The UK’s critical national infrastructure should be braced for a ransomware attack involving AI-powered malware within the next two years, the National Cyber Security Centre (NCSC) warned today.
The agency – part of GCHQ, Britain’s ‘listening post’ – said in its annual State of the Cyber Nation report, published today, that hostile states and criminal gangs are “highly likely” to use AI to increase the scale and efficiency of their operations by 2028, including ransomware, social engineering and the exploitation of software vulnerabilities.
In a speech launching the report, NCSC chief executive Dr Richard Horne warned that the country faces “a real prospect of an unprecedented rise in the number of cyber incidents” in the coming months – not because AI has invented new ways to attack, but because long-tolerated weaknesses “can now be discovered and exploited at a scale that was once unimaginable”.
He urged leaders to fix underinvestment in technology, stop connecting systems to the internet unnecessarily, and treat Cyber Essentials as “the starting point for cyber security, not the end goal”. Those that fail to act, he warned, will have to explain themselves “when food isn’t on shelves, lights aren’t on, businesses have gone under”.
He added: “For decades, we have collectively got away with doing tech on the cheap.”
The report covers the NCSC’s 10th year, from 1 September 2025 to 31 August 2026. Over that period its incident management team received 1,831 reports of cyber attacks, supported 337 incidents and classed 80 as ‘nationally significant’.
An accompanying assessment judges that Russia, China and other states will “highly likely” use AI routinely in cyber operations by 2028. The NCSC expects attackers to use AI mainly to speed up and scale existing techniques rather than hand entire attacks to autonomous systems.
The warning comes alongside new UK Government spending announced by the Chancellor last week, including £60 million for the first phase of a national Cyber Shield to develop “agentic cyber defence capabilities”, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and a new NCSC-run AI Cyber Security Centre of Excellence in Manchester. The Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan are also likely to bring about a significant shifts in policy.
The legislation would bring data centres, managed IT providers and critical suppliers under the UK’s cyber rules for the first time, make regulated organisations, including Scottish health boards, report significant incidents to the NCSC within 24 hours, and give regulators tougher enforcement powers.
The Cyber Shield initiative aims to develop “agentic cyber defence capabilities” with UK industry, which in practice means AI agents that can detect and respond to threats on their own, whilst NERV is designed to find weaknesses across critical infrastructure and the economy.
Security Minister Dan Jarvis said: “The NCSC’s latest annual report shows cyber threats are growing more sophisticated. We’re using the power of AI to help stay ahead of those who seek to do us harm.”
This week marks three years since Comhairle nan Eilean Siar was crippled by ransomware on 7 November 2023. An Accounts Commission report last November found that many of the vulnerabilities exploited in the attack had been identified in 2021–22 but never fixed.
And in 2024, the INC Ransom gang threatened to release three terabytes of NHS Dumfries and Galloway data after a “focused and ongoing” attack, and later dumped the stolen files on the dark web, including confidential patient information.
Last year, West Lothian Council’s education network was also hit by a criminal ransomware attack during the exam season, with a gang later publishing 3.3 million files. Weeks later, Glasgow City Council took services offline after malicious activity was detected on servers run by a third-party supplier, and warned that customer data may have been taken.
Most recently, Edinburgh City Council pulled its website offline last month after two critical flaws were found in PHP, the software behind a large share of the world’s websites.
While national cyber security is reserved, Scotland’s devolved public sector relies on the Scottish Government’s Strategic Framework for a Cyber Resilient Scotland and the Scottish Cyber Coordination Centre (SC3) to coordinate incident response alongside the NCSC.
Councils have moved to pool defences, with Scotland Excel – the procurement agency for local government – last year launching a £13 million security operations centre framework open to all 32 local authorities. But the NCSC warns that AI will expose vulnerabilities, failings and underinvestment at “unprecedented speed and scale”, and that organisations must act urgently on foundational weaknesses or risk adversaries exploiting them first.