten the time it takes to find flaws, but fixing them still requires money, skilled staff and time, resources that parts of the critical infrastructure base have long gone without. Horne’s warning that the coming months could bring an unprecedented volume of incidents suggests the NCSC sees the gap between discovery and repair as the central risk of the next two years.
Click Here For The Original Source.
——————————————————–
