Artificial intelligence is transforming cybersecurity, but it is also giving cybercriminals new capabilities. In a warning published on 3 November 2026, the UK’s National Cyber Security Centre (NCSC), part of GCHQ, said AI-powered malware is highly likely to be used in a ransomware attack against critical national infrastructure by 2028.
The assessment raises urgent questions about whether governments, businesses and essential service providers are prepared for threats that can identify and exploit vulnerabilities at unprecedented speed and scale. Power stations, airports, hospitals, payment systems and communications networks could all face disruption if attackers successfully compromise the systems on which daily life depends.
What the NCSC has warned
The NCSC’s State of the Cyber Nation report, published on 3 November 2026, forecasts that hostile actors’ adoption of AI is “highly likely” to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.
It also assesses that, by 2028, Russia, China and other states are highly likely to use AI-enabled cyber operations routinely to pursue geopolitical goals. The NCSC specifically identifies China as well placed to target critical infrastructure and says it likely has the intent to do so.
Importantly, this is a forecast of future risk rather than confirmation that a particular AI-powered attack has already occurred. The NCSC says its scenarios are plausible possibilities designed to inform proactive security planning, not predictions.
How AI changes cyberattacks
AI can accelerate established attack techniques rather than invent entirely new forms of cybercrime. It can help attackers scan systems for weaknesses, generate malicious code, automate reconnaissance, craft convincing phishing messages and plan intrusions more efficiently.
The NCSC expects AI to act as a “force multiplier” for skilled attackers: tools can identify and exploit system weaknesses at speed, allowing attackers to lose access with less concern because replacing it costs little.
That matters because most successful attacks still rely on familiar weaknesses—known vulnerabilities, weak credentials and social engineering. AI makes those methods faster, cheaper and easier to scale across many targets.
Why critical infrastructure is exposed
Critical infrastructure is attractive to attackers because even limited disruption can have wide economic, public-safety and political consequences.
| Sector | Potential consequences |
| Energy | Electricity supply disruption |
| Healthcare | Delayed treatment and unavailable patient systems |
| Transport | Airport and railway operational disruption |
| Finance | Interrupted payments and banking services |
| Food supply | Distribution and refrigeration failures |
| Communications | Network outages and service interruptions |
Legacy technology, interconnected operational systems and underinvestment in cyber resilience can widen the attack surface. The NCSC warns that attackers are likely to target known vulnerabilities in legacy infrastructure, as well as new risks created by deploying AI tools within critical systems.
The UK’s response
The UK government has announced £130 million for the first phase of AI-enabled cyber defence: £60 million for a National Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre.
The Cyber Shield will use agentic AI to strengthen national defences and includes a £25 million challenge fund for UK AI and cybersecurity innovators. The NERV Centre will build a national picture of vulnerabilities across critical infrastructure and the wider economy.
The government is also establishing an NCSC-run AI Cyber Security Centre of Excellence in Manchester, advancing the Cyber Security and Resilience Bill, and preparing a National Cyber Action Plan to improve resilience and deter hostile state activity.
AI versus AI
AI is also becoming central to defence. Security teams can use it for vulnerability detection, continuous monitoring, threat intelligence, faster incident response and more rapid software patching.
The challenge is that both attackers and defenders can benefit from the same underlying technology. The NCSC notes that defensive AI implementation in UK critical infrastructure appears to lag behind offensive use, making responsible deployment, human oversight and broad access to defensive tools increasingly important.
What businesses must do
Businesses should treat AI-enabled cyber risk as a board-level continuity issue, not solely an IT problem. Practical priorities include:
- Regular security assessments and penetration testing.
- Prompt patching and secure configuration of software.
- Network segmentation to limit the spread of an intrusion.
- Employee training against AI-enhanced phishing and social engineering.
- Offline, tested backups and a rehearsed incident-response plan.
- AI-assisted monitoring and threat detection where appropriate.
- The NCSC urges organisations to use existing tools, standards and frameworks that are proven to protect against both conventional and AI-powered attacks.
The future of cybersecurity
The next phase of cybersecurity may involve increasingly autonomous cyber operations, in which AI systems conduct reconnaissance, exploitation and defence with limited human involvement. That could make attacks faster and more scalable, while complicating attribution and accountability.
International cooperation, AI governance and investment in resilience will therefore be essential. As AI makes cyberattacks faster and more scalable, can businesses and governments deploy defensive AI quickly enough to protect the infrastructure on which modern society depends?
