UK Warns AI Cyber Threats Could Put Critical Infrastructure at Risk

Nov 6, 2026 · Original article ↗

Summary

The UK’s NCSC warned that AI-enabled attacks could threaten critical infrastructure by 2028. Government proposals include expanded cyber regulation, stricter reporting and new defense initiatives; experts emphasized fundamentals such as segmentation and data diodes.

Key points

The NCSC assessed it as highly likely that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028.
The NCSC also warned that nation-states may use AI to increase the speed and sophistication of cyberattacks, and that many systems will remain vulnerable.
In an NCC Group survey, 51% of MPs said their areas were not keeping pace with infrastructure threats, while 47% considered the UK unprepared for a major attack.
The Cyber Security and Resilience Bill, which is passing through Parliament, would cover data centers, managed service providers and certain critical suppliers, with stricter breach reporting and penalties.
The government announced £2.4 billion in subsidies to help smaller businesses obtain Cyber Essentials certification and plans for national vulnerability and AI-defense initiatives.
Experts recommended strengthening basic defenses, including protecting network edges, using data diodes for one-way data flows, segmenting networks and deploying realistic decoys.

Article Details

Event Type: UK government cybersecurity policy announcements and NCSC assessment of threats to critical national infrastructure
Impact: The NCSC assessed it as highly likely (80%–90%) that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028, and almost certain that many systems will remain vulnerable to AI-empowered attacks. These are forecasts, not reports of a confirmed attack. The Cyber Security and Resilience Bill, currently passing through Parliament, would expand regulatory coverage and introduce stricter breach-reporting requirements and penalties.

People

Graham TaylorOPSWAT director of defense strategy for Northern Europe; recommended protecting critical infrastructure network edges, including use of hardware-enforced data diodes where facilities only need to export monitoring data.Jack ChapmanKnowBe4 senior vice president of threat intelligence; commented on UK cybersecurity funding and emphasized cybersecurity fundamentals, including defenses against phishing and stolen credentials.Jacob KrellSuzu Labs senior director for secure AI solutions and cybersecurity; discussed network segmentation and the risks of delayed patching and inadequate defenses against lateral movement in critical infrastructure.John StrandOwner of Black Hills Information Security; advocated using realistic, dynamic decoys to divert AI agents attacking critical infrastructure.Katharina SommerHead of government affairs at NCC Group; commented on the gap between government action and demonstrated resilience and on the need for tested coordination between government and industry.Richard HorneNCSC CEO; described the Cyber Security and Resilience Bill as a vital step forward in a speech announcing the agency's Annual Review 2026.

Countries

Chinawill have been used in a ransomware attack on UK CNI." It also labeled "highly likely" the prospect that "China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals" in the Russiabeen used in a ransomware attack on UK CNI." It also labeled "highly likely" the prospect that "China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals" in the country.United KingdomAt various levels of the United Kingdom government, officials are warning about the threat of cyberattacks against its critical infrastructure.

Industries

Critical infrastructureAt various levels of the United Kingdom government, officials are warning about the threat of cyberattacks against its critical infrastructure.GovernmentAt various levels of the United Kingdom government, officials are warning about the threat of cyberattacks against its critical infrastructure.