UK Cyber Agency Warns AI-Powered Ransomware Attack on Critical Infrastructure Is 'Highly Likely' by 2028

The UK's national cyber agency has rated an AI-powered ransomware attack on critical infrastructure as "highly likely" before 2028 — a formal probability assessment that puts the threat at roughly 80–90% certainty. The warning reflects a fundamental shift: AI isn't just helping defenders write faster code; it is actively lowering the barrier for state-backed actors to execute attacks that would previously have required years of specialized expertise.

The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation review on November 3, 2026. The report is the agency's most direct public statement yet on AI's role in the evolving threat landscape, and it names specific adversaries rather than gesturing at vague "nation-state" threats.

What the NCSC Said

According to the review reported by New Civil Engineer, the NCSC assessment breaks down as follows:

• China is rated as best positioned to use AI offensively against strategic infrastructure — meaning energy grids, water systems, and transport networks.
• Russia and other state actors are expected to routinely deploy AI cyber capabilities within the same two-year window.
• An AI-enabled ransomware strike on UK critical infrastructure is classified "highly likely" — the agency's second-highest probability rating, corresponding to approximately 80–90% confidence.

"Highly likely" in UK intelligence terminology is not hedging. It is near-certainty language used when analysts see active capability development and clear intent.

Why AI Changes the Ransomware Equation

Traditional ransomware attacks against hardened critical infrastructure required significant resources: months of reconnaissance, bespoke malware written by skilled operators, and well-timed execution. AI compresses all three phases.

Reconnaissance acceleration: AI can analyze publicly available data — network diagrams, procurement records, employee LinkedIn profiles — to map attack surfaces faster than any human team.

Malware generation: Large language models (LLMs) fine-tuned on vulnerability data can generate functional exploit code. The NCSC has documented this trend in prior advisories.

Adaptive evasion: AI-powered malware can modify its own signatures in real time, making signature-based detection (the backbone of most enterprise security tooling) progressively less effective.

The result is that attacks that once required a well-resourced nation-state intelligence apparatus can increasingly be executed by smaller groups using commercially available AI infrastructure.

The Defensive Gap Warning

The NCSC flags a compounding problem: organizations that cannot adopt AI-powered security defenses will become disproportionately attractive targets. This creates a two-tier vulnerability landscape.

Large operators of critical infrastructure — national grid operators, water utilities, hospital networks — typically have the resources to deploy AI-assisted threat detection, continuous monitoring, and automated incident response. Smaller operators in the same critical sectors often do not.

Attackers optimize for return on effort. If AI-defended targets become harder to crack, attackers will route around them to softer targets in the same supply chains. A regional water authority that supplies a major city carries infrastructure-level risk even if it doesn't look like a primary target.

What This Means for Organizations

For security and risk teams, the NCSC's framing has practical implications:

• Threat modeling must now include AI-augmented attack paths, not just known TTPs (tactics, techniques, procedures).
• Supply chain exposure is the immediate gap — smaller vendors and contractors connected to critical infrastructure operators are the most likely first-breach point.
• AI detection tools are no longer optional. The NCSC's implicit message is that organizations relying solely on legacy SIEM (security information and event management) platforms are undermatched.

What to Watch

The UK government's Cyber Security and Resilience Bill, currently moving through Parliament, is expected to expand mandatory reporting requirements for critical infrastructure operators. The NCSC's "highly likely" rating gives that legislation considerably more political urgency. Watch for accelerated committee timelines and whether the bill is amended to include specific AI threat provisions before the 2028 window closes.