What NCSC says
The National Cyber Security Centre, part of GCHQ, published a report on Tuesday 3 November warning that it is highly likely an AI-powered ransomware attack will hit the UK’s critical national infrastructure by 2028. The report, titled State of the Cyber Nation, says artificial intelligence is making it easier for attackers to find and exploit security weaknesses that organisations have let build up over years.
The NCSC’s head is set to warn that the era of “tech on the cheap”, where security has been treated as an afterthought to cost-cutting, is over. The report calls on organisations to make “significant changes” now to avoid a future in which AI tools are turned against the UK economy and society at scale.
Who is affected
The warning is aimed squarely at operators of UK critical national infrastructure: the energy, water, transport, telecoms, finance and health sectors that keep the country running. These are the organisations the NCSC says are most exposed because of long-standing underinvestment in cyber resilience, and the ones it says AI could help attackers probe faster and more cheaply than ever before.
The report does not name specific companies or confirm any current attack. The 2028 timeframe is presented as a forecast of what is likely to happen if organisations do not act, not a prediction of an attack already under way.
Why it matters for UK organisations
The core message is that AI changes the economics of attacking infrastructure. Weaknesses that might previously have taken skilled human attackers weeks to find and exploit can, according to the NCSC, be uncovered and weaponised far more quickly with AI-powered tools. That shortens the window organisations have to patch systems and raises the stakes for any operator still running on legacy technology or deferred security upgrades.
For boards and IT leaders at infrastructure operators, the report is effectively a call to bring forward resilience investment that might otherwise have been pushed back. The NCSC frames this as a societal and economic issue, not just a technical one, with the risk extending beyond individual companies to the services the public depends on.
What to watch next
The NCSC’s State of the Cyber Nation report is due to be published in full on 3 November, alongside remarks from the agency’s head setting out the case for urgent investment. UK organisations running critical infrastructure, and their regulators, will be watching for any follow-up guidance from the NCSC on specific steps to take, as well as whether government departments respond with new funding or mandates for cyber resilience ahead of the 2028 timeframe the agency has flagged.