UK critical infrastructure faces AI-powered cyber threats by 2028

The rise of AI-powered malware

The National Cyber Security Centre (NCSC) has issued a stark warning regarding the evolution of digital threats. The agency reports that AI-powered malware is highly likely to be used in ransomware attacks against the UK's critical national infrastructure by 2028. This shift represents a significant escalation in how cybercriminals operate and scale their reach.

Ransomware involves attackers gaining access to a network to encrypt files or lock users out of their systems. They then demand payment to restore access or threaten to leak stolen data. By using artificial intelligence, these criminal groups can automate several stages of an intrusion, making the process much faster and more efficient than previous methods.

The NCSC notes that AI specifically helps hackers identify potential targets and locate existing weaknesses in computer networks. It also allows for the rapid development of malicious code. This means that hackers can now target a much greater number of organizations simultaneously, increasing the risk of widespread service outages across the country.

Vulnerabilities in essential services

The threat extends far beyond standard office computers and personal devices. Modern infrastructure relies heavily on connected technology to manage physical processes like electricity generation, manufacturing, and heating. When these systems are linked to the internet, they become potential entry points for malicious actors seeking to cause physical disruption.

The NCSC highlighted recent incidents in Europe as a warning of what could happen to British services. For example, hackers manipulated refrigeration controls at French supermarkets in October. This caused temperatures to rise above 50°C, forcing retailers to discard their entire food stocks. Similar suspected attacks occurred across several other European countries in November.

These examples illustrate how a digital breach can have immediate, real-world consequences for the public. If successful, attacks on the UK's critical national infrastructure could lead to situations where food is unavailable or essential services are halted. The NCSC warns that organizations must take the security of these connected pieces of equipment much more seriously to prevent such outcomes.

State-backed threats and geopolitics

The threat landscape is also being shaped by sophisticated state-backed actors. The NCSC warned that Russia and China are highly likely to use AI more routinely in their cyber operations by 2028. These nations are expected to use these tools to exert pressure on British interests while remaining below the threshold of armed conflict.

Richard Horne, the chief executive of the NCSC, identified Chinese cyber activity as the most sophisticated and sustained challenge facing the UK. He noted that Russian operations are part of a broader strategy to increase pressure on the country. The integration of AI into these state-led efforts means the UK faces a new generation of digital warfare that is both persistent and evolving.

Because these actors have significant resources, they can use AI to find and exploit vulnerabilities that organizations have left unresolved for years. The NCSC argues that the country faces an unprecedented increase in cyber incidents in the coming months. This creates a sense of urgency for public and private institutions to upgrade their security posture before these sophisticated tools are fully deployed.

Investing in national defense

In response to these growing risks, the UK government is increasing its investment in national resilience. Recent funding announcements include £60m for the first phase of a national Cyber Shield initiative. This program is designed to strengthen the UK's ability to use artificial intelligence specifically for cyber defense purposes.

Additionally, the government has allocated £70m to a National Exposure and Real-Time Vulnerability Centre. This center is intended to identify weaknesses across the wider economy and critical infrastructure before they can be exploited. There are also plans to establish an AI Cyber Security Centre of Excellence to further coordinate these efforts.

The goal is to create a system where defenders have access to technology that is as capable as the tools used by attackers. Anne Keast-Butler, director of GCHQ, stated that cybersecurity has become part of the country's national defense. She emphasized that the challenge is not just building better tools, but ensuring that organizations actually use them to fix security flaws before a breach occurs.

A race against the clock

The NCSC's assessment highlights a critical window of time for the UK to improve its defenses. While AI gives attackers the ability to move faster, infrastructure operators still have the opportunity to close long-standing security gaps. The success of these efforts by 2028 will determine how exposed the country's essential services remain to the next major wave of cybercrime.

Recent developments show that AI is already being used for positive security research. Last month, researchers used AI to find a major security flaw in PHP, a programming language used by many websites. This discovery demonstrates how quickly AI can identify previously overlooked flaws, providing a blueprint for how defenders can stay ahead.

Richard Horne warned that organizations can no longer afford to neglect investment in technology. He noted that for decades, the country has managed to get away with doing tech on the cheap. However, the shift toward AI-powered threats means that failure to make different investment choices could leave leaders explaining to customers why essential services have collapsed or why businesses have failed.