UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028

What it is

The UK National Cyber Security Centre (NCSC) published its annual cyber report, and its head, Richard Horne, gave a speech alongside it. The report judges that the UK will likely face AI-enabled attacks on critical infrastructure by 2028. The page does not give the publication date beyond "Tuesday".

How it works

The report says AI is highly likely to increase the scale and efficiency of hostile operations. It says AI is more likely to enhance and scale existing tactics than to find new kinds of vulnerability. Horne named AI-powered ransomware malware as one possibility. He also said AI will let long-tolerated vulnerabilities be found and exploited "at a scale that was once unimaginable".

The page gives one recent example. Governments and companies rushed out security updates after AI-assisted discovery of two critical flaws in a programming language that the page says is vital to 70% of websites. The page does not name the language or give CVE ids. It says the flaws could allow unauthenticated access and, in theory, remote control of a web server without a password.

Preconditions / Affected

Horne listed operational technology that automates physical processes: electricity switching, water sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls. He cited recent attacks on refrigeration systems in French supermarkets as proof that civilian infrastructure is easy to exploit.

The page also describes the threat actors:

• China: the "most sophisticated and sustained" challenge to the UK.
• Russia: runs campaigns below the threshold of armed conflict. The UK and EU states attributed the December 2025 Polish energy grid attack to its FSB, and say it could have cut power to 500,000 people in winter.
• Iran: attacks UK targets and individuals it sees as threats to the regime.

What to do

The NCSC's only concrete guidance is three basic measures:

• Keep devices up to date.
• Limit administrator access to systems.
• Back up important files and data.

Horne said leaders who skimp on security or leave out-of-date technology in place will have to explain outages to the public. Anne Keast-Butler, director of GCHQ, said every UK organisation should act now.

Caveats

The 2028 date is a forecast by the NCSC, not an observed event. The page gives no technical indicators, detection guidance or product-specific mitigations. It does not say how the report's cost figure of almost $20 billion a year was calculated.