UK cyber agency warns AI-enabled attacks may become routine by 2028

The UK’s National Cyber Security Centre says Russia, China and other states are highly likely to use AI-enabled cyber capabilities routinely by 2028. The agency expects that use to increase the speed and scale of sophisticated attacks against the country.

It also assesses that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure between the assessment’s publication and 2028. The NCSC called on organisations to invest urgently in resilience and fix longstanding security weaknesses before attackers can exploit them at greater scale.

According to the November 3 assessment, attackers are likely to apply AI tools to known vulnerabilities in legacy critical-infrastructure technology. Deploying AI within critical infrastructure could also create new openings for attackers.

The NCSC assesses that many systems are almost certain to remain vulnerable in 2028 to AI tools that can find and exploit weaknesses. Those capabilities could make it cheaper for attackers to regain access after defenders remove them from a network.

Its baseline, pessimistic and optimistic scenarios are plausible medium-term possibilities, not predictions, the agency cautioned, adding that the potential for surprise is high. The findings do not establish that a specific AI-powered ransomware attack on UK critical infrastructure has already happened.

The NCSC expects AI’s largest near-term effect to be the acceleration and scaling of existing attack methods, rather than the creation of new attack vectors or fully autonomous, end-to-end cyberattacks, according to its annual review of AI’s impact on cyber threats. Human operators are still highly likely to remain essential for directing, checking and adapting AI-generated output during cyber operations.

AI can help identify vulnerabilities across large codebases and spot system misconfigurations. That compresses the time defenders have to deploy patches before attackers turn a discovered weakness into a working exploit.

In prepared remarks published with the assessment, NCSC chief executive Richard Horne said organisations had “collectively got away with doing tech on the cheap” for decades. The agency identified underinvestment and unnecessary internet connections among foundational weaknesses, and said the government-backed Cyber Essentials scheme should be treated as a starting point rather than an end goal.