Latest
Annual Review 2026 published[3]
The review covers 1 September 2025 to 31 August 2026, the NCSC's tenth year as part of GCHQ.
NCSC warning, 3 November 2026
What the NCSC's AI attack warning means for UK organisations
The NCSC says AI-powered malware is highly likely to feature in a ransomware attack on UK critical infrastructure by 2028. It has not seen AI create a new kind of attack, so the defence is largely the basics, done faster.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
At a glance
- 2028
- Year by which AI-powered malware is highly likely to have featured in a ransomware attack on UK critical infrastructure[9]
- 88%
- Of incidents at large organisations that used one of four initial access routes[7]
- 80
- Nationally significant incidents the NCSC handled in its latest reporting year[7]
- 75%
- Discount on a first Cyber Essentials certificate for micro, small and medium-sized businesses[9]
The latest
AI Attack Guidance: what has happened so far
Newest first. Each entry links to its source.
Assessment looks ahead to 2028[2]
The NCSC publishes Artificial intelligence and cyber intrusion, with a baseline, a pessimistic and an optimistic scenario to 2028.
NCSC chief warns of AI-powered attacks[6]
Dr Richard Horne says the UK will likely face AI-enabled attacks on critical infrastructure by 2028 and urges leaders to invest with urgency.
In brief
The warning in three answers
What was said, what has actually been seen and what it asks of you.
What the NCSC said
On 3 November 2026 the National Cyber Security Centre published its Annual Review 2026 and an assessment of AI and cyber intrusion [3][2]. Its chief executive, Dr Richard Horne, said the UK will likely face AI-enabled attacks on critical infrastructure by 2028 [6]. The assessment treats it as highly likely that AI-powered malware will feature in a ransomware attack on this sector between now and 2028 [9].
What has been seen so far
NCSC responders have started to see attackers use AI tools, but none of the observed uses enabled a new class of attack [7]. AI is helping attackers research targets, write convincing messages, find software flaws and develop exploit code more efficiently [7]. The forecast about critical infrastructure is a forecast, not an incident that has already happened [7].
Why it matters
Old weaknesses, newer speed
The warning is less about new techniques than about speed. Dr Horne said AI means long-tolerated weaknesses can be found and used at a scale that was once unimaginable [9]. His summary of the problem was blunt: "For decades, we have collectively got away with doing tech on the cheap." [9]
The routes in have not changed
Across large organisations in the NCSC's incident data, 88% of incidents used one of four initial access routes: public-facing applications, phishing, valid accounts and external remote services [7].
Start here
Where to go next
Not every page is for every reader. Pick the one that matches your question:
- Who the warning applies to, sector by sector.
- What to do, in a sensible order.
- How AI could change ransomware, and what the NCSC does and does not claim.
- Preparing for a patch wave, if you run internet-facing systems.
What to do
Four things to do first
-
1
Shrink what faces the internet
IT and security teams
-
2
Prepare for a patch wave
IT operations
-
3
Tighten accounts and remote access
Identity and infrastructure teams
-
4
Protect backups and rehearse your response
IT leads and incident owners
There are eight steps in all, with who does each one. See every step
Quick answers
Questions people ask
What did the NCSC say about AI cyber attacks?
On 3 November 2026 the NCSC said AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure between now and 2028[9]. Its chief executive said the UK will likely face AI-enabled attacks on critical infrastructure by 2028[6].
Has an AI-powered ransomware attack already happened?
The NCSC's warning is a forecast, not confirmation that such an incident has happened[7]. Responders have seen attackers use AI tools, but none of the observed uses enabled a new class of attack[7].
Does this apply to my business if I am not critical infrastructure?
The strongest warning concerns critical infrastructure, but the advice is for all organisations, scaled to size, complexity and risk[9]. The four access routes behind 88% of incidents at large organisations are common to many sectors[7].
Coming up
2028
End of the period in which AI-powered malware is highly likely to feature in a ransomware attack on UK critical infrastructure[2]
About this site
Primary sources, dated
The CyPro Consulting Ltd team maintains this site. Every version, date and figure comes from 5 named sources, including National Cyber Security Centre, SecurityWeek, Cyber Security News, and links to the one it came from. Last checked 4 November 2026.
Who we are and how pages are kept currentStart here
The guides, in the order to read them
Who is affected
Which UK organisations the NCSC's AI warning points at, from critical infrastructure to small businesses, and how to tell where you sit.
Read the guide
Key dates
The dates that matter in the NCSC's AI warning, from the May patch wave advice to the 3 November review and the 2028 horizon.
Read the guide
What to do
A practical order of work for UK organisations preparing for AI-assisted ransomware, based on the NCSC's advice. Start with what you expose.
Read the guide
Questions
Short, sourced answers on the NCSC's warning of AI-powered ransomware against UK critical infrastructure by 2028 and what organisations should do.
Read the guideGo deeper
In depth AI ransomware 
In depth The assessment 
In depth Patch wave 
In depth Annual review 
In depth Four routes 
In depth Shadow AI 
In depth Cyber Essentials 
In depth Funding 
In depth Legacy systems 
In depth Response plan How CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.