The forecast

How AI could change ransomware against UK infrastructure

The NCSC rates AI-powered malware in a ransomware attack on UK critical infrastructure as highly likely by 2028. It has not yet seen AI enable a new class of attack.

Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources

A hooded figure at a desk with several monitors showing downloads in progress

The claim

What was actually said

The NCSC says AI-powered malware is highly likely to be part of a future ransomware attack on Britain's critical national infrastructure between now and 2028 [9]. The warning comes with its annual review and a separate assessment of how AI could change cyber threats over the next two years [9].

It did not give much detail about what form the malware might take [9]. That matters: the claim is a probability judgement, not a description of a known tool.

Seen and unseen

Observed activity against forecast

The NCSC separates what responders have seen from what it expects.

An industrial site with some buildings flagged in red and virus shapes above

Already observed

Responders have begun to see attackers using AI tools, but none of the observed uses enabled a new class of attack [7]. AI is being used to research targets, write convincing social engineering messages, find software flaws and develop exploit code [7].

A padlock beside a rising bar chart

Expected

The NCSC assesses that attackers will mostly use AI to improve existing operations rather than routinely hand complete attacks to autonomous systems [7]. Skilled operators gain the most, because they can check results and correct mistakes [7].

A globe in a wire frame with a padlock and coins around it

Possible, not predicted

In its pessimistic scenario for 2028 the NCSC considers an autonomous attacker acting beyond its operator's control, which it calls a realistic possibility [9]. The assessment describes its scenarios as plausible possibilities, not predictions [2].

A wireless signal above a padlock

Open tools

Security software turned around

The NCSC alluded to open source AI security tools, first built to help researchers, being repurposed for harm [9]. The Register reported researchers seeing widespread abuse of one such open source red-teaming platform in attacks on a UK registrar, Microsoft 365 tenants and others since July [9]. That example is the publication's reporting; the NCSC itself gave little detail [9].

A cloud with a secured dial at its centre

What changes for you

The defensive reading

Because the observed uses did not create a new class of attack, existing controls remain directly relevant [7]. The practical question is whether your controls hold up if the same attacks arrive faster and in greater volume. Start with what to do, and read how the NCSC expects the next two years to go.

Keep reading

Read next

A hooded figure holding up three different masks

The assessment

The NCSC's four key judgements and three scenarios for AI and cyber intrusion to 2028, summarised for UK security and risk leads.

Read the guide Software windows with bugs and a Computer Hacked warning

Patch wave

The NCSC expects AI to uncover a wave of software flaws and fixes. Its advice on patch priorities, exposure and automatic updates, explained.

Read the guide A clipboard of charts under a magnifying glass

Annual review

What the NCSC Annual Review 2026 reports: 80 nationally significant incidents, 337 needing NCSC support, 1,831 reports and how to read them.

Read the guide

How CyPro can help

Need a hand getting ready?

Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Talk to us Book a Free Consultation
Rocket launching from a cloud

Get ready

Need to know what this means for you?

The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.

See Cyber Incident Response Book a Free Consultation