1. Home
2. News
3. AI policy

UK cyber agency says AI-powered ransomware on British infrastructure is highly likely by 2028

GCHQ's cyber chief says AI is making long-tolerated weaknesses cheap to exploit, and he names China as best placed to do it.

By Think Facility · November 4, 2026 · UK Cybersecurity Save

On November 3, 2026, Britain's National Cyber Security Centre, a part of the signals intelligence agency GCHQ, published its State of the Cyber Nation report. Its main warning is that AI-powered malware is highly likely to be used in a ransomware attack on Britain's critical national infrastructure by 2028.

The NCSC's chief executive, Richard Horne, launched the report the same day in a speech at Nova South in London. He put the danger in old weaknesses, which AI now makes cheap to find and exploit at scale.

Who

the National Cyber Security Centre, a part of GCHQ

Published

3 November 2026

Main warning

AI-powered malware in a ransomware attack on critical national infrastructure by 2028

Next two years

AI adoption by hostile actors highly likely to increase the scale and efficiency of their operations

New money

£60 million for a Cyber Shield, £70 million for the NERV Centre

What the NCSC is warning about

Within the next two years, the report says, AI adoption by hostile actors is highly likely to increase the scale and efficiency of their operations, ransomware and social engineering among them. Horne was clear about where the new risk comes from.

He blamed what he called "tech on the cheap". End-of-life systems kept running for one more year, upgrades pushed back, access granted where it was convenient, services bought on price alone. And it isn't only office IT. Horne pointed to the machines that run physical processes, from electricity switching to sluice gates in water facilities and refrigeration controls, and said they're even more overlooked in investment decisions.

On who would do the attacking, he named China first. He said China highly likely has the intent and is best positioned to use AI against Britain's critical national infrastructure, and called its activity the most sophisticated and sustained cyber challenge the UK faces. He also cited Russian campaigns that stay below the threshold of armed conflict, and Iranian operations against the UK.

What AI does for the defenders

Horne also called AI potentially one of the greatest opportunities in cyber defense, because it's letting vulnerabilities be found and fixed faster than ever. His example: the Linux Kernel Project patched more than a thousand vulnerabilities last month. The NCSC itself sent over 110,000 proactive notifications and Early Warning alerts to UK organizations in response to a PHP vulnerability (he didn't say which one).

The money is new. In the week before the speech, the Chancellor announced £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre, which will use AI to find weak spots across critical infrastructure. The NCSC will also run a new AI Cyber Security Centre of Excellence in Manchester.

What it means for people in Britain

Horne put the stakes in terms anyone shopping for groceries would recognize. Leaders who don't act now, he said, will one day have to explain themselves to investors, employees and customers alike.

His asks of organizations are plain. Invest in the technology you already run, and don't leave it connected to the internet when it doesn't need to be. Treat Cyber Essentials, the baseline the NCSC has promoted for years, as the starting point rather than the goal.

Horne said the Cyber Security and Resilience Bill will set a minimum level of resilience across critical national infrastructure. The two NCSC pages I read don't put a number on how likely a successful attack is, or rank which sectors are most exposed (the full report is a PDF I didn't draw on).

Horne said a National Cyber Action Plan will be announced soon. He didn't give a date.