The United Kingdom's National Cyber Security Centre has issued a stark warning that hostile actors are "highly likely" to use AI-powered malware in ransomware attacks against the country's critical national infrastructure by 2028.
In its annual State of the Cyber Nation report published on 3 November, the NCSC said AI is not creating entirely new attack methods but acting as a force multiplier, enabling criminals to identify targets, craft phishing messages, uncover vulnerabilities, and develop exploits with much greater speed and scale.
NCSC chief executive Richard Horne warned: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
Horne added that for decades the UK has "collectively got away with doing tech on the cheap" and urged organizations to invest properly in technology, limit unnecessary internet exposure, and treat the government's Cyber Essentials certification as a starting point rather than an end goal.
To strengthen defences, the UK government has committed £60 million to the first phase of a national Cyber Shield, £70 million to a new National Exposure and Real-Time Vulnerability Centre, and will establish an AI Cyber Security Centre of Excellence in Manchester run by the NCSC.
The report cites existing evidence of AI-assisted intrusions. In October, CrowdStrike documented China-linked Vapor Panda using ARTEX against more than 200 organisations across at least 14 countries, though post-exploitation was confirmed in only nine. Sophos found that Aur0ra ransomware operators used Cursor and other AI models to explore compromised networks and gain administrator privileges with little human supervision. CrowdStrike's 2026 threat report said AI-enabled attacks rose 89% in 2025.
Meanwhile, Google's Threat Intelligence Group reported in May that cybercriminals had used an AI model to find and weaponize a previously unknown flaw, bypassing two-factor authentication in a popular open-source administration tool. A Cambridge University study of more than 90,000 cybercrime forum threads found most criminals were still using AI mainly for spam and phishing.
The warning arrives as global AI cybersecurity spending is projected to grow from $51.3 billion in 2026 to $86 billion in 2027, according to Gartner. A World Economic Forum survey found 87% of respondents saw AI-related vulnerabilities as the fastest-growing cyber risk in 2025, and 94% expected AI to have the greatest impact on cybersecurity in the coming year.
