The NCSC judges AI-powered ransomware against UK infrastructure highly likely by 2028. Old weaknesses are the exposure

In brief

On 3 November 2026 the National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026 and a State of the Cyber Nation report. Its assessment says it is "highly likely" that, between now and 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI).

That is a probability judgement on the government's PHIA yardstick, not a forecast of a specific event. The NCSC's own assessment says its 2028 scenarios "are not predictions".

What the NCSC actually assessed

• Force multiplier. The Annual Review says it is "almost certain AI will act as a force multiplier across the cyber threat landscape", with the greatest impact coming from speeding up and scaling existing techniques rather than inventing new ones.
• Legacy exposure. The intrusion assessment judges it "almost certain that many systems will remain vulnerable" to AI tools that find and exploit weaknesses by 2028, and "likely" that attackers will turn them on known vulnerabilities in CNI legacy technology.
• State actors. The Annual Review states: "China highly likely has the intent and is best positioned to use AI for operations against critical national infrastructure and other strategic targets."
• Underinvestment. The NCSC says the era of "tech on the cheap" at the expense of security is over. Its launch release quotes CEO Dr Richard Horne's prepared speech: "For decades, we have collectively got away with doing tech on the cheap."

The release also points to funding the Chancellor announced the previous week: £60m for the first phase of a national Cyber Shield, £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre, and an AI Cyber Security Centre of Excellence in Manchester, run by the NCSC.

Why it matters

The message is less about new AI weapons than about old debt. The NCSC's argument is that vulnerabilities "tolerated for far too long" can now be found and exploited at scale. It also expects a widening divide: organisations with legacy technology and thin resources "may struggle to keep pace" and become more attractive targets.

Operational technology in utilities, food supply and logistics is where that debt tends to sit. ByteNib's earlier report on a European supermarket refrigeration cyberattack is useful background on how disruption to such systems reaches the physical world.

What leaders should do next

1. Inventory internet-facing systems. The NCSC specifically calls out technology "unnecessarily connected to the internet". Disconnect or put behind controlled access anything that does not need direct exposure.
2. Shorten patch cycles. The Annual Review expects defenders to face "a race to shorten patch deployment timelines". Measure your current time to patch critical flaws and set a target.
3. Plan legacy replacement, not just compensation. Where an old system cannot be patched, record the owner, the isolation in place and a funded retirement date.
4. Treat Cyber Essentials as the floor. The NCSC wants it to be "the starting point for cyber security, not the end goal".

Sources and scope

Facts and quotations are from the NCSC's launch release, the Annual Review 2026 chapter on the impact of AI on cyber threat and the assessment Artificial intelligence and cyber intrusion, all checked on 3 November 2026. Horne's quotations come from remarks the NCSC published ahead of his launch speech; we have not independently confirmed delivery. Funding figures are as reported by the NCSC. The recommended actions are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.