The UK's National Cyber Security Centre (NCSC) published its State of the Cyber Nation report on November 3, 2026, warning that the country's critical national infrastructure should brace for a ransomware attack involving AI-powered malware, which the NCSC considers "highly likely" by 2028. Richard Horne, chief executive of the NCSC, part of GCHQ, said in the speech launching the report that the UK faced a real prospect of an unprecedented rise in cyber incidents in the coming months.
Old vulnerabilities amplified by AI, not new weapons
The report argues that hostile actors' use of AI will increase the scale and efficiency of their operations over the next two years, covering ransomware, social engineering and vulnerability exploitation. Horne's judgement is that AI has not invented new ways to attack; the real problem is vulnerabilities tolerated for too long, which can now be discovered and exploited at a scale once unimaginable. He also named state actors: the assessment puts China at the forefront on intent and capability, says Russia is making sustained attempts to penetrate UK military networks, and says Iran is carrying out malicious cyber operations globally. Moscow, Beijing and Tehran have repeatedly denied such allegations.
The UK response list: funding, a centre and a bill
The NCSC calls on organisations to act now, including closing gaps in technology investment, not connecting unnecessary technology to the internet, and treating Cyber Essentials as the starting point for cyber security rather than the end goal. The government's measures are already set out: last week the Chancellor announced £60 million for the first phase of a national Cyber Shield, £70 million for a new National Exposure and Real-Time Vulnerability Centre, and an AI Cyber Security Centre of Excellence in Manchester, run by the NCSC; alongside them, the Cyber Security and Resilience Bill is progressing and a National Cyber Action Plan is forthcoming.
This warning is a forward-looking assessment aimed at 2028, not a statement that an attack has happened. Its weight lies in the specific timetable: within two years, AI-powered malware is "highly likely" to feature in a ransomware attack on critical infrastructure. What comes next is whether UK organisations will genuinely invest more at what Horne calls a "moment of choice", or keep treating security as an afterthought.
