UK Cyber Warning Puts Infrastructure Risks and AI-Enabled Ransomware in Focus

AI may accelerate attacks on weaknesses already in place

The UK’s National Cyber Security Centre (NCSC) sees a high likelihood of ransomware involving AI-powered malware striking critical infrastructure by 2028. Its warning points to a familiar problem with a faster-moving threat: long-standing technology and supply-chain weaknesses may now be found and exploited at a much larger scale.

Richard Horne, the NCSC’s chief executive, said too many organizations and suppliers had relied for decades on cut-price technology, leaving systems vulnerable. In remarks scheduled for Tuesday, he was expected to warn of a sharp rise in cyber incidents in the coming months. His assessment was that artificial intelligence hasn’t created entirely new ways to attack systems; it can help hostile actors locate and exploit flaws that organizations have tolerated for years.

That distinction matters for organizations weighing their exposure. The report’s concern is not limited to a new type of malicious software. It also focuses on how AI could increase the speed, reach and efficiency of operations against existing weaknesses. A vulnerability that once took time to identify or exploit may become easier to target at scale, increasing pressure on organizations that depend on aging systems or on suppliers with weak technology controls.

Infrastructure and supply chains are part of the exposure

The NCSC report places critical infrastructure among the potential targets, while Horne also pointed to the risks created by weaknesses across organizations and their supply chains. That reach matters because essential services and businesses often depend on interconnected systems. A problem at one organization or supplier can therefore create disruption beyond the entity where the weakness began.

Horne warned that organizations need to act on known risks. He described the possible consequences in practical terms: food might not reach shelves, lights might go out, and businesses could fail. Those examples underline why cyber resilience is a business continuity issue as well as a technology concern. The effects of a serious incident can extend from disrupted operations to damaged supplier relationships and lost revenue.

Recent hacking incidents affecting supermarkets across Europe have already exposed weaknesses in IT systems, the report said. The NCSC’s warning adds a forward-looking concern: AI may make it easier for hostile actors to conduct operations at greater scale, while existing weaknesses remain unaddressed. The report says China is highly likely to have the intent and the strongest position to use AI against UK critical infrastructure and other strategic targets. It describes activity from China as the most sophisticated and sustained cyber challenge facing the UK.

The report also warns that hostile actors’ use of AI is expected to improve the scale and efficiency of their operations. It identifies China as best placed to use the technology in operations against UK infrastructure, while Horne was expected to say that Russia had made sustained efforts to penetrate UK military networks and that Iran had conducted malicious cyber operations globally, including against the UK and individuals it viewed as threats. Moscow, Beijing and Tehran have denied similar accusations in the past.

What the warning means for risk planning

The report’s 2028 assessment is a forecast, not a claim that a specific attack will occur on a set date. Still, it gives organizations a clear planning horizon. The NCSC describes an AI-powered ransomware attack on the nation’s critical infrastructure by that year as highly likely. For companies, the practical question is whether they know which systems and suppliers could interrupt essential operations, and whether they have plans for responding if those systems become unavailable.

For risk and insurance teams, the warning makes a useful case for checking how cyber exposures connect with operational dependencies. That review can start with the systems that keep a business running, the outside providers those systems rely on, and the steps available if access is lost or data is compromised. Organizations can also review their cyber incident response arrangements and make sure relevant staff know how to escalate a suspected incident. These are planning considerations; the report does not describe insurance terms, promise claim outcomes or predict premium changes.

Insurance professionals may also want to understand how clients describe their technology controls and supplier dependencies when assessing cyber risk. A changing threat environment can make those details more significant, especially where a business relies on systems that are difficult to replace quickly. The NCSC warning does not establish how any insurer will price or cover a particular exposure. Policyholders should review their own policy wording and discuss questions about coverage with their insurer or broker.

Horne’s central message was that organizations have seen the warning signs and understand the risks, but still need to make better choices. The report frames AI as an accelerator of existing weaknesses, which leaves organizations with a practical task: identify the systems and suppliers that matter most, address known vulnerabilities, and prepare for disruption before the technology makes those weaknesses easier to exploit.