PolicyNews
NCSC: AI malware likely in UK infrastructure attack by 2028
The UK's NCSC says it is highly likely that AI-powered malware will feature in a ransomware attack on critical national infrastructure by 2028.
By: Mikola Máté Patrik · · 2 min read
Mikola Máté Patrik
What happened?
On November 3, the UK's National Cyber Security Centre (NCSC) presented its annual assessment (NCSC). The headline: it is highly likely that AI-powered malware will play a part in a ransomware attack on UK critical national infrastructure by 2028.
NCSC chief executive Richard Horne said the era of "tech on the cheap" is over, meaning organisations can no longer run technology with minimal security investment. The NCSC stresses that the problem is not that AI has invented new ways to attack. AI makes existing weaknesses faster and cheaper to exploit.
What the NCSC recommends
- Real investment in cyber security instead of running systems at the bare minimum.
- Removing unnecessary internet exposure of systems.
- Treating Cyber Essentials certification as a starting point, not the finish line.
The government package
The warning ties in with the Cyber Security and Resilience Bill and the National Cyber Action Plan. The UK government is committing £60 million to the Cyber Shield programme and £70 million to the NERV Centre, and an AI Cyber Security Centre of Excellence is being set up in Manchester.
A related NCSC report (AI and cyber intrusion) assesses that by 2028 Russia and China could be using AI routinely in their intrusion operations.
Why it matters
The NCSC is one of the most cited cyber agencies in Europe, and its findings often echo in EU practice. For operators the takeaway is simple: AI speeds up the exploitation of old flaws. Patching, reducing exposure and basic hygiene are worth more now than ever.
Produced with the help of AI, reviewed by an editor. How we make our articles
Reviewed and edited by the Neural Daily desk. About
