NCSC annual review: AI malware likely to hit UK infrastructure by 2028

The UK’s National Cyber Security Centre (NCSC) warns in its annual review, The State of the Cyber Nation, published on 3 November, that AI-powered malware is highly likely to be used in ransomware attacks against critical national infrastructure by 2028. The NCSC also expects hostile states to lean on AI, saying that by 2028 it is highly likely China, Russia and other nation states will routinely use AI cyber to meet geopolitical goals. The review covers 1 September 2025 to 31 August 2026, when the NCSC received 1,831 attack reports, supported 337, and rated 80 as nationally significant. It notes that many successful intrusions still relied on familiar tactics like phishing and stolen credentials.