What happened
The UK National Cyber Security Centre (NCSC) published its annual review warning that AI-powered malware is highly likely to be used in ransomware attacks against critical national infrastructure (CNI) by 2028. The report also predicts that Russia and China will begin using AI routinely in cyber-attacks. NCSC chief executive Richard Horne is scheduled to warn the public of an imminent, unprecedented rise in cyber incidents, attributing this to AI's ability to uncover long-tolerated IT weaknesses. The review cites recent examples, such as AI discovering a critical vulnerability in PHP, and notes that military communications networks face persistent daily attacks, including hybrid warfare campaigns by Russia that intentionally remain below the threshold of armed conflict.
The National Cyber Security Centre (NCSC), part of GCHQ, released its annual review stating that it is highly likely AI-powered malware will be used in a ransomware attack on UK critical national infrastructure (CNI) between now and 2028. CNI includes energy, transport, defence, food, health, and finance sectors.
The review warns that Russia and China will start using AI routinely in cyber-attacks. NCSC chief executive Richard Horne is set to warn the public in a speech that an unprecedented rise in cyber incidents is imminent, driven by AI's ability to find weaknesses in IT systems that have been tolerated for too long.
The report cites a recent example where AI helped discover a critical weakness in PHP, a language used by nearly 70% of websites. It also notes that British military communications networks are subjected to persistent daily attacks, with Russia conducting hybrid warfare campaigns that intentionally fall below the threshold of armed conflict.
The NCSC highlights recent cyber-attacks on European supermarket fridges, where hackers raised temperatures to over 50C, as a warning for organizations to invest in cyber resilience. The report emphasizes that AI will help attackers scout targets, locate network weaknesses, and write malicious code.
Source details: theguardian.com
Why it matters
This assessment marks a significant shift in the threat landscape, moving AI from a theoretical risk to a predicted operational tool for state and criminal actors targeting essential services. The NCSC's specific timeline and the identification of AI's role in automating target scouting, vulnerability discovery, and code generation highlight the urgent need for organizations to adopt advanced AI tools for defense. Without access to cutting-edge AI for patching and detection, defenders may be outpaced by attackers who leverage these same capabilities to exploit legacy systems. The warning also underscores the blurring line between cyber operations and hybrid warfare, as seen in attacks on European supermarket fridges and persistent intrusions into military networks, necessitating a fundamental re-evaluation of cyber resilience strategies for both public and private sectors.
The NCSC's assessment provides a concrete timeline for the operationalization of AI in cyberattacks against essential services, shifting the focus from speculative risks to imminent threats. This prediction underscores the need for critical infrastructure operators to accelerate their adoption of AI-driven defensive tools.
The report highlights a critical asymmetry: while AI can help defenders find and patch flaws, attackers who gain access to advanced AI models first may exploit vulnerabilities before they are addressed. This dynamic pressures both nation states and private companies to secure access to cutting-edge AI capabilities for security purposes.
The mention of Russia's hybrid warfare tactics, which remain below the threshold of armed conflict, indicates that cyberattacks are becoming a standard tool of geopolitical strategy. This elevates the stakes for UK infrastructure, as attacks may be part of broader state-sponsored campaigns rather than isolated criminal acts.
The warning serves as a call to action for the UK government and private sector to move beyond traditional security measures and invest in robust cyber resilience, acknowledging that legacy systems and cheap tech solutions are no longer sufficient against AI-enhanced threats.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
What to watch next
Monitor for the publication of Richard Horne's speech and any specific technical details regarding the AI capabilities being deployed by threat actors. Watch for increased adoption of AI-driven security tools by UK critical infrastructure providers and government agencies. Additionally, track any new incidents involving AI-assisted ransomware or state-sponsored cyber operations that align with the NCSC's predictions of rising incident frequency and sophistication.
The specific content of Richard Horne's upcoming speech, which may provide further details on the types of AI tools being used by attackers and the specific vulnerabilities being targeted.
The response of UK critical infrastructure providers to the NCSC's warning, including any new investments in AI security tools or changes to their incident response protocols.
Any new reports of AI-assisted cyberattacks on UK or European infrastructure, which would validate the NCSC's predictions and demonstrate the real-world impact of these threats.
The development of new AI security standards or regulations in the UK and other countries, as governments seek to address the growing threat of AI-powered malware and state-sponsored cyber operations.