Quick Takeaways
-
AI is a force multiplier, not a wholly new threat: attackers can use it to find and exploit familiar weaknesses faster and at greater scale.
-
By 2028, AI-powered malware is highly likely to be used in a ransomware attack on U.K. critical national infrastructure.
-
Basic security gaps remain the main entry point: patch internet-facing systems, secure accounts, train staff, limit unnecessary connectivity and strengthen suppliers.
- The stakes are national and economic: cyberattacks disrupt essential services and cost U.K. organisations an estimated £14.7 billion a year; the NCSC urges urgent investment in resilience.
What’s the Problem?
The U.K.’s National Cyber Security Centre (NCSC), part of GCHQ, warned in its Annual Review 2026 that AI-powered malware is highly likely to be used in a ransomware attack against U.K. critical infrastructure by 2028. This is a forecast, not a report of an attack that has already occurred. The warning concerns essential services and the organisations that operate them. The NCSC says AI could help hostile states and criminals find weaknesses, target victims and scale familiar attacks faster. However, it does not expect AI to make human direction unnecessary or to create entirely new attack methods.
The risk is growing because many organisations still rely on outdated systems, leave known vulnerabilities unpatched, or invest too little in basic cyber security. As a result, AI may make these longstanding weaknesses easier to exploit at speed and scale. The NCSC urges organisations to strengthen their defences, limit unnecessary internet connections and treat Cyber Essentials as a starting point. Industrial Cyber reported the warning, citing the NCSC review and statements from U.K. security officials.
Risks Involved
The NCSC’s warning that AI-powered malware could target UK critical infrastructure by 2028 matters to every business, not only utilities or transport firms. Such tools may help attackers tailor scams, evade basic defenses, and exploit weak links in suppliers or cloud services. As a result, a smaller company could be breached directly—or become the route into a larger organization. The damage can spread quickly: systems may stop, orders and payments may stall, sensitive data may be stolen, and recovery costs may rise. Moreover, customers could lose trust, contracts could be jeopardized, and regulatory duties may follow. The warning is not a prediction that every business will be attacked; it is a reason to strengthen defenses before disruption becomes costly.
Possible Next Steps
Timely remediation narrows the window in which AI-enabled malware could disrupt essential UK services.
Priority Actions
- Assess exposure: Inventory IT, operational technology (OT), critical assets, suppliers, and dependencies; rank risks by potential impact on public services.
- Harden systems: Apply security updates promptly, remove unsupported software, secure configurations, and restrict remote access—especially to OT environments.
- Limit attacker movement: Separate IT and OT networks, enforce least-privilege access, and require multifactor authentication for privileged and remote accounts.
- Improve detection: Monitor network and endpoint activity for unusual behavior, including in OT settings; use threat intelligence to update detection rules as tactics evolve.
- Prepare recovery: Maintain tested, offline or immutable backups, and rehearse restoration of critical systems in priority order.
- Coordinate response: Set clear incident roles and escalation routes; exercise scenarios with suppliers and relevant UK authorities, including the NCSC where appropriate.
- Remediate compromise: Isolate affected systems, preserve evidence, remove malicious access and persistence, rotate exposed credentials, rebuild from trusted sources, and verify systems before reconnecting them.
Stay Ahead in Cybersecurity
Discover cutting-edge developments in Emerging Tech and industry Insights.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
