NCSC warns AI ransomware likely to hit UK infrastructure by 2028

The UK's national cyber authority has given itself a two-year deadline. Within that window, the National Cyber Security Centre judges an AI-powered ransomware attack on Britain's critical national infrastructure to be highly likely, according to its State of the Cyber Nation report published on 3 November.

The blame lands squarely on how British organisations have run their stacks. 'For decades, we have collectively got away with doing tech on the cheap,' said Dr Richard Horne, NCSC's chief executive. The report argues that AI changes the economics for attackers more than defenders: 'vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.'

Horne frames leaders as being at a 'moment of choice' on cyber investment, and sketches what failure looks like in deliberately literal terms, the kind of thing a minister would have to explain on television 'when food isn't on shelves, lights aren't on, businesses have gone under'.

The warning lands alongside spending. The government is putting £60 million into the first phase of a national Cyber Shield to develop 'agentic cyber defence capabilities' in partnership with the UK cyber security industry, £70 million into a National Exposure and Real-Time Vulnerability (NERV) Centre at NCSC, and setting up a new AI Cyber Security Centre of Excellence in Manchester. The sums are modest beside the problem the report describes.

The 2028 date now sits inside a run of state-level AI threat warnings on our regulation beat, and next to our tracking of real-world agentic incident claims such as the recent Chainalysis breach writeup. The State of the Cyber Nation covers NCSC's tenth year, 1 September 2025 to 31 August 2026.