NCSC warns AI-powered ransomware will hit UK infrastructure by 2028

The UK's National Cyber Security Centre says AI-powered malware is "highly likely" to feature in a ransomware attack on Britain's critical national infrastructure between now and 2028, according to its annual review and a companion threat assessment reported on 3 November 2026.

The NCSC, the cyber arm of signals intelligence agency GCHQ, gave little detail about what form such malware might take. It did point to open source AI security tools, originally built to help security researchers, being repurposed for criminal use. That repurposing is already happening. Researchers are seeing widespread abuse of ARTEX, an open source Chinese-made AI red-teaming platform, in attacks on the UK registrar 123 Reg, Microsoft 365 and others since the tool launched in July, The Register reports.

In its pessimistic scenario for 2028, the NCSC describes "a significant increase in the frequency and sophistication of cyberattacks worldwide", with broader adoption of AI tools making attribution harder. The report says China "has likely played a role" in supplying those tools in that scenario, "enabling them to hide their activities within the noise".

The assessment also raises the prospect of an autonomous attacker operating beyond its human operator's control. The NCSC says it "is a realistic possibility such an entity could self-replicate and conduct cyberattacks at will, with no apparent motivation or restraint". The agency says such attacks would likely complicate geopolitical relations, because attribution difficulties would make it easier for states that order attacks to deny involvement.

On defence, the NCSC acknowledges that AI is already changing how vulnerabilities are found and patched. Project DROMOS, launched by the Government Cyber Coordination Centre with the AI Security Institute and other departments, began earlier this year with a four-week pilot analysing government code repositories before expanding into selected operational environments. The NCSC says the project uncovered hundreds of potential security issues, including critical vulnerabilities.

The review reaffirms Cyber Shield, an agentic cyber defence system first trailed in July. It is expected to be delivered in stages over five years. Under the scheme, the NCSC will supply defensive agents deployed by participating organisations with data intended to strengthen national resilience. The NCSC will run it alongside the Department for Digital, Culture, Media and Sport, but acknowledged that this kind of automated defensive activity currently sits outside many organisations' risk tolerances. It said it has a role in building trust before adoption can become mainstream.

The government has set aside £60 million for the initiative and £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre, which will track vulnerabilities across critical national infrastructure organisations and the wider economy. Last week's budget assigned £40 million to a National Agentic Security Unit, responsible for responding to uncontrolled bots and other agentic mishaps, and £24 million to strengthen public sector defences. An undisclosed sum will help establish an NCSC-managed AI Cyber Security Centre in Manchester.

NCSC chief executive Dr Richard Horne urged organisations to "invest with urgency" in security and resilience. "For decades, we have collectively got away with doing tech on the cheap," he said. He added that organisations should make security "a fundamental requirement, not an afterthought", and treat the NCSC's Cyber Essentials certification as a starting point, scaling resilience work to match size, complexity and risk. The government also announced a 75 percent discount on Cyber Essentials certification for micro, small and medium-sized businesses applying for a first certificate.