The United Kingdom has issued a significant warning about the growing cybersecurity risks associated with artificial intelligence, with its National Cyber Security Centre (NCSC) assessing that AI-powered malware is highly likely to be used in a ransomware attack against British critical national infrastructure by 2028.
The warning was published on November 3, 2026, as part of the NCSC’s latest State of the Cyber Nation assessment.
The agency says artificial intelligence could increase the scale and efficiency of cybercriminal operations, making it easier for attackers to identify existing vulnerabilities, conduct social engineering campaigns and carry out ransomware attacks.
The assessment highlights a growing concern for governments and businesses: older technology systems that have remained vulnerable for years could become easier targets as attackers gain access to increasingly capable AI tools.
NCSC Warns of Increasing AI-Enabled Cyber Threats
The NCSC, which operates as part of Britain’s signals intelligence agency GCHQ, believes hostile actors will increasingly use artificial intelligence to improve their cyber operations.
According to its assessment, AI could make several existing forms of cybercrime more effective.
These include ransomware, social engineering and vulnerability exploitation.
One important distinction in the report is that AI does not necessarily need to invent completely new methods of attacking computer systems.
Instead, it can help criminals discover and exploit weaknesses that already exist.
For example, an organisation might continue operating outdated software, exposed internet-facing services or poorly maintained infrastructure.
Such weaknesses may have remained unnoticed or difficult to exploit at scale.
AI-assisted tools could help attackers identify these vulnerabilities more quickly and automate parts of the process.
The NCSC believes this could increase the number and efficiency of attacks against organisations that have not invested sufficiently in cybersecurity.
Recent Supermarket Refrigeration Attacks Highlight Infrastructure Risks
The warning comes after cyberattacks affected supermarket refrigeration systems in parts of Europe.
Reuters reported that attacks targeting supermarket fridges and freezers across countries including Sweden, Belgium and France exposed weaknesses in older IT systems.
The disruption resulted in stores having to discard food.
Britain’s cybersecurity chief Richard Horne described the incident as an early indication of the disruptions that could occur when technology infrastructure is not properly maintained.
Importantly, the NCSC and Reuters reporting do not establish that these particular refrigeration attacks required advanced AI tools.
Instead, the incidents demonstrate how existing vulnerabilities in connected infrastructure can create operational problems.
This distinction matters because the future AI threat is partly about increasing the speed and scale at which known weaknesses can be discovered and exploited.
Critical infrastructure includes systems supporting electricity, transportation, food distribution, healthcare, communications and other essential services.
Disruptions in these areas can have consequences far beyond the computers directly affected.
Why Artificial Intelligence Changes the Cybersecurity Landscape
Artificial intelligence is increasingly becoming a tool for both cybersecurity professionals and malicious actors.
Security teams can use AI to analyse logs, identify unusual activity, investigate vulnerabilities and prioritise potential threats.
However, attackers can also use AI to improve their operations.
Automated analysis may help criminals examine large numbers of systems, identify vulnerable software and create more convincing social engineering campaigns.
AI tools can also reduce the technical effort required for certain activities, potentially allowing less experienced attackers to perform tasks that previously required more specialised knowledge.
The NCSC is particularly concerned about the speed at which these capabilities could spread.
A weakness that once required significant manual research might become easier to identify across many systems.
This could place additional pressure on organisations that already struggle to update software, monitor networks and maintain secure infrastructure.
UK Government Announces Additional Cybersecurity Investment
The UK government is also investing in new capabilities to improve national cyber resilience.
According to the NCSC announcement, the government has outlined funding that includes £60 million for the first phase of a national Cyber Shield initiative.
It has also announced £70 million for a National Exposure and Real-Time Vulnerability Centre, known as NERV, intended to help identify vulnerabilities across critical infrastructure and the wider economy.
An AI Cyber Security Centre of Excellence is also planned in Manchester under the NCSC.
These initiatives reflect the growing importance of combining artificial intelligence with defensive cybersecurity capabilities.
However, technological investment alone cannot eliminate security weaknesses.
Organisations must also maintain their existing systems, establish clear security policies and ensure that employees understand their responsibilities.
What Businesses Should Do Now
The NCSC has urged organisations to stop treating cybersecurity as an optional expense.
Its recommendations include addressing outdated technology, reducing unnecessary internet exposure and using established cybersecurity standards.
Businesses should consider several practical measures.
First, they should identify internet-facing systems and remove services that do not need external access.
Second, organisations should establish reliable patch-management procedures to ensure that security vulnerabilities are addressed promptly.
Third, administrator accounts should receive appropriate restrictions, with unnecessary privileges removed.
Companies should also maintain tested backups, monitor suspicious network activity and develop incident-response procedures.
Organisations using AI tools internally should additionally establish policies governing confidential information and employee access.
Small businesses should not assume that they are unlikely targets simply because they are smaller than major infrastructure operators.
Compromised smaller organisations can also create opportunities for attackers to reach suppliers, partners and larger networks.
The Road to 2028
The NCSC’s assessment should be understood as a threat forecast rather than confirmation that a particular attack will occur on a specific date.
Its warning is that AI-powered malware is highly likely to feature in a ransomware attack against UK critical national infrastructure by 2028.
The central concern is that existing security weaknesses may become easier to exploit as artificial intelligence advances.
For governments and businesses, the message is straightforward: cybersecurity investments must keep pace with technological change.
Artificial intelligence may improve the ability of defenders to identify threats, but organisations that continue relying on outdated systems and weak security practices could face increasingly serious risks.