NCSC State of the Cyber Nation report published Tuesday, November 3, 2026
NCSC Puts a Date on AI Malware: Highly Likely in a Ransomware Attack on UK Critical Infrastructure by 2028
The UK National Cyber Security Centre published its State of the Cyber Nation report on Tuesday, November 3, and its central judgment is a forecast, not a sighting: in the agency's words, it is highly likely that between now and 2028 AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure. The NCSC says hostile AI adoption is highly likely to raise the scale and efficiency of ransomware, social engineering and vulnerability exploitation over the next two years, and that China and Russia will routinely be using AI in their cyber operations by 2028, with chief executive Richard Horne describing China as best positioned to use AI against UK infrastructure and other strategic targets. The report's second message cuts the other way: AI did not create these weaknesses, and it is more likely to enhance and scale existing attack methods than to invent new ones. Horne warned of a real prospect of an unprecedented rise in cyber incidents in the coming months, not because AI invented new attacks, but because vulnerabilities tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable. He criticized organizations for doing tech on the cheap, keeping end-of-life systems running and delaying upgrades, and noted that even state-linked intrusions often arrive through internet-facing applications and flaws for which patches already exist. The same report describes the government testing frontier AI systems against its own networks under an initiative called Project DROMOS, which grew from a planned four-week pilot into live environments and found hundreds of potential security issues, including critical vulnerabilities.
Executives
A national agency has put a two-year date on AI-assisted ransomware against critical infrastructure, and its own chief says the cause will be old weaknesses, not new magic. That framing is budget language: the spending that answers this forecast is patching discipline, replacement of end-of-life systems, and restore-tested backups, all inside the current contract cycle rather than a future transformation program. The NIST AI RMF treats this as Govern and Manage work: name the risk, assign an owner, and measure the basics that decide whether the forecast lands on you.
CIO / CISO
Translate the forecast into three operating numbers and report them monthly: mean time to remediate internet-facing critical flaws, count of end-of-life systems still in production, and percentage of backups with a successful restore test in the quarter. The NCSC notes that state-linked intrusions routinely use flaws with patches already available, so exposure windows are the metric that predicts your outcome. Run the Project DROMOS idea at your scale: use AI-assisted scanning against your own estate, with authorization and logging, before someone else does it without either.
Engineers
Expect AI to compress the time between a flaw becoming public and working exploitation, which means the queue cannot wait for the monthly cycle on internet-facing systems. Keep the inventory honest, especially the long tail of appliances, controllers and supplier-managed boxes that sit outside the central network, because those are the systems both this report and this week's refrigeration attacks keep pointing at.
Everyone (non-IT)
Nothing about your daily habits changes because of this report, and no AI attack on UK infrastructure has happened yet; the NCSC is forecasting, not announcing. The practical takeaway is the same advice that defeats ordinary ransomware: keep devices updated, use unique passwords with multifactor authentication, and be suspicious of polished phishing, which is one of the areas AI is expected to scale first.