UK's NCSC judges AI-powered ransomware on critical infrastructure 'highly likely' by 2028

The UK's National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026, titled "The State of the Cyber Nation", on November 3. Covering the agency's tenth year, from September 2025 to August 2026, the report's starkest assessment concerns artificial intelligence: the NCSC judges it highly likely that, between now and 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI).

A forecast, not an incident

The wording matters. Under the probability scale used by UK intelligence analysts, "highly likely" corresponds to roughly an 80–90% chance. As Tech Insider points out, it is a forecast; the NCSC is not reporting that such an attack has already happened. The review also judges that hostile use of AI will very probably make ransomware, social engineering and the exploitation of vulnerabilities faster and more efficient over the next two years. At the same time, the NCSC's incident team says none of the AI use it has observed so far enabled a new class of attack, according to FourWeekMBA's reading of the report.

Chief executive Richard Horne argued that weaknesses tolerated for years could now be exploited at a scale that once seemed unimaginable, and said the UK had long been "doing tech on the cheap".

Money for AI-based defence

The review sits alongside spending the Treasury set out ahead of last week's Budget. According to The Next Web, this includes £60m for the first phase of a national Cyber Shield, built with the UK security industry to develop agentic defence capabilities and including a £25m challenge fund, and £70m for a National Exposure and Real-Time Vulnerability (NERV) Centre that will use AI tools to find weaknesses across critical infrastructure and the wider economy. The NCSC will also open an AI Cyber Security Centre of Excellence in Manchester to train government cyber and AI specialists; no budget for it has been given.

What the numbers show

FourWeekMBA, citing the review, reports that the NCSC received 1,831 reports in the year to August 2026, of which 337 required its support and 80 were classed as nationally significant, compared with 204 in the previous review. The NCSC cautions that its reporting does not follow a simple year-on-year trend, and the figures cover only incidents brought to the agency, not every attack in the UK. The review also repeats a government estimate that malicious cyber activity costs UK organisations about £14.7bn a year.