UK Says AI-Powered Ransomware Attack on Critical Infrastructure 'Highly Likely' by 2028

In brief

• The UK's National Cyber Security Centre said critical infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028.
• NCSC chief Richard Horne warned that AI will expose vulnerabilities tolerated "for far too long," and said the era of "tech on the cheap" must end.
• The warning comes as the UK puts £60 million into a national Cyber Shield and £70 million into a new center to find vulnerabilities in critical systems.

Britain's critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, the UK's National Cyber Security Centre warned on Tuesday.

Within the next two years, hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations, including ransomware, social engineering and the exploitation of software vulnerabilities, according to the NCSC's annual State of the Cyber Nation report. The agency is part of GCHQ, the UK's signals intelligence service.

The threat stems less from new attack techniques than from old weaknesses, NCSC chief executive Richard Horne said in prepared remarks for a speech launching the report.

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," Horne said. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."