UK Warns AI-Powered Attack on Critical Infrastructure Is Likely Within Two Years, Cyber Chief Says

Britain should prepare for an AI-powered cyberattack on its critical national infrastructure within the next two years, according to the UK's National Cyber Security Centre. The warning came in the centre's annual report and in a speech by its chief executive, Richard Horne, on Tuesday 3 November 2026.

The headline finding is direct. The NCSC said it was highly likely there would be a ransomware attack involving AI-powered malware on the nation's critical infrastructure by 2028. That means the systems people rely on every day: electricity, water, manufacturing, heating and refrigeration controls, and the networks tying them together. The warning does not say such an attack has already happened. It says the conditions for one are forming fast.

Horne's message to business leaders was blunt. He said far too many organisations in Britain had got away with “doing tech on the cheap” for decades, leaving them exposed. Leaders who failed to invest in cybersecurity, he warned, would have to explain why food was not on the shelves, lights were not on, and businesses had gone under. He also said Britain faced a real prospect of an unprecedented rise in cyber incidents in the coming months.

Why AI changes the threat

The NCSC's argument is that AI is changing the speed and scale of cyberattacks. Hostile actors can find weak points faster, adapt malicious software more quickly, and run operations across many targets at once.

A recent example shows how that shift is already playing out. In the week before the speech, governments and companies rushed out security updates after the AI-assisted discovery of flaws in a programming language said to be vital to around 70 percent of websites globally. The two critical flaws reportedly could allow attackers to gain access to sites without a password and, in theory, to control a web server remotely.

The deeper problem is old weaknesses tolerated for far too long. Unpatched systems and flat networks, where one compromised device opens the door to many others, give attackers room to move. AI makes that room easier to exploit, because it can scan for known flaws at a scale that once seemed unimaginable. The UK's exposure, in Horne's view, is the result of postponed upgrades meeting a faster class of attacker.

China, Russia and Iran named in the report

The NCSC named the states it sees as the main sources of threat. China, it said, highly likely has the intent and is best positioned to use AI against critical infrastructure and other strategic targets. Horne called China's activity the most sophisticated and sustained cyber challenge the UK faces.

Russia, according to the speech, is making sustained attempts to penetrate UK military networks. The UK and EU member states have also said Russia's FSB security service was behind an attack on Poland's energy grid in December 2025. Iran was described as carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat.

These attributions are the NCSC's judgments, based on reporting the public cannot fully check. Treat them as the centre's stated view, not as independently verified fact.

Supermarket attacks showed how close to home it can get

One concrete illustration came from the supermarket sector. Hacking attacks on supermarkets across Europe exposed weaknesses in IT systems, and Horne pointed to attacks on refrigeration systems in French supermarkets. Coverage of the speech showed a shopper in a refrigerated aisle in Montreuil, France, two days after one such attack in October 2026.

Refrigeration may sound like a small detail, but it shows how a cyber incident quickly becomes a physical one. When temperature controls or payment networks fail, fresh food spoils and shelves empty. Attackers do not need to break into a power station control room. They need only find a poorly defended link in a long chain of connected systems.

The cost is already large. The NCSC said malicious cyber activity costs UK organisations almost 20 billion dollars every year. In 2025, carmaker Jaguar Land Rover suffered more than 260 million dollars in direct losses from a cyberattack that also hit suppliers and dented the wider economy. Underinvestment in security is not a saving. It is a deferred bill that arrives all at once.

What the NCSC wants organisations to do

The centre's advice is deliberately basic. Organisations should keep devices and software up to date, limit administrator access so fewer accounts hold the keys to the whole network, and back up important files so a ransomware attack does not mean total loss. These steps will not stop a determined state actor alone, but they remove the easy wins attackers rely on.

For smaller businesses, the same advice scales down neatly. Prompt patching, automatic updates, strong and unique passwords with two-factor authentication, and a tested offline backup all cost little compared with a week of downtime. Larger operators face a harder conversation about replacing ageing systems rather than patching around them.

What happens next

The NCSC's timeline runs to 2028, giving organisations roughly two years to act. Whether that proves enough depends on how seriously boards and public bodies take the warning. The centre expects incident numbers to rise before they fall, as attackers press the advantages AI gives them.

The warning also lands as the UK invests heavily in AI infrastructure and data centres. The same technologies that promise growth widen the attack surface. The country's AI ambitions and its cyber defences will rise or fall together.

For now, the takeaway is simple. The cyber chief is not predicting one dramatic attack on one day, but a likely event within two years, with the most urgent repairs being updates, access controls, and backups.

Frequently Asked Questions

What exactly did the NCSC warn about?

The NCSC said it was highly likely there would be a ransomware attack involving AI-powered malware on the UK's critical national infrastructure by 2028, in its annual report and a speech by Richard Horne on 3 November 2026.

Which countries did the report name as threats?

China was named as the most sophisticated and sustained cyber challenge facing the UK. The report also said Russia is making sustained attempts to penetrate UK military networks, and that Iran carries out malicious cyber operations globally, including against the UK.

What can businesses do to reduce the risk?

Keep devices and software up to date, limit administrator access, and back up important files. Prompt patching, strong unique passwords with two-factor authentication, and tested offline backups are the starting points for smaller firms too.