Britain should prepare for a UK AI cyberattack on critical infrastructure within the next two years, the National Cyber Security Centre warned on Tuesday 3 November 2026. The warning came in the centre’s State of the Cyber Nation report, published the same day, alongside a speech by its chief executive, Dr Richard Horne. The report says AI-powered malware is highly likely to have been used in a ransomware attack on UK critical national infrastructure by 2028.
The NCSC is part of GCHQ, the UK signals intelligence agency, and its assessment carries weight because it draws on incidents reported across the country. The centre says hostile actors are highly likely to use AI to increase the scale and efficiency of their operations over the next two years. That includes ransomware attacks, social engineering and the exploitation of software vulnerabilities.
Quick Reference Summary Table:
| Item | Detail |
| Warning issued | Tuesday 3 November 2026, London |
| Issued by | National Cyber Security Centre (NCSC), part of GCHQ |
| Report | State of the Cyber Nation |
| Key forecast | AI-powered malware highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028 |
| Threats named | China, Russia and Iran, in different roles |
| Estimated annual cost | £14.7 billion a year from malicious cyber activity, per the NCSC via Computer Weekly |
| New funding announced | £60 million for the first phase of a national Cyber Shield; £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre |
| New centre | AI Cyber Security Centre of Excellence in Manchester, run by the NCSC |
What the NCSC’s State of the Cyber Nation actually says
The report does not claim that AI has created entirely new ways to attack the UK. Instead, it says AI is set to make existing attacks faster, larger and easier to run. Attackers can use AI to scout targets, find weaknesses in IT networks and write malicious code. The NCSC also warns of an unprecedented rise in cyber incidents in the coming months.
Horne put the point bluntly in his launch speech, saying vulnerabilities tolerated for too long can now be discovered and exploited at a scale that was once unimaginable. He said the era of doing tech on the cheap, at the expense of security, is over. The centre describes the UK as at a point of enormous consequence for cyber security, and calls the response a moment of choice.
Why old flaws become fast weapons under AI
The danger, in the NCSC’s account, is not a single new weapon but speed applied to old weaknesses. Technology underpins the automation of physical processes that keep modern life running, from electricity switching to water facilities, dam operations, manufacturing lines and heating and refrigeration controls. A flaw in one of those systems can therefore reach far beyond a single computer.
Recent evidence cited in coverage of the report includes the AI-assisted discovery of vulnerabilities in a programming language used by about 70% of websites worldwide. Governments and companies worked on urgent security updates after that discovery. The NCSC’s message is that organisations can no longer rely on obscurity, delay or the hope that a known flaw will go unnoticed.
China, Russia and Iran in the NCSC’s assessment
China is named as the actor best positioned to use AI against UK critical infrastructure and other strategic targets. Horne was expected to say China highly likely has both the intent and the capability, and that its activity is the most sophisticated and sustained cyber challenge the UK faces. Reuters reports the same assessment, and notes that China, Russia and Iran have repeatedly denied accusations of malicious cyber operations in the past.
Russia is described as making sustained attempts to penetrate UK military networks, while Iran is carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat. The report says Russia and China will routinely use AI to achieve their geopolitical goals. The distinction matters: the warning is about a widening set of state and criminal actors, not one country alone.
What the government is funding to close the gap
Alongside the warning, the government has announced investment aimed at using AI for defence as well as closing basic gaps. The Chancellor announced £60 million for the first phase of a national Cyber Shield, according to the NCSC’s own announcement. A further £70 million will fund a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure and the economy.
A new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC, will develop AI security expertise within government. The government is also progressing the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan. Those measures are presented as part of a wider effort to keep essential services running and to deter hostile state aggression.
What the warning means for households and businesses
For households, the practical risk is disruption to services people rely on without thinking about them: power, water, transport, health services and food supply. The NCSC defines critical national infrastructure across energy, transport, defence, food, health and finance, among other sectors. Horne warned leaders they could face having to explain to investors, employees, customers and suppliers why food is not on shelves, lights are not on, or businesses have gone under.
For businesses, the report’s advice is deliberately basic: invest in technology properly, avoid connecting systems to the internet unnecessarily, and treat Cyber Essentials as a starting point rather than an end goal. Organisations should build resilience according to their size, complexity and risk. The NCSC also notes that AI can help defenders too, for example by allowing technology companies to fix hundreds of vulnerabilities in a single update.
The scale of the problem is already large. The NCSC estimates malicious cyber activity costs UK organisations about £14.7 billion every year. It received 1,830 reports of cyber attacks during the past year, of which 80 were classed as nationally significant, according to Computer Weekly’s coverage of the report. Those figures explain why the centre is pressing for significant changes now, rather than after a major incident.
Frequently asked questions
Has an AI-powered ransomware attack on UK critical infrastructure already happened? No. The NCSC says such an attack is highly likely by 2028. The warning is a forecast based on current trends, not a report of a specific incident on 3 November 2026.
Which services count as critical national infrastructure? The UK definition covers facilities and services across sectors including energy, transport, defence, food, health and finance. Power stations, airports and hospitals are among the examples cited in coverage of the report.
Does AI create completely new kinds of cyberattack? According to the NCSC, the main change is scale and speed rather than entirely new methods. AI helps attackers scout targets, find weaknesses and write code faster, and helps defenders patch vulnerabilities faster too.
What is the NERV Centre? It is a new National Exposure and Real-Time Vulnerability Centre, funded with £70 million, to identify vulnerabilities across critical infrastructure and the wider economy. It sits alongside the £60 million first phase of a national Cyber Shield.
What should a small business do first? The NCSC urges organisations to address underinvestment, avoid unnecessarily internet-connected systems, and make Cyber Essentials the starting point for security. Larger or higher-risk organisations should build further resilience on top of that baseline.
