UK cyber agency says AI-powered ransomware is highly likely to hit critical infrastructure by 2028

The NCSC's annual review pairs a stark AI threat forecast with fresh government funding for national cyber defenses Britain’s top cyber defense agency has put a date on a scenario security teams have been dreading. The National Cyber Security Centre (NCSC) says it is “highly likely” that AI-powered malware will feature in a ransomware attack on the UK’s critical national infrastructure between now and 2028. The forecast arrived on November 3, 2026, alongside the NCSC’s annual review, titled “State of the Cyber Nation.” The agency also released a separate assessment examining how AI could reshape the cyber threat landscape over the next two years. What the NCSC actually said Dr. Richard Horne, CEO of the NCSC, indicated that AI is not producing entirely new methods of attack. Instead, it is amplifying familiar weaknesses, with social engineering and ransomware at the top of the list. The assessment connects this shift to decades of underinvestment in cybersecurity technology. In other words, AI is exploiting gaps that were already there, not carving out fresh ones. The NCSC did not spell out what form the AI-driven malware might take. It did, however, flag a potential increase in bo...