The National Cyber Security Centre, the public-facing arm of GCHQ, has issued its starkest warning yet: AI-powered malware will "highly likely" be used in a ransomware attack against UK critical national infrastructure before 2028. The assessment, published in NCSC's annual review, names Russia and China as state actors expected to deploy AI "routinely" in cyber operations. NCSC chief Richard Horne will say publicly that an "unprecedented rise in cyber incidents" is coming within months. The mechanism is straightforward. AI accelerates every stage of ransomware operations — target scouting, vulnerability discovery, and malicious code generation. The threat is not that AI creates fundamentally new attack categories, but that it collapses the time and skill required to execute existing ones. Last month, AI discovered a critical flaw in PHP, a language underpinning roughly 70% of the world's websites, illustrating the technology's capacity to surface vulnerabilities that human auditors missed for years. Ransomware is already the signature weapon of criminal hacking gangs, typically operating from former Soviet states. Royal Mail, outsourcing firm Capita, and multiple UK councils have been hit. AI lowers the barrier to entry for these operations while simultaneously increasing their scale and sophistication. The NCSC assessment frames this as an acceleration of an existing trend, not a phase change — but the acceleration is steep enough to warrant the "highly likely" threshold. Horne's speech will also address persistent daily attacks on British military communications networks, attributed in part to Russia. Moscow's operations are described as "notable campaigns" that "intentionally fall below the threshold of armed conflict" — hybrid warfare by design, calibrated to avoid triggering Article 5 or equivalent responses while steadily degrading trust and operational confidence. The deeper structural problem NCSC identifies is not AI itself but decades of infrastructure underinvestment. "For decades we have collectively got away with tech on the cheap," Horne will say. The recent hack of European supermarket fridges — temperatures raised above 50°C by attackers — illustrates the cascading consequences when operational technology is connected to networks without adequate resilience. AI doesn't create the vulnerability; it finds and exploits the ones that accumulated while budgets were cut. The government's response spans two registers. The Be Ready campaign urges citizens to stockpile nine litres of water and three days' food — individual resilience against systemic fragility. Meanwhile, cybersecurity professor Alan Woodward argues that access to cutting-edge AI for defenders is the decisive variable: "If we don't get the access the bad guys will beat them to it." OpenAI and Anthropic have granted some organisations early access to powerful models for vulnerability identification, but the distribution of defensive AI capability remains narrow and ad hoc. The honest diagnosis is that the UK faces a self-inflicted asymmetry. Attackers need only find one weakness; defenders must patch all of them. AI dramatically favours the attacker in this equation unless defensive deployment is fast, broad, and funded at a level that decades of "tech on the cheap" suggest is unlikely. The 2028 timeline is less a prediction than a countdown clock measuring how long existing neglect can hold before AI-accelerated adversaries find the seams.
