LONDON, November 3, 2026 — The United Kingdom should prepare for the possibility of an artificial intelligence-powered cyberattack on critical national infrastructure by 2028, the head of the National Cyber Security Centre (NCSC) warned on Tuesday, saying criminals and hostile states could use AI to scale up existing cyber operations.
Richard Horne, chief executive of the NCSC, said AI-powered malware was highly likely to feature in a ransomware attack against Britain’s critical infrastructure within the next two years. The warning was included in the centre’s annual assessment of the country’s cyber threat environment.
The central risk, according to the NCSC, is not that AI will suddenly invent entirely new ways to penetrate systems. Instead, the technology could help attackers discover and exploit long-standing weaknesses more quickly and across a much larger number of targets. That could make familiar methods, including ransomware, more efficient and harder for underprepared organisations to contain.
Horne criticised years of underinvestment in basic technology security, warning that outdated equipment and systems connected unnecessarily to the internet could expose essential services. Operational technology is a particular concern because digital controls are used in electricity networks, water facilities, dams, manufacturing lines, heating systems and refrigeration.
Recent attacks on supermarket refrigeration systems in France, which also affected organisations in the UK, illustrate the danger of poorly secured operational technology. Horne stressed that those incidents were not AI attacks: they involved old systems that were no longer receiving updates and were connected to the internet with default passwords. The episode demonstrated how vulnerabilities that have existed for years can still cause real-world disruption.
The NCSC described Chinese cyber activity as the UK’s most sophisticated and sustained state-linked cyber challenge. It also said Russia conducts cyber campaigns below the threshold of armed conflict, while Iran has targeted individuals considered threats to its government. The warning about AI concerns the growing scale and efficiency of hostile activity, rather than attributing a specific future attack to any one country.
The centre urged organisations to update devices and software, restrict administrator access, avoid unnecessary internet exposure and maintain reliable backups. The NCSC said malicious cyber activity costs UK organisations almost $20 billion annually, while Jaguar Land Rover’s 2025 cyberattack caused more than $260 million in direct losses.
The warning places renewed emphasis on cyber resilience as a matter of public safety as well as business continuity. Essential services increasingly depend on connected systems, meaning weaknesses in equipment that controls physical processes can have consequences beyond the loss of data or access to corporate networks.
Comments (0)
Be the first to comment. Comments are published after moderation.