The assessment
The NCSC's AI and cyber intrusion assessment, summarised
The NCSC's assessment sets out four judgements and three scenarios for 2028. It is a threat forecast, and it says the potential for surprise is high.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
Judgements
The four headline findings
The assessment, published on 3 November 2026, examines current AI-enabled threat trends and projects the threat to 2028 [2]. Its key judgements are:
- By 2028 it is highly likely that Russia, China and other states will routinely use AI-enabled cyber tools for geopolitical goals, increasing the scale and speed of sophisticated attacks on the UK [2].
- By 2028 it is almost certain that many systems will remain vulnerable to AI tools that find and exploit weaknesses [2].
- By 2028 it is likely that attackers will target known vulnerabilities in legacy critical infrastructure and new attack surfaces created by AI deployment [2].
- It is highly likely that, before 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure [2].
Scenarios
Three versions of 2028
The NCSC describes three scenarios and is clear that they are not predictions [2].
Baseline: a higher global threat
Threat levels rise and states, especially China and Russia, remain the main threat. Defence in critical infrastructure lags behind offence [2].
Pessimistic: proliferation outstrips defence
Optimistic: development slows
AI-cyber development slows, giving the UK time to replace legacy systems and build skills [2].
How to use it
Plan for the range
Treat the three scenarios as a stress test. If your plans only work in the optimistic version, they are too thin. The common thread in every scenario is legacy technology and unpatched systems, which is where end-of-life systems and patch wave preparation come in.
A note on probability words
The assessment uses the intelligence community's probability yardstick, where "almost certain", "highly likely" and "likely" carry defined ranges [2]. Read them as calibrated judgements, not as loose adjectives.
Keep reading
Read next
Patch wave
The NCSC expects AI to uncover a wave of software flaws and fixes. Its advice on patch priorities, exposure and automatic updates, explained.
Read the guide
Annual review
What the NCSC Annual Review 2026 reports: 80 nationally significant incidents, 337 needing NCSC support, 1,831 reports and how to read them.
Read the guide
Four routes
Public-facing apps, phishing, valid accounts and external remote services: the four routes behind 88% of incidents at large organisations.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.