The UK’s critical national infrastructure should prepare for ransomware involving AI-powered malware by 2028, the National Cyber Security Centre (NCSC) has warned. The assessment, published alongside the agency’s State of the Cyber Nation review, says it is “highly likely” that artificial intelligence will increase the scale and speed of attacks by hostile actors, including ransomware, social engineering and vulnerability exploitation. The NCSC’s announcement frames the prediction as a forward-looking threat assessment, not a report of a confirmed AI-driven attack.
The agency says China, Russia and other nation states are likely to be routinely using AI cyber capabilities to pursue geopolitical objectives by 2028. AI is already helping some attackers identify vulnerabilities, select targets and operate more efficiently, but the NCSC gave no technical definition of the malware it expects to feature in a future ransomware operation. It also warned that broader access to offensive and dual-use AI tools could make campaigns harder to attribute by allowing malicious activity to blend into a larger volume of criminal and state-backed operations. The agency’s threat assessment says the immediate priority is to improve resilience against established attack methods while preparing for faster, more scalable threats.
The warning raises the pressure on operators of energy, healthcare, transport, communications and other essential services to reduce exposure before attackers gain further automation. The NCSC said organisations should invest urgently in security and resilience, treating its Cyber Essentials scheme as a baseline rather than a complete security programme. That means maintaining accurate asset inventories, prioritising the remediation of internet-facing weaknesses, testing recovery from ransomware and ensuring that identity, backup and incident-response controls can withstand a fast-moving intrusion.
The UK is also testing AI-assisted defensive capabilities. Project DROMOS began with a four-week review of government code repositories and expanded into selected operational environments, where the NCSC says it identified hundreds of potential security issues, including critical vulnerabilities. The project’s published account does not identify the vulnerabilities or provide CVE numbers, exploit details or evidence that any were exploited in the wild.
Separately, the NCSC and the Department for Digital, Culture, Media and Sport are developing Cyber Shield, a national programme for agentic detection, analysis and response planned for staged delivery over five years. The government has allocated £60 million for its first phase and £70 million for a National Exposure and Real-Time Vulnerability Centre intended to track weaknesses across critical infrastructure and the wider economy. The NCSC says Cyber Shield will require organisations to build confidence in automated defensive actions before such systems can be adopted at scale.
