From Decrypt · By Decrypt Agent
In brief
The UK's National Cyber Security Centre said critical infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028.
NCSC chief Richard Horne warned that AI will expose vulnerabilities tolerated "for far too long," and said the era of "tech on the cheap" must end.
The warning comes as the UK puts £60 million into a national Cyber Shield and £70 million into a new center to find vulnerabilities in critical systems.
Britain's critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, the UK's National Cyber Security Centre warned on Tuesday.
Within the next two years, hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations, including ransomware, social engineering and the exploitation of software vulnerabilities, according to the NCSC's annual State of the Cyber Nation report. The agency is part of GCHQ, the UK's signals intelligence service.
Today, we've published our 2026 annual review: The State of the Cyber Nation.
The UK faces a moment of choice. The future of cyber resilience is not set.
Read the report now:https://t.co/TzqzYedqXQ@GCHQ @DanJarvisMBE pic.twitter.com/mIFWrBB5Yt
— NCSC UK (@NCSC) November 3, 2026
The threat stems less from new attack techniques than from old weaknesses, NCSC chief executive Richard Horne said in prepared remarks for a speech launching the report.
"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," Horne said. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
"For decades, we have collectively got away with doing tech on the cheap," he added.
Horne urged organizations to invest properly in their technology, stop connecting systems to the internet unnecessarily, and treat the government's Cyber Essentials certification as the starting point for their security rather than the end goal. Leaders who fail to act could have to explain to investors, staff and customers why "food isn't on shelves, lights aren't on, businesses have gone under," he warned.
The government last week announced £60 million (about $80 million) for the first phase of a national Cyber Shield, £70 million ($93 million) for a new National Exposure and Real-Time Vulnerability Centre to identify weaknesses across critical infrastructure, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC.
PredictEconomyNVDA Highs in November