UK cyber security body warns AI-powered malware will target critical infrastructure by 2028

The National Cyber Security Centre (NCSC) expects AI-powered malware to be used in ransomware attacks against the UK’s critical national infrastructure by 2028. The warning, published in its annual review, covers sectors including energy, transport, health and finance. NCSC said AI will help attackers find vulnerabilities and write malicious code, increasing the risk to essential services.

NCSC’s chief executive, Richard Horne, said the technology will soon drive a sharp increase in cyber incidents, as AI exposes weaknesses in IT systems that have been “tolerated for far too long”. The review also noted that Russia and China are expected to use AI routinely in cyber-attacks, and that the UK’s military communications face daily attempts at disruption.

AI is expected to make ransomware attacks more effective by automating the scouting of targets and the exploitation of flaws. Recent incidents, such as hackers raising supermarket fridge temperatures, show the real-world impact of cyber threats on business operations. NCSC and experts warn that companies must invest more in cyber resilience to keep pace with the evolving threat.

Regulated firms should assess their exposure, update incident response plans and consider advanced AI tools for defence, as attackers and defenders race to exploit the same technologies.