Britain should expect a ransomware attack built with AI software against its national infrastructure inside two years. That is the judgement in the National Cyber Security Centre’s annual review, published Tuesday.
The agency, part of GCHQ, rated it highly likely that between now and 2028 AI-powered malware will appear in a ransomware attack on critical national infrastructure. Energy, transport, health, defence, food and finance all sit in that definition.
What AI actually changes
The review argues models speed up reconnaissance, help locate weak points in networks and write malicious code. Scale is where the concern sits, not novelty.
Russia and China are expected to use AI routinely against UK interests over the same period, with China assessed as the most capable.
The chief’s warning
Richard Horne, the agency’s chief executive, is due to tell the public that an unprecedented rise in incident volume may be months away rather than years.
Much of the report points at decades of tolerated weakness rather than a new class of attack. A flaw found in PHP last month, a language underpinning a large share of websites, was held up as an example of what machine-speed discovery now surfaces.
Surrey University’s Alan Woodward said the finding strengthens the case for states and companies securing frontier tooling of their own.
Forecasts are not incidents. No AI-crafted ransomware operation against UK infrastructure has been publicly attributed. The document sets a planning assumption, and the deadline it names is close enough to sit inside most infrastructure investment cycles.
