Summary
- The NCSC assesses that AI-powered malware is highly likely to feature in a ransomware attack on UK critical infrastructure by 2028.
- AI could accelerate vulnerability discovery, exploitation, and the replacement of compromised attacker access.
- Legacy infrastructure and the growing use of AI within essential services introduce overlapping security challenges.
AI-powered malware is highly likely to feature in a ransomware attack against the UK’s critical national infrastructure by 2028, according to a new assessment from the National Cyber Security Centre.
The assessment, published on 3 November, examines how increasingly capable artificial intelligence systems could change the speed, scale, and effectiveness of cyber intrusions over the next two years.
The National Cyber Security Centre expects attackers to use AI to identify vulnerabilities, conduct exploitation, and automate parts of their existing operations. Its findings suggest that some activities currently requiring specialist knowledge may become easier to perform or repeat.
The agency’s judgement concerns the likely adoption of AI capabilities across existing threats. It does not identify a planned attack on a particular organisation or establish that autonomous malware has already caused a major UK infrastructure incident.
Faster exploitation of familiar weaknesses
One of the assessment’s central findings is that many systems will remain vulnerable as AI-enabled attack tools become more capable.
By 2028, the NCSC considers it almost certain that attackers will encounter systems whose weaknesses can be identified and exploited using automated tools.
That development could make attackers less concerned about losing access to a compromised environment, because obtaining replacement access may require less time and effort.
The consequences are particularly relevant to organisations running large numbers of interconnected systems. An attacker able to examine more targets and test weaknesses more efficiently may identify exposed services that would otherwise have remained unnoticed for longer.
Critical national infrastructure presents additional difficulties because essential services often depend on equipment intended to operate for many years.
Industrial controllers, specialist management systems, and operational technology may have limited opportunities for software upgrades or replacement. Changes to those systems can require careful testing to avoid interrupting the services they support.
The NCSC judges it likely that attackers will apply AI-enabled capabilities against known vulnerabilities in legacy infrastructure, while also exploiting weaknesses introduced by legitimate AI deployments.
Operators adopting AI for monitoring, automation, or operational decision-making may introduce new data connections and administrative interfaces. Those systems can expand the number of components requiring protection, particularly where they connect previously separate operational and corporate environments.
State-backed and criminal activity
The assessment also considers the use of AI by governments conducting espionage and disruptive cyber operations.
By 2028, the NCSC judges it highly likely that Russia, China, and other nation states will routinely use AI-enabled cyber capabilities to pursue geopolitical objectives.
Such adoption could increase the scale and speed of attacks while helping operators examine networks, identify useful information, and maintain access.
Cybercriminal groups are expected to benefit from some of the same developments, particularly where openly available tools can be repurposed to automate reconnaissance and exploitation.
Ransomware operators already combine credential theft, remote access, lateral movement, and interference with recovery systems. AI could make portions of those processes faster without fundamentally changing the purpose of the intrusion.
For infrastructure operators, disruption can arise through supporting business systems as well as equipment directly controlling physical processes. A compromised supplier, administrative platform, or communications service may affect operations even where industrial equipment itself remains intact.
Three potential threat trajectories
Rather than presenting one predetermined future, the NCSC describes three plausible scenarios for the period to 2028.
Its baseline scenario anticipates a growing global threat from AI-enabled cyber capabilities. A pessimistic scenario considers proliferation outpacing the UK’s defensive capacity, while an optimistic scenario allows for slower development and stronger countermeasures.
The agency explicitly states that these scenarios are not predictions. They are intended to examine uncertainty in technological development and the response of attackers and defenders.
The assessment’s probability judgements are separate from those scenarios and represent the NCSC’s current evaluation of the available evidence.
Existing infrastructure weaknesses remain prominent across the analysis. Poorly protected interfaces, delayed security updates, and inadequate separation between systems may still provide the access that attackers need.
As AI capabilities improve, the time and resources required to exploit those weaknesses may change considerably.
The NCSC’s outlook extends to 2028, with the agency acknowledging that the pace of AI development creates considerable uncertainty about the capabilities available to attackers and defenders over that period.
