NCSC warns Britain has just two years to prepare for ransomware attack on critical infrastructure

The UK faces a highly likely threat of an AI-powered ransomware attack against its critical national infrastructure by 2028, the National Cyber Security Centre (NCSC) has warned, as hostile actors increasingly exploit artificial intelligence to accelerate cyber attacks.

In its latest State of the Cyber Nation report, published on Tuesday, the government’s cyber security agency said AI would allow attackers to identify and exploit longstanding weaknesses in digital systems at unprecedented speed and scale.

The technology is expected to intensify threats including ransomware, social engineering and the exploitation of software vulnerabilities, potentially putting essential services, businesses and the wider economy at risk.

Dr Richard Horne, chief executive of the NCSC, warned that the coming months could bring an unprecedented rise in cyber incidents.

“But we must be clear that is not because AI has invented new ways to attack us,” he said. “But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

“For decades, we have collectively got away with doing tech on the cheap,” Horne added.

He urged organisations to treat security and resilience as fundamental requirements rather than secondary considerations, arguing that greater investment was needed to protect the country.

Simon Edwards, chief executive of cyber security testing company SE Labs, said the warning reflected an increasingly hostile threat environment.

“These warnings come as little surprise given the current state of the cyber threat landscape and the constant wave of attacks targeting organisations,” he said. “Cyber criminals are increasingly exploiting AI and cause significant disruption at unprecedented speed and scale.”

Edwards cautioned, however, that businesses should not overlook conventional cyber threats or the financial constraints facing smaller companies.

“SMEs often lack the financial resources to build strong cyber security capabilities, despite being the backbone of larger organisations’ supply chains,” he said.

He called for rigorous, independent testing against real-world attacks to identify weaknesses before criminals could exploit them, warning that traditional security approaches were no longer sufficient.

The Government has announced additional funding to strengthen the UK’s defences, including £60mn for a national Cyber Shield and £70mn for a National Exposure and Real-Time Vulnerability (NERV) Centre.

It will also establish a new AI Cyber Security Centre of Excellence in Manchester.

The measures are intended to improve the country’s ability to detect vulnerabilities and respond to emerging threats as artificial intelligence changes the scale and speed of cyber attacks.