NCSC Assessment Projects AI-Enabled Cyber Threats to the UK Through 2028
Summary
An NCSC assessment outlines three possible AI-cyber threat scenarios through 2028, forecasting increased attacks on the UK and its critical infrastructure while emphasizing that the scenarios are plausible possibilities, not predictions.
Key points
- The assessment examines AI-enabled cyber threats to the UK through 2028 using baseline, pessimistic and optimistic scenarios; it says these are possibilities, not predictions.
- NCSC judges that nation states are likely to routinely use AI-cyber capabilities by 2028, increasing the scale and speed of sophisticated attacks.
- The assessment expects AI tools to accelerate vulnerability discovery and exploitation, while inadequate configuration and slow patching could leave systems exposed.
- UK critical national infrastructure may face attacks exploiting known weaknesses in legacy technology and expanded attack surfaces from AI deployment.
- NCSC assesses that AI-powered malware is likely to be used in a ransomware attack on UK critical national infrastructure by 2028.
- The optimistic scenario describes stronger defenses through modernization, workforce education, effective security measures and proactive AI regulation.
Article Details
- Publisher
- NCSC Assessment (NCSC-A), NCSC
- Report Period
- Current trends and projections through 2028
- Scope
- UK AI-enabled cyber threat trends and three scenarios for the threat landscape through 2028
- Key Statistics
- The assessment presents three scenarios: baseline, pessimistic, and optimistic.
- The assessment identifies five drivers likely to influence the AI-cyber threat to the UK in 2028.
- Recommendations
- Evolve patching and testing processes to keep pace with accelerating vulnerability discovery.
- Configure defensive AI technologies correctly and deploy them widely.
- Replace ageing legacy systems in UK critical national infrastructure.
- Educate the workforce on AI and cybersecurity, and apply standard cybersecurity measures promptly and consistently.
Countries
ChinaBy 2028, it is highly likely that Russia, China and other nation states will routinely use AI-cyber to achieve their geopolitical goals, with the UK facing an increase in scale and speed of sophisticated cyber attacks.RussiaBy 2028, it is highly likely that Russia, China and other nation states will routinely use AI-cyber to achieve their geopolitical goals, with the UK facing an increase in scale and speed of sophisticated cyber attacks.United KingdomNCSC Assessment (NCSC-A) is the authoritative voice on the cyber threat to the UK. We combine source information – classified intelligence, industry knowledge, academic material and open source – to provide independent
Industries
Civil societyThe UK faces a significant increase in cyber attacks targeting its CNI, industry, government and civil society.Critical infrastructureit is likely that attackers will apply AI-cyber capability against known vulnerabilities in critical national infrastructure (CNI) legacy technology, and the new opportunities in the attack surface which theGovernmentkey judgements that inform policy decision making, to improve UK cyber security. We work closely with government, industry and international partners for expert input into our assessments.