Privacy & Security

NCSC: AI-powered attacks on UK critical infrastructure expected within two years

The NCSC's chief executive warned on 3 November that AI is making old weaknesses easier to exploit. What the State of the Cyber Nation report says, and the habits it means for your own network.

By Andrew Ingleton · Published

Image accompanying the NCSC news item on AI-powered attacks
Image from the NCSC's 3 November 2026 news item © NCSC

The National Cyber Security Centre (NCSC) published a warning on 3 November that AI will make cyber attacks on UK critical infrastructure faster and cheaper to carry out. Chief executive Dr Richard Horne gave the speech launching the NCSC's annual report, State of the Cyber Nation, covering 1 September 2025 to 31 August 2026.

What the NCSC says

  • AI-powered malware is 'highly likely' to be used in a ransomware attack on UK critical national infrastructure by 2028.
  • Within two years, hostile actors' use of AI will 'highly likely' increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.
  • The article frames AI as exposing weaknesses organisations have tolerated for years, far faster and at greater scale, rather than as inventing new attack methods.

What the government announced

  • £60 million for the first phase of a national Cyber Shield.
  • £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, to identify vulnerabilities across critical infrastructure and the wider economy.
  • A new AI Cyber Security Centre of Excellence run by the NCSC in Manchester.
  • The Cyber Security and Resilience Bill and a forthcoming National Cyber Action Plan are also mentioned.

The advice to organisations

Address underinvestment in technology; do not connect technology to the internet unless necessary; treat Cyber Essentials as a starting point rather than the finish line; build resilience in proportion to size and risk; and use existing standards and frameworks that already protect against conventional and AI-powered attacks.

What it means for a home or small office

The speech is aimed at operators of national infrastructure, but the lesson scales down: the dangerous weaknesses are the old, boring ones. Three habits follow directly from the NCSC's message:

  1. Do not expose services you do not need. A home server, NAS or camera reachable from the internet is exactly what automated scanning finds. Prefer a VPN or mesh network for remote access, as we discuss in our Tailscale guide.
  2. Patch quickly. If exploitation gets faster, the gap between a fix being published and you applying it matters more. Turn on automatic updates for routers, NAS software and phones.
  3. Expect more convincing scams. Better AI makes phishing messages more fluent. Our Black Friday checklist still applies: check the sender, do not click through, use passkeys where offered.

The NCSC's page also lists related reading, including blogs on a 'vulnerability patch wave' (1 May), agentic AI risk (20 August) and an AI chapter in its research problem book (20 October). We will cover them in a follow-up.

You might also like