UK warns of AI-powered cyberattacks on critical infrastructure by 2028

The 2028 Deadline

Richard Horne, the head of the National Cyber Security Center (NCSC), recently warned that the United Kingdom is on a timeline toward a significant shift in cyber warfare. He stated that the country is expected to encounter machine-learning-driven digital assaults on essential public services by 2028. This timeframe suggests that the integration of AI into hostile cyberactivity is moving from a theoretical risk to an imminent operational reality.

The warning comes as both criminals and state-sponsored actors begin to incorporate AI into their digital toolkits. According to the NCSC, these actors are increasingly using these technologies to conduct cyberactivity. The goal is to move beyond simple data theft and toward more sophisticated operations that can impact the physical world.

The report highlights that the scale of these potential attacks is what concerns officials the most. Horne noted that AI will allow flaws that have been ignored for a long time to be found and exploited "at a scale that was once unimaginable." This means that small, previously manageable security flaws could suddenly be targeted by thousands of automated processes simultaneously.

Scaling Existing Tactics

While the rise of AI in cybersecurity is often discussed in terms of new inventions, the NCSC suggests a more practical evolution. The report indicates that AI is more likely to be used to boost and expand current methods and techniques rather than finding brand new vulnerabilities. Instead of creating entirely new ways to break into systems, AI allows hackers to do what they already do, but much faster and more efficiently.

One specific way this manifests is through AI-powered malware used for ransomware attacks. By automating the discovery and exploitation of flaws, malicious actors can reach a much wider audience in a shorter amount of time. This efficiency makes it harder for traditional defense systems to keep up with the sheer volume of incoming threats.

The report emphasizes that technology currently supports the automated operation of physical systems that are fundamental to contemporary existence. Because these processes are automated, they are susceptible to the same types of digital manipulation. AI provides the engine that allows hostile actors to coordinate these manipulations across multiple targets at once, creating a compounding effect on infrastructure stability.

Targets of Physical Impact

The NCSC identified several specific types of infrastructure that are at risk of being targeted by these AI-enhanced operations. These include electricity switching, sluice gates in water facilities, and dam operations. Because these systems control the flow of resources, a successful cyberattack could lead to immediate and widespread physical consequences for the general public.

Beyond water and power, the report points to manufacturing lines, heating, and refrigeration controls as high-risk areas. Horne specifically mentioned how technology supports the automation of these vital processes. If a hacker can gain access to these controls, they can disrupt the production of goods or the maintenance of essential climate controls in buildings and warehouses.

A real-world example of this risk was recently observed in French supermarkets. Hackers targeted refrigeration units and turned up the temperature, which caused food to thaw and spoil. Horne noted that the UK has also been affected by similar incidents, illustrating how easily civilian infrastructure can be exploited by hostile actors to cause tangible damage.

Geopolitical Cyber Threats

The report identifies specific nations that pose the most significant threats to the UK's digital security. Chinese cyberactivity is described as the "most sophisticated and sustained cyber challenge facing the U.K." The report notes that both Russia and China will routinely use AI to achieve their specific geopolitical goals, often targeting the UK's stability.

Russia is currently identified as a state actor intentionally conducting cybercampaigns that fall below the threshold of armed conflict. This means they are engaging in hostile acts that are serious enough to cause damage but do not trigger a formal military response. By using AI, these campaigns can be made more persistent and harder to attribute to a specific human operator.

Additionally, the report highlights Iran as a source of cyberattacks against the UK. These operations are often directed at individuals who are considered a threat to the Iranian government. The combination of state-sponsored goals and AI-driven efficiency creates a complex environment where the UK must defend against a variety of different actors with different motives.

The Cost of Inaction

Richard Horne issued a stern warning to the leaders of businesses and organizations of all sizes regarding their current security posture. He argued that many organizations have "got away with tech on the cheap" for too long. This lack of investment in modern security measures leaves them vulnerable to the automated attacks that are expected to rise by 2028.

The consequences of failing to update out-of-date technology are not just financial; they are social and logistical. Horne warned that leaders will have to explain why food isn't on the shelves, lights aren't on, or businesses have gone under if they fail to act. This puts the responsibility on the private and public sectors to prioritize cybersecurity as a foundational element of infrastructure.

The transition toward a more AI-heavy threat landscape requires a proactive approach to maintenance. Organizations must identify the specific systems that control physical outputs and ensure they are not relying on legacy software that can be easily scanned by automated tools. Failing to do so risks a future where basic utilities are held hostage by digital adversaries.