NCSC’s forecast for UK critical infrastructure separates future AI‑enabled threats from observed incidents and mandatory rules.
Forecast, not an incident report
The NCSC’s November 3 release warns UK critical infrastructure should prepare for ransomware involving AI‑powered malware by 2028. An agency forecast is different from evidence that such an attack has already occurred. The date sets the assessment’s horizon, not a compliance deadline.
Previewed remarks from its CEO connect the risk to existing vulnerabilities being found and exploited at greater scale, rather than new attack methods. They are expected remarks, not a verified delivered transcript.
The agency calls Cyber Essentials a starting point, with further resilience proportionate to organisations’ size, complexity and risk. This frames AI as pressure on foundations, rather than automatically rendering existing security work irrelevant.
Cyber incident‑response exchange in Panama, May 2025; archive, not NCSC activity or AI‑attack evidence. Photo: Petty Officer 1st Class Daniel James Lanari / U.S. Navy / Wikimedia Commons, public‑domain US government work. Downscaled/display‑cropped.
Sources
- 1.Petty Officer 1st Class Daniel James Lanari / U.S. Navy / Wikimedia Commons(commons.wikimedia.org)
- 2.public-domain US government work(creativecommons.org)
- 3.ncsc.gov.uk(ncsc.gov.uk)
