UK Cyber Agency Warns AI-Powered Attacks Could Hit Essential Services by 2028

Britain's cyber security watchdog has warned that artificial intelligence could help criminals launch a ransomware attack against critical national infrastructure within the next two years. The National Cyber Security Centre (NCSC), part of GCHQ, published the assessment on Tuesday 3 November, calling on organisations to tackle weaknesses before attackers exploit them.

What has the NCSC actually predicted?

The agency considers it highly likely that AI-powered malware will feature in an attack on essential infrastructure by 2028. That is a risk assessment, not a claim that a specific attack has been discovered or that a future incident is inevitable. Critical infrastructure includes the systems that keep everyday life running, from energy and water services to transport and communications.

The warning is less about science-fiction-style autonomous hackers than about the speed of familiar cybercrime. AI can help hostile groups identify vulnerable systems, automate reconnaissance and make existing techniques more efficient. Security teams may have less time to spot and fix problems that have been neglected for years.

Why older technology is a concern

NCSC chief executive Richard Horne highlighted the risks created when organisations rely on outdated systems or postpone investment in security. Some vulnerabilities are already known, but patching them can be difficult where networks are complex, equipment is old or essential services cannot easily be taken offline.

The agency also points to hostile state activity. Its assessment identifies China as a particularly sophisticated and persistent cyber challenge to the UK, while noting activity linked to Russia and Iran. Those concerns sit alongside financially motivated ransomware groups, whose targets may be chosen for the disruption and pressure they can create.

What could disruption look like?

A serious incident could interrupt business operations or public services even without permanently damaging physical equipment. The knock-on effects might include delays, temporary outages and supply-chain problems. However, the NCSC has not announced an imminent nationwide shutdown, and the report should not be read as a forecast of a particular service failing.

For businesses, the practical message is to maintain supported software, manage access carefully, back up important data and rehearse how services would continue during an incident. For households, basic precautions such as installing updates and using strong, unique passwords remain worthwhile. AI also offers defenders ways to detect suspicious behaviour, provided organisations invest in using those tools effectively.

The bigger picture

Cyber resilience is increasingly a question of continuity, not simply keeping hackers out. The NCSC's latest warning asks organisations responsible for vital services to assume that attackers will become quicker and more capable. Preparing now is likely to be less costly than rebuilding after a major interruption.

Sources: NCSC, 3 November 2026, https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years ; Reuters, 3 November 2026, https://www.reuters.com/legal/government/uk-must-expect-ai-powered-attack-critical-infrastructure-within-two-years-report-2026-11-03/ . Image: Photo by panumas nikhomkhai on Pexels.