GCHQ Says AI Ransomware Is Highly Likely to Hit UK Infrastructure by 2028 and Blames Cheap Tech
The NCSC, part of GCHQ, says AI-powered malware will highly likely be used in a ransomware attack on UK critical infrastructure by 2028. Its chief says the real culprit is decades of doing tech on the cheap, not a new kind of attack.
Britain's signals intelligence agency just told the country's boardrooms to stop pretending. In its State of the Cyber Nation report, published Tuesday, the National Cyber Security Centre, part of GCHQ, says it is "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. The agency is not describing a clever new weapon. It is describing a bill coming due.
That is the sharpest part of the NCSC announcement. Chief executive Richard Horne is set to say in a launch speech that a surge in incidents is coming "not because AI has invented new ways to attack us" but because old weaknesses can now be found and exploited at scale.
"For decades, we have collectively got away with doing tech on the cheap." Richard Horne, NCSC chief executive, in remarks prepared for the report launch
Read that twice. The head of the UK's cyber agency is pointing at underinvestment, not a sinister algorithm. AI is the accelerant. The tinder is legacy systems and kit that never needed to be online.
The NCSC's annual review says that by 2028 it is highly likely China, Russia and other states will routinely use AI cyber capabilities to pursue geopolitical goals. The agency also says hostile use of AI is highly likely to raise the scale and efficiency of ransomware, social engineering and vulnerability exploitation within two years.
China gets the starkest billing. According to Reuters coverage syndicated by Devdiscourse, Horne will say China "highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets". He calls its activity the most sophisticated and sustained cyber challenge the UK faces. Russia, he will add, is trying to penetrate UK military networks, and Iran is running malicious operations globally. Moscow, Beijing and Tehran have repeatedly denied similar accusations, Reuters notes.
Worth keeping straight what this is. It is an intelligence assessment. "Highly likely" is a calibrated probability term, not a report of an attack that has happened. The NCSC's separate AI and cyber intrusion assessment describes its 2028 outlook through three scenarios and says they are plausible possibilities, not predictions.
The line leaders will remember
Horne's message to executives is blunt. Fail to change course and, per the NCSC, leaders will have to look investors, employees, customers and suppliers in the eye and explain "when food isn't on shelves, lights aren't on, businesses have gone under".
It is a pointed way to drag cyber risk out of the IT department. Reuters notes the report follows hacking attacks on supermarkets across Europe that exposed IT weaknesses.
The ask itself is unglamorous. Invest properly in technology. Stop connecting systems to the internet unless there is a reason. Treat Cyber Essentials as the starting point, not the end goal. None of that needs an AI model, which is exactly the point.
The agency is not all doom. It says AI is also a critical opportunity to improve collective resilience, if organisations fix the foundations first. Last week, the NCSC says, the Chancellor announced £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC. Security Minister Dan Jarvis says the agency is using AI "to help stay ahead of those who seek to do us harm".
Set that against the money question. £130 million is real, but it is government spending on government capability. The report's argument is that the heavy lifting sits with operators and suppliers who set their own budgets. Regulators are circling the same ground from another angle, as in our report on four UK regulators warning that blaming an AI agent will not work.
Nobody can say they were not told. The NCSC has put the warning in writing, with a date attached. What operators of food, power and transport do with it is their call.
