UK NCSC annual review rates AI-enabled ransomware against critical infrastructure 'highly likely' by 2028; 80 nationally significant incidents

Familiar methods, with AI changing speed and scale

The review judges that AI is unlikely to change hostile actors' goals but highly likely to increase the speed, scale and efficiency of their operations. The incident-management team has begun to see attackers incorporating AI tools, yet none of the observed uses enabled a novel class of attack; each accelerated an existing method. The 2028 assessment therefore rests on familiar means, ransomware, social engineering and vulnerability exploitation, being amplified by AI.

Most successful compromises relied on known vulnerabilities in internet-facing systems, stolen credentials and social engineering. Several incidents were linked to state or state-aligned actors; some exploited unknown vulnerabilities, but many used flaws that had been patched but not deployed. Horne said in his speech that, because long-tolerated vulnerabilities can now be discovered and exploited with AI, the UK faces 'a real prospect of an unprecedented rise in the number of cyber incidents' in the coming months.

337 incidents and the placing of China and Russia

The incident-management team received 1,831 reports of attacks over the period, supported 337 incidents after triage and classed 80 as nationally significant. It notified about 8,500 organisations of suspected compromise through the Early Warning service. The review gives no year-on-year comparison, explaining that incident reporting does not follow a simple annual trend and that earlier peaks were tied to a small number of especially significant incidents. Media reports cited government research putting the economic cost of cyber attacks at about £14.7 billion a year.

Horne said China highly likely has the intent, and is best positioned, to use AI for operations against critical national infrastructure, calling its activity 'the most sophisticated and sustained cyber challenge the UK faces'. He cited Russian campaigns that intentionally fall below the threshold of armed conflict, and said Iran continues malicious operations globally, including against the UK and individuals it regards as threats to the regime. North Korea does not appear in the speech.

Cyber Shield and the Manchester AI centre

The launch consolidated investments set out in the Chancellor's budget the week before: £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and an NCSC-run AI Cyber Security Centre of Excellence in Manchester. On the statutory side, the Cyber Security and Resilience Bill would set minimum resilience levels for critical infrastructure, with a National Cyber Action Plan to follow. Horne called for replacing end-of-life technology, isolating physical control systems from attackers and making passkeys the norm, and framed Cyber Essentials as the starting point rather than the end goal.