LONDON — Britain should prepare for an AI-powered cyberattack on its critical national infrastructure within the next two years, the United Kingdom's National Cyber Security Centre (NCSC) warned on Tuesday, 3 November 2026, saying China was likely the best equipped to carry out such operations.
The warning, set out in the NCSC's annual report and in a speech by its chief executive, Richard Horne, is one of the starkest assessments yet of how artificial intelligence is changing the cyber threat facing essential services. The centre said it was highly likely there would be a ransomware attack involving AI-powered malware by 2028 on the nation's critical infrastructure, and warned that hostile actors are set to use AI to increase the scale and efficiency of their operations over the same period.
Illustration: A digital shield protecting power lines, servers and a city skyline from streams of malicious code. This is an illustration, not a photograph of a real event.
What Happened
The NCSC, which is part of the GCHQ intelligence agency, published its annual report on Tuesday, accompanied by a speech from Horne warning that Britain faces a real prospect of an unprecedented rise in the number of cyber incidents in the coming months. According to Reuters, Horne was expected to tell his audience that far too many organisations and supply chains in Britain had got away with "doing tech on the cheap" for decades, leaving them vulnerable.
"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," Horne was expected to say. "But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
The distinction matters. The NCSC is not saying that AI has suddenly created an entirely new kind of attack. Its argument, as reported by Reuters, is that AI makes it faster and cheaper to find and exploit weaknesses that already exist — in outdated software, poorly configured systems and supply chains that have not been properly secured. What once required time, skill and patience from a small number of specialists can now, the centre warns, be attempted at a scale that was previously unimaginable.
The annual report's headline judgement is deliberately precise. It says it is highly likely there will be a ransomware attack involving AI-powered malware by 2028 on the nation's critical infrastructure. In the language used by British intelligence assessments, "highly likely" is a strong judgement, not a certainty — but it is meant to be read as a planning assumption, not a distant possibility. Organisations responsible for essential services, the NCSC argues, should act as though such an attack is coming, rather than hoping it will not.
Horne also used the speech to name the states the NCSC regards as the most active threats. He was due to say that Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat. On China, his language was sharper still.
"We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces," he was expected to say, according to Reuters.
Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malevolent cyber actions in the past, Reuters noted. The NCSC's assessment is therefore best understood as the British government's own public judgement about intent and capability, not as an allegation that any specific incident has been conclusively attributed in public on this occasion.
Background
The NCSC sits within GCHQ, Britain's signals-intelligence agency, and acts as the country's technical authority on cyber security, advising government, businesses and operators of essential services. Its annual report is one of the few regular public windows into how the agency sees the threat landscape, and its warnings tend to be carefully worded — which is why Tuesday's language about a "highly likely" AI-powered ransomware attack by 2028 has drawn attention.
Critical national infrastructure is a broad term. In general usage it covers the systems a country cannot function without: energy generation and distribution, water supplies, transport networks, health services, food supply chains, financial services and communications. An attack on any of these does not need to destroy physical equipment to cause serious harm. If ransomware locks the computer systems that schedule deliveries, manage patient records, control payments or coordinate logistics, the real-world effects can appear quickly — empty shelves, delayed services and businesses unable to operate.
That context helps explain Horne's warning about what happens if organisations fail to act. He said organisations needed to take urgent action now, or explain why "when food isn't on shelves, lights aren't on, businesses have gone under ... that we saw the warning signs, understood the risks and still didn't make the right choices," Reuters reported.
The report and speech come after hacking attacks on supermarkets across Europe exposed vulnerabilities in IT systems, Reuters noted. Those incidents, while not the subject of the NCSC's headline warning, illustrate the point Horne was making: modern food retail depends on complex, interconnected IT systems, and when those systems are disrupted, the consequences are visible to ordinary shoppers within hours. The NCSC's argument is that the same dependence exists across other essential sectors, and that AI now gives attackers a more powerful tool for probing it.
Illustration: Analysts in a security operations centre monitoring network maps and warning alerts. This is an illustration, not a photograph of a real event.
Ransomware, the type of attack at the centre of the warning, typically works by encrypting an organisation's data and demanding payment for its release, often combined with the threat of leaking stolen data. AI-powered malware, as the NCSC describes the emerging risk, would use AI to make that process faster and more adaptive — for example, by scanning networks more quickly for weak points, tailoring phishing messages more convincingly, or adjusting its behaviour to evade detection. The NCSC's point is not that defenders are helpless, but that the speed and scale of the attacker's side of the contest is increasing.
Britain is not alone in issuing such warnings. Governments and cyber agencies around the world have spent the past two years grappling with the same question: how to defend systems that were built for a slower, less automated threat environment against adversaries who can now automate reconnaissance, exploit development and social engineering. The NCSC's contribution is to put a timeframe on it — within two years, and by 2028 for the specific ransomware scenario — and to tie it explicitly to underinvestment in basic cyber hygiene over decades.
Why It Matters
The warning matters for three reasons. First, it reframes AI in cyber security from a future risk to a near-term planning problem. A two-year horizon is short in infrastructure terms: replacing legacy systems, patching supply chains and training staff cannot be done overnight, and the NCSC is effectively telling boards and ministers that the time to start — if they have not already — is now.
Second, it puts the spotlight on the supply chain. Horne's criticism of organisations that have been "doing tech on the cheap" points not only at the operators of power stations or hospitals themselves, but at the web of suppliers, contractors and software providers they depend on. An attacker does not need to breach the most heavily defended target directly if a smaller supplier with access to its systems offers an easier route in. Securing that chain, the NCSC argues, is now as important as securing the core network.
Third, the warning sharpens a geopolitical argument. By singling out China as the actor best positioned to use AI against British critical infrastructure, and by describing its activity as the most sophisticated and sustained cyber challenge the UK faces, the NCSC is signalling where it believes the most capable threat comes from — even as it also flags sustained Russian attempts against military networks and Iranian operations globally. That assessment will feed into diplomatic conversations and into decisions about which partnerships, technologies and supply chains Britain trusts with its most sensitive systems.
For ordinary people, the practical stakes are less abstract than the language of "critical infrastructure" can sound. If the systems behind electricity distribution, water treatment, transport timetables, hospital administration or supermarket logistics are disrupted, the effects are felt in daily life — not in a server room. Horne's choice of examples, food on shelves and lights staying on, was deliberate: it translates a technical warning into the services people notice when they stop working.
For businesses, the warning also carries a governance message. Cyber security is often treated as an IT cost to be minimised. The NCSC is arguing the opposite: that years of minimising that cost have created the very vulnerabilities AI can now exploit at scale, and that leaders who continue to defer investment may find themselves having to explain their choices after an incident, not before one.
What Happens Next
In the immediate term, the NCSC's message is a call for urgent action rather than a prediction of a specific incident on a specific date. Organisations operating essential services are expected to review their defences, patch known vulnerabilities, test their incident-response plans and scrutinise their suppliers — the unglamorous work of cyber hygiene that Horne argues has been neglected for too long.
The two-year window also sets a test for the government itself. If the NCSC's assessment is correct, the period to 2028 will show whether warnings of this kind translate into investment and reform, or whether they are noted and filed away. Future annual reports will, in effect, grade that response: the number and severity of incidents, and whether AI-powered ransomware reaches critical infrastructure as warned, will be measured against Tuesday's judgement.
Diplomatically, the naming of China, Russia and Iran is likely to draw formal responses, as similar assessments have in the past. All three governments have previously denied accusations of malicious cyber activity, and there is no indication in the Reuters reporting that any of them has accepted the NCSC's latest characterisation. The public attribution debate will continue alongside the technical work of defence.
Illustration: A padlock formed from circuit patterns over a map of the United Kingdom, symbolising national cyber defence. This is an illustration, not a photograph of a real event.
For the wider public, the most useful response is less dramatic than the warning sounds: keep software updated, use strong and distinct passwords with multi-factor authentication where available, and treat unexpected messages asking for credentials or payments with suspicion. Those habits do not stop a state-level attack on a power grid, but they do reduce the everyday routes — especially phishing — through which many intrusions begin.
The NCSC's warning does not say an AI-powered attack on British critical infrastructure is inevitable tomorrow, nor does it claim one has already happened. It says the conditions for one are now in place, the timeframe is short, and the vulnerabilities are known. Whether Britain meets that warning with the urgency Horne demanded will determine whether the prediction reads, in two years' time, as a warning heeded or a warning ignored.
Sponsored: explore today's featured sponsored offers
FAQ
What exactly did the NCSC warn about?
Britain's National Cyber Security Centre said on 3 November 2026 that the country should prepare for an AI-powered cyberattack on its critical national infrastructure within two years, and that a ransomware attack involving AI-powered malware by 2028 on such infrastructure was highly likely.
Who is Richard Horne?
Richard Horne is the chief executive of the NCSC, which is part of the GCHQ intelligence agency. He set out the warning in the centre's annual report and in a speech on Tuesday, 3 November 2026.
Why does AI make the threat worse, according to the NCSC?
According to Horne, AI has not invented new ways to attack, but it allows vulnerabilities that have been tolerated for too long to be discovered and exploited at a scale that was once unimaginable, increasing both the speed and efficiency of hostile operations.
Which countries did the NCSC name?
Horne said China was highly likely to have the intent and was best positioned to use AI against British critical infrastructure, described Russia as making sustained attempts to penetrate UK military networks, and said Iran was carrying out malicious cyber operations globally. All three governments have previously denied similar accusations, Reuters noted.
What should organisations do now?
The NCSC urged urgent action: fixing long-tolerated vulnerabilities, securing supply chains, patching systems and testing incident-response plans, rather than waiting to explain after an incident why food was not on shelves, lights were not on or businesses had gone under.
Sources
- Reuters, "UK must expect AI-powered attack on critical infrastructure within two years, report says," 3 November 2026.
- Reuters, via BusinessWorld Online, "UK must expect AI-powered attack on critical infrastructure within two years, report says," 3 November 2026.
Comments
Post a Comment