The National Cyber Security Centre’s State of the Cyber Nation report, published on 3 November, says UK critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, and it asks organisations to fix long-tolerated weaknesses before attackers find them faster.
The warning comes from the NCSC, part of GCHQ, and rests on a two-year view. According to the agency’s announcement, hostile actors’ adoption of AI is “highly likely” to increase the scale and efficiency of their operations, including ransomware attacks, social engineering and vulnerability exploitation. The report describes the UK as being at a point of “enormous consequence” for cyber security.
What the NCSC says is changing
The framing is specific about cause. In prepared remarks released with the report, NCSC chief executive Dr Richard Horne is set to say that the UK faces a real prospect of an unprecedented rise in incidents, and that the reason is old weakness. In his words: “vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
That matches the argument the agency’s chief technology officer, Ollie Whitehouse, made on 1 May in a post about a coming “patch wave.” Whitehouse wrote that AI, used by sufficiently skilled people, is showing the ability to exploit technical debt at scale and at pace, and that the NCSC expects a “forced correction” across open source, commercial, proprietary and software as a service. Both statements place the pressure on the backlog of known weakness.
Horne also puts the cost on leadership. He is set to say: “For decades, we have collectively got away with doing tech on the cheap.” He will urge organisations to address under-investment in technology, to avoid connecting technology to the internet unnecessarily, and to treat Cyber Essentials as the starting point for security instead of the end goal, building further resilience according to their size, complexity and risk. If leaders fail to make those choices, he says, they will have to explain to investors, shareholders, employees, customers and suppliers “when food isn’t on shelves, lights aren’t on, businesses have gone under.”
The government side of the announcement
The NCSC ties the report to public spending and legislation. The announcement says the Chancellor, last week, committed £60 million to the first phase of a national Cyber Shield, £70 million to a new National Exposure and Real-Time Vulnerability (NERV) Centre that will identify vulnerabilities across critical infrastructure and the economy, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC. It also points to the Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan.
Security Minister Dan Jarvis said the report shows threats growing more sophisticated and that the government is using AI “to help stay ahead of those who seek to do us harm.”
What it means for the security leader
The report is addressed to leaders, and the practical content is about sequence. The patch wave post gives the order: identify and minimise internet-facing and other externally exposed attack surfaces first, starting with perimeter technology and then working inward through cloud instances and on-premises systems. Where capacity runs out, it says to prioritise the external attack surface, then critical security systems. It adds that patching will not always be enough, because technology that is out of support cannot receive updates and has to be replaced or brought back within support. Where updates have to be ranked, the post names the Stakeholder Specific Vulnerability Categorisation (SSVC) system as one risk-prioritised method, and for organisations running essential services such as energy, healthcare and transport it points to the Cyber Assessment Framework alongside Cyber Essentials.
The same post recommends enabling automatic hot patching and automatic updates wherever they exist, including for embedded devices, and adopting a policy of “update by default” outside safety-critical and operational technology. For systems under active exploitation, it points to new NCSC guidance on responding to active exploitation of vulnerabilities and says the update process must accelerate.
In our reading, recent incidents on this site show what that sequence prevents. A chain of three flaws on an edge VPN appliance, covered when Ivanti patched CVE-2026-104935, is the kind of perimeter exposure the NCSC wants inventoried first. Wiz’s count of AI developer platform incidents, which we reported yesterday, shows stolen credentials turning into paid model use within days, an early example of the pace the NCSC describes. For the US side of the same planning problem, see our report on the CISA 2030 strategy and its 60, 180 and 365-day marks.
Actions for the next quarter
Three jobs follow from what the NCSC has published. First, produce a current list of everything reachable from the internet, with an owner and a patch route for each item. Second, find the systems that cannot take updates and put a replacement date on each one that sits on the perimeter. Third, move Cyber Essentials from a certificate to a floor, and measure resilience against the organisation’s size, complexity and risk, as Horne asks. Boards should expect to see all three reported with dates.
The NCSC’s own wording is that this is a moment of choice, and the 2028 date gives a planning horizon of about two years. The agency’s argument is that the weaknesses are already known and that AI will let attackers find them faster.
Source: NCSC, Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
