NCSC warns AI malware could target UK infrastructure within two years

The NCSC’s assessment is that it is highly likely AI-powered malware will be used in a ransomware attack on the UK by 2028.[1] The warning also describes cyberattacks involving AI-powered malware on key infrastructure, including airports, hospitals and power stations, within two years.[1] The NCSC frames its assessment as an examination of current AI-enabled threat trends and projections through 2028.[3] The NCSC describes the assessment as examining current AI-enabled threat trends and projections through 2028.[3]

The NCSC warns that AI could uncover and exploit longstanding cybersecurity weaknesses that have left UK organisations exposed.[2] It says hostile actors are highly likely to use AI to increase the scale and efficiency of cyberattack operations.[1] The report also warns that vulnerabilities tolerated for too long could now be discovered and exploited at a previously unimaginable scale.[1] The NCSC says organisations unable to defend against AI-enabled threats face greater cyber risk.[4] Together, those points make the state of existing defences central to the warning.[2][4]

Richard Horne made his remarks in a speech ahead of the launch of the NCSC’s *State of the Cyber Nation* report.[1] He urged organisations across the UK to take responsibility and make different choices, with the remarks referring to failures to invest adequately in technology.[1] The NCSC calls for urgent investment in cyber resilience.[2] Horne also said there was a real prospect of an unprecedented rise in cyber incidents in the coming months.[1] His warning connects the threat assessment to the need for organisations to address their resilience.[1][2]

The report warns that Russia and China will begin using AI more routinely in cyberattacks.[1] It describes Chinese cyber activity as the most sophisticated and sustained cyber challenge facing the UK.[1] The NCSC’s concern is not limited to the prospect of ransomware: its assessment also describes AI as a way for hostile actors to scale and improve cyberattack operations.[1] Horne referred to food not being on shelves, lights not being on, and businesses having gone under.[1]