AI-powered ransomware attacks are becoming a growing concern for cybersecurity experts in the UK. The National Cyber Security Centre (NCSC), which is part of GCHQ, has warned that AI-powered malware is highly likely to be used in a ransomware attack against the UK’s critical national infrastructure by 2028.
This does not mean an attack has already taken place or that every UK business is at risk of being targeted. The warning is about how AI could help cybercriminals carry out existing attacks more quickly and effectively, putting extra pressure on organisations with weak security.
For businesses, this is a reminder that cybersecurity involves more than installing antivirus software or other security tools. Companies also need to keep their systems updated, manage who can access sensitive information and have a clear plan for responding to cyber incidents.
What Did the UK NCSC Warn About?
On November 3, 2026, the NCSC published its latest State of the Cyber Nation report and an assessment of artificial intelligence and cyber intrusion.
The assessment says it is highly likely that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure between now and 2028.
The NCSC also expects hostile actors to use AI to increase the scale and efficiency of activities such as ransomware, social engineering and exploiting software vulnerabilities.
This is a forward-looking security assessment, not confirmation of a planned attack or a specific criminal operation.
The warning also highlights a wider problem: organisations may be leaving known security weaknesses unresolved for too long. AI could help attackers identify and exploit those weaknesses more quickly.
Source: UK National Cyber Security Centre – Artificial Intelligence and Cyber Intrusion
Why Are AI-Powered Ransomware Attacks a Concern?
Ransomware is a type of malicious software that can prevent an organisation from accessing its files or systems. Attackers may then demand payment to restore access or threaten to publish stolen information.
AI does not need to invent an entirely new type of cyberattack to make this threat more serious. It can potentially help criminals improve parts of existing attacks, including research, communication and vulnerability discovery.
Here are three areas that deserve attention.
1. Faster Discovery of Security Weaknesses
Many organisations still operate older software, outdated devices and systems that do not receive regular security updates.
AI-assisted tools could help attackers examine systems and identify weaknesses more efficiently. This may increase the pressure on organisations that take too long to install security updates or replace unsupported technology.
The NCSC has specifically highlighted the risk of AI being used to identify and exploit weaknesses in existing systems.
2. More Convincing Social Engineering
Social engineering involves manipulating people into revealing information, opening harmful files or taking actions that compromise security.
AI can help attackers produce convincing messages, adapt communication to different targets and create content at scale. This can make suspicious emails and other messages harder for employees to recognise.
For example, an employee might receive a message that appears to come from a manager or supplier. If the message requests an urgent payment or asks for login information, acting without verification could expose the organisation to fraud or account compromise.
3. More Efficient Ransomware Operations
Ransomware incidents can involve several stages, including gaining access to a network, moving between systems, identifying valuable information and disrupting operations.
AI could help attackers automate or speed up some of these activities. However, this does not mean every ransomware operation is fully autonomous or that AI can independently carry out every stage of an attack.
The NCSC’s concern is that AI may increase the efficiency and scale of existing cyber operations.
Why Is Critical National Infrastructure at Risk?
Critical national infrastructure refers to systems and services that are essential to the functioning of a country.
In the UK, this includes sectors such as:
- Energy and electricity
- Water and wastewater
- Healthcare
- Transport
- Telecommunications
- Digital infrastructure
- Financial services
A serious cyber incident affecting these services could create problems beyond the organisation directly targeted.
For example, an attack affecting an essential service could interrupt operations, delay services or create difficulties for businesses and the public that depend on it.
The NCSC’s warning specifically concerns UK critical national infrastructure. It should not be interpreted as a prediction that every company or household will experience a ransomware attack by 2028.
What Should Businesses Do to Reduce Ransomware Risks?
Businesses do not need to wait for AI-powered attacks to become more common before improving their cybersecurity. Many useful protections address weaknesses that attackers already exploit.
The following measures can help organisations improve their security.
| Security measure | Why it matters |
| Install security updates | Reduces exposure to known software vulnerabilities |
| Use multi-factor authentication | Adds another layer of protection to accounts |
| Restrict administrator access | Limits what compromised accounts can change |
| Maintain offline or isolated backups | Helps organisations recover after ransomware incidents |
| Train employees | Helps staff recognise phishing and suspicious requests |
| Monitor network activity | Can help identify unusual behaviour |
| Review third-party access | Reduces risks from suppliers and connected services |
| Prepare an incident response plan | Helps teams respond in an organised way |
These measures do not guarantee that an organisation will avoid an attack. However, they can reduce exposure and improve the ability to respond when something goes wrong.
Businesses should also consider the security of AI tools they use internally. If an AI system can access company files, business applications or customer information, its permissions should be limited to what it actually needs.
For a closer look at this issue, read our guide to AI Governance and Business Security.
Why Older Technology Can Create New Security Problems
One of the important points behind the NCSC warning is that AI could make existing weaknesses easier to discover and exploit.
Some organisations continue to rely on older systems because replacing them can be expensive or disruptive. In other cases, software updates are delayed because businesses are concerned about compatibility or operational downtime.
However, leaving known vulnerabilities unresolved can create long-term security risks.
Reuters reported that the NCSC chief also highlighted the dangers of outdated technology and insufficient investment in cybersecurity. The report discussed how weaknesses in connected systems can disrupt real-world services.
This is particularly important for infrastructure operators, where replacing or updating equipment may require careful planning.
Businesses should regularly review which systems are still supported, identify devices exposed to the internet and establish a clear process for applying security updates.
Is AI Only a Threat to Cybersecurity?
No. Artificial intelligence can also help organisations strengthen their security.
Defensive AI tools may assist security teams with analysing large volumes of alerts, identifying unusual activity and prioritising potential threats.
However, these tools are not a replacement for experienced security professionals, reliable procedures or properly maintained systems.
AI-generated alerts also need to be reviewed carefully. Poor configuration, incomplete information or incorrect results can lead to missed threats or unnecessary investigations.
The NCSC has also highlighted the opportunity to use AI to improve cyber defence, alongside its warnings about how hostile actors may use the technology.
This means businesses need to consider both sides of AI adoption: how attackers might use it and how security teams can use it responsibly.
What Does the 2028 Warning Mean for UK Businesses?
The NCSC warning is a reminder that cybersecurity needs to be treated as an ongoing business responsibility rather than a one-time technology purchase.
Large infrastructure operators may need to review legacy systems, network security and their ability to recover from major incidents. Smaller businesses should also take practical steps to protect their accounts, devices, customer information and backups.
The warning does not establish a new legal deadline requiring every UK business to complete a particular security upgrade by 2028. It is a threat assessment that organisations can use when reviewing their security plans.
Businesses that depend on suppliers, cloud services or connected systems should also understand how an incident affecting a third party could disrupt their own operations.
Final Thoughts
The UK’s warning about AI-powered ransomware attacks by 2028 highlights how artificial intelligence could change the scale and efficiency of cyber threats.
The concern is not simply that AI will create entirely new forms of malware. It is that attackers may use it to find weaknesses, improve social engineering and carry out existing cyber operations more efficiently.
For businesses, the most useful response is to strengthen the basics: update systems, limit access, protect backups, train employees and prepare for security incidents.
AI may change how cyberattacks are carried out, but strong security practices remain an important part of protecting organisations.
Frequently Asked Questions
1. What did the UK warn about regarding AI-powered ransomware?
The UK’s National Cyber Security Centre assessed that it is highly likely AI-powered malware will be used in a ransomware attack against UK critical national infrastructure between now and 2028.
2. Has an AI-powered ransomware attack already hit UK critical infrastructure?
The NCSC assessment is a warning about a likely future threat. It does not report that the predicted AI-powered ransomware attack has already happened.
3. Why could AI make ransomware attacks more dangerous?
AI could help attackers identify software weaknesses, create convincing social engineering messages and improve the efficiency of some cyber operations. It may increase the speed and scale of existing threats.
4. Which UK sectors could be affected by ransomware attacks?
Critical national infrastructure includes sectors such as energy, water, healthcare, transport, telecommunications and digital infrastructure. A serious incident could disrupt services that businesses and the public depend on.
5. How can businesses protect themselves from AI-powered cyberattacks?
Businesses should keep software updated, use multi-factor authentication, restrict administrator permissions, maintain secure backups, monitor suspicious activity and train employees to recognise phishing attempts.
Sources
- UK National Cyber Security Centre – Artificial Intelligence and Cyber Intrusion
- https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
- Reuters – UK Must Expect AI-Powered Attack on Critical Infrastructure Within Two Years
- Associated Press – UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
