UK NCSC sees AI-powered malware highly likely against critical infrastructure by 2028
Reporting tied to the UK National Cyber Security Centre states that AI-powered malicious software is highly likely to feature in hacking attacks on power stations, airports, and hospitals by 2028, extending a separate expectation that AI could enable ransomware against critical national infrastructure before then. The centre's framing covers broad critical national infrastructure sectors from energy and transport through health and finance, moving public discussion toward dated contingency planning rather than open-ended speculation. Parallel headlines attribute similar timing to UK cyber leadership. Security builders should note that available excerpts convey an assessment, not a documented breach, and they do not detail which AI capabilities or analytic basis underpin the highly likely label, so the 2028 date is a signal for preparedness rather than a measured forecast precision.
UK NCSC sees AI-powered malware highly likely against critical infrastructure by 2028
The Guardian reports that the National Cyber Security Centre expects AI-powered malicious software to be highly likely used in hacking attacks on UK power stations, airports and hospitals by 2028. The story cites the state cybersecurity body and names those facility classes as expected targets.
Key takeaway
Treat the NCSC 2028 horizon as a government planning signal: invest in resilience against AI-assisted malware without treating the forecast as proof attacks already operate at scale.
What happened
According to The Guardian, the National Cyber Security Centre expects AI-powered malicious software to be highly likely used in hacking attacks on UK power stations, airports, and hospitals by 2028, citing the state cybersecurity body as the source of that judgment.
Reporting excerpts also attribute to the NCSC an expectation that AI will probably enable a ransomware attack against critical national infrastructure between now and 2028, with UK critical national infrastructure defined across sectors including energy, transport, defence, food, health, and finance.
Evidence
The NCSC expects AI-powered malware to be highly likely used against UK power stations, airports, and hospitals by 2028.
The Guardian AI · attributed
AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body.
The NCSC said AI will probably enable a ransomware attack on critical national infrastructure before 2028.
The Guardian AI · attributed
The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028.
UK critical national infrastructure spans multiple essential sectors named in reporting.
The Guardian AI · attributed
The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance.
Associated coverage headlines UK cyber leadership expecting AI cyberattacks on critical infrastructure by 2028.
Associated Press AI · attributed
UK cyber chief says the UK will face AI cyberattacks on critical infrastructure by 2028 - AP News
Why it matters
Operators of essential services receive a public, time-bound rationale to prioritize detection and recovery for AI-enabled ransomware instead of waiting for a confirmed headline breach.
Limits and uncertainties
The packet reports a forward-looking NCSC probability statement rather than an observed AI-powered attack on UK critical infrastructure.
Excerpts do not establish which specific AI capabilities would be used or the methodology behind the highly likely assessment.
Associated Press material in the packet is headline-level and does not add detailed NCSC quotes beyond the Guardian excerpt.
Practical implications
Critical infrastructure security teams should treat AI-assisted attack tooling as a near-term planning assumption through 2028.
Builders should emphasize detection and resilience for ransomware against essential services rather than deferring controls until after a demonstrated incident.
What to watch
Whether the NCSC or UK government publishes fuller detail on the evidence and confidence basis for the 2028 highly likely judgment.
Any confirmed ransomware incident against UK critical national infrastructure attributed to AI-enabled tooling.
