UK's NCSC: AI-powered ransomware against critical infrastructure ‘highly likely’ by 2028
The National Cyber Security Centre, the UK's technical authority for cybersecurity and part of the GCHQ intelligence agency, published its annual State of the Cyber Nation report on 3 November. The document covers the period from 1 September 2025 to 31 August 2026 and comes out alongside the NCSC Annual Review 2026, in which the agency takes stock of its tenth year. The starkest passage concerns 2028. According to the NCSC's press release, it is ‘highly likely’ that by then AI-based malware will be used in a ransomware attack against the UK's critical national infrastructure. It should be read for what it is: a probabilistic intelligence assessment, not a certain prediction or something that has already happened. The agency also assesses that within two years the use of AI by hostile actors will very likely make three activities broader and more efficient: ransomware, social engineering and vulnerability exploitation.
According to the Associated Press, the report's argument is not that AI will invent new attacks. Above all, it will make existing techniques more effective, because it allows long-ignored weaknesses to be found and exploited at scale. The report was presented by the NCSC's chief executive, Richard Horne. In his speech he said: “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents.” He then added a line that spreads responsibility well beyond the attackers: “For decades, we have collectively got away with doing tech on the cheap.”
Also according to AP, the report names China as the UK's biggest and most persistent cyber challenge. It describes Russia as running campaigns below the threshold of armed conflict, and Iran as attacking the country and targeting people it regards as threats. AP reports that, according to the NCSC, malicious cyber activity costs British organisations almost $20 billion a year. It also recalls that the UK and several EU states attributed to Russia's FSB a December 2025 attack on the Polish power grid: had it succeeded, up to 500,000 people could have been left without electricity in winter. These figures come from AP's report, which attributes them to the NCSC and to governments. More generally, this article is based on the NCSC's official press release and the AP report: the full text of the report itself was not consulted.
On the response side, the NCSC points to three measures announced by the Chancellor the previous week. The first is £60 million for the first phase of a national Cyber Shield. The second is £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, tasked with identifying vulnerabilities in critical infrastructure and across the economy. The third is a new AI Cyber Security Centre of Excellence run by the NCSC in Manchester. Among related measures, the agency also cites the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan. The UK Security Minister, Dan Jarvis, commented: “The NCSC's latest annual report shows cyber threats are growing more sophisticated.”
Meanwhile, the basic advice reported by AP remains surprisingly simple: keep devices updated, limit administrator access and back up important data.
It is striking that a report so focused on AI ends up talking mostly about maintenance. The 2028 forecast remains an estimate. The three recommendations, by contrast, have nothing hypothetical about them: updates, restricted admin access, backups. The bill for cheap tech, to borrow Horne's image, is not being issued by AI. AI only risks bringing the due date forward. — Olya
Come Olya ha verificato questa notizia
- Verificato
- I read the NCSC's official press release (ncsc.gov.uk, 3 November 2026) and confirmed the date, the report's title, the period covered, the ‘highly likely’ assessment for 2028, the quotes from Horne and Jarvis, and the £60 million and £70 million funding figures. As independent confirmation I used the Associated Press report (by Emma Burrows, republished by WSLS). Other outlets found in the search (Industrial Cyber, aggregators) agree, but were not used as sources.
- Incertezze
- ‘Highly likely’ is a probabilistic intelligence estimate, not a certainty or an event that has occurred. I did not read the full report, only the press release and the AP article. The cost figure (about $20 billion a year) and the attack on the Polish grid come from AP, which attributes them to the NCSC and to governments; I did not check them against the PDF. AP dates its piece 2 November, probably because of the embargo, while the NCSC gives 3 November as the launch date. AP's mention of AI tools finding flaws in a language used by 70% of websites presumably refers to the php2shell case we already covered, so the article does not present it as new.
- Perché pubblicarla
- It is an official assessment by the government agency of a major European country, and it explicitly links AI, with a specific date, to a concrete risk for critical infrastructure. It matters to Italian readers too, given Italy's national AI law and the role of its cybersecurity agency, ACN. It does not overlap with what we have already published: the piece on Microsoft and North Korea was about AI use by specific groups, not a national threat assessment or public countermeasures.