UK warns of AI-powered ransomware hitting critical infrastructure by 2028

The threat of old weaknesses

The National Cyber Security Centre (NCSC) of the UK recently released its 2026 annual review, titled The State of the Cyber Nation. The report highlights a looming moment of choice for the country regarding how it handles cyber resilience. Officials are warning that the primary threat to the nation is not necessarily a brand-new type of attack, but rather the exploitation of old flaws.

NCSC chief executive Richard Horne explained that many vulnerabilities have been tolerated for far too long in the current digital landscape. He noted that these weaknesses can now be discovered and exploited at a scale that was previously unimaginable. This shift is driven by the fact that many organizations have historically opted to do technology on the cheap rather than investing in robust security.

The warning suggests that the sheer volume of cyber incidents is expected to rise significantly in the coming months. Horne emphasized that while AI is a factor, the core issue is the persistence of these underlying technical gaps. He urged organizations to stop connecting systems to the internet unnecessarily and to view government certifications as a starting point rather than a final goal.

AI in the hands of criminals

While the UK warns of future risks, there is already evidence of cybercriminals putting artificial intelligence to work. In May, Google's Threat Intelligence Group confirmed a specific instance of AI-assisted zero-day development. A zero-day refers to a previously unknown flaw that allows attackers to bypass security measures before a fix can be created.

In that specific case, criminals used an AI model to find and weaponize a flaw in a popular open-source administration tool. This allowed them to bypass two-factor authentication, which is a security process requiring two different methods of verification. This marked the first time Google confirmed that AI was being used to develop these types of sophisticated exploits in the wild.

However, the scope of AI use in cybercrime may currently be more limited than the most extreme fears suggest. A study from Cambridge University analyzed over 90,000 cybercrime forum threads to see how criminals are actually behaving. The research found that the majority of criminals are currently using AI for simpler tasks like spam and phishing rather than complex, high-level attacks.

Protecting critical infrastructure

To combat these rising threats, the UK government has announced several new investments aimed at hardening national defenses. One major initiative includes a £60 million investment for the first phase of a national Cyber Shield. This project is designed to provide a broader layer of protection against coordinated digital attacks on the country's systems.

Additionally, the government is allocating £70 million to create a new National Exposure and Real-Time Vulnerability Centre. This facility will specifically focus on identifying weaknesses across critical infrastructure. By monitoring these systems in real-time, the government hopes to stay ahead of attackers who might try to disrupt essential services like electricity or water.

The UK is also establishing a new AI Cyber Security Centre of Excellence in Manchester. This center will be run by the NCSC to study the intersection of artificial intelligence and cybersecurity. These investments represent a significant shift toward proactive defense and a move away from reactive measures that only address problems after they occur.

The human and economic cost

The warnings from the NCSC are not just technical; they carry significant implications for the general public and the economy. Richard Horne warned that leaders who fail to act on these security concerns could face severe consequences. He suggested that the lack of investment could lead to situations where food is missing from shelves and the lights are turned off.

The report suggests that the consequences of cyberattacks on critical infrastructure could be devastating for businesses and residents alike. If systems fail, businesses could go under, and the basic functions of society could be paralyzed. This highlights the need for organizations to treat cybersecurity as a fundamental requirement for survival rather than an optional IT expense.

The government is pushing for a standard where security is integrated into the very beginning of technology deployment. By moving away from 'tech on the cheap,' the UK aims to prevent the catastrophic outcomes described by Horne. The goal is to ensure that the nation's infrastructure remains resilient even as the tools available to attackers become more sophisticated.

A call for global safeguards

The domestic concerns in the UK are part of a larger international conversation about the risks of frontier AI systems. Foreign Secretary Yvette Cooper recently voiced concerns about how these technologies might transform warfare and crime. She argued that governments need to reach an agreement on AI safeguards before these systems can fundamentally change society.

Cooper's comments reflect a sense of urgency regarding the pace of AI development and its potential for misuse. She warned that the international community cannot afford to wait for a catastrophic event before taking action. This sentiment aligns with the NCSC's push for immediate investment in identifying and closing vulnerabilities before they can be exploited on a massive scale.

Looking forward, the focus will likely remain on balancing the benefits of AI with the need for robust security protocols. The UK's new centers and investments are designed to provide a blueprint for this balance. By identifying weaknesses in real-time and creating centers of excellence, the government hopes to mitigate the risks of an AI-powered ransomware era.