UK cyber agency warns of AI ransomware attacks by 2028
The UK's National Cyber Security Centre (NCSC) judges that an AI-powered ransomware attack on UK critical national infrastructure is highly likely by 2028. The warning sits in its State of the Cyber Nation report, published on 3 November 2026. The agency also expects China and Russia to use AI routinely in hostile cyber activity by the same year. For a business that automates routine work, the practical point is this: every automated workflow adds accounts, data links and logins that an attacker could try to use. Owners should know which systems are connected, who approves changes to payment details, and whether backups can be restored. The NCSC's own baseline, Cyber Essentials, is a useful starting checklist.
In short
- The NCSC judges an AI-powered ransomware attack on UK critical national infrastructure highly likely by 2028.
- The report was published on 3 November 2026 and names China and Russia as states that will use AI routinely in cyber operations.
- Every automated workflow adds accounts and system links that need named access and multi-factor authentication.
- Payment detail changes should always be checked by a named person, whatever tool requested them.
- Automation cannot fix unsupported or unpatchable systems, so those need a human decision.
What happened
According to the NCSC, highly likely is the agency's own judgement term for a high probability. Its State of the Cyber Nation report, published on Tuesday 3 November 2026, says AI-powered malware will highly likely have been used in a ransomware attack on UK critical national infrastructure by 2028. Reuters reported the same judgement the same day, adding that China was likely the best equipped to run such operations. The Record reported that the NCSC expects China and Russia to use AI routinely in their cyber operations by that date.
The NCSC's chief executive, Dr Richard Horne, used the launch to make a wider point. He said that for decades British organisations had run their technology on the cheap, and that this is now exposed. In his words, as reported by Reuters, the risk is not that AI has invented new ways to attack. The risk is that flaws organisations have tolerated for years can now be found and exploited at a scale that was not possible before.
Why it matters for businesses that automate work
Critical national infrastructure covers power, water, transport, health and food systems. The NCSC's warning is aimed at those operators first. Smaller firms are not named in the report, but the same tools that find weaknesses in a power network can probe a supplier's billing system or a shared accounting login.
Automation changes the picture in two ways. It adds accounts that run without a person at the keyboard, and it adds links between systems, such as a billing tool that reads from a bank feed. Each link is a place where a weak password, an unpatched server or an over-permissive account can be used. The report also says organisations with mature security programmes will be better placed to detect threats and automate their own defences, while weaker organisations will struggle to keep pace.
What changes in practice, at any size
The NCSC treats its Cyber Essentials scheme as the minimum standard for organisations of all sizes. It covers five technical controls: firewalls and routers, secure configuration, user access control, malware protection and security update management. A business that wants a simple order of work can start there.
List every system that an automated tool can read or write to, including email, accounting, payroll and file storage.
Give each automated process its own named account with only the permissions its task needs. Do not share a person's login with a tool.
Require multi-factor authentication on all administrator and finance accounts.
Set a rule that any change to a supplier's bank details or a customer's payment account is checked by a named person before it is made.
Test a restore from backup at least once a year, and keep one copy that is not connected to the main network.
A five-person firm can do most of this in a week with its existing software. A group with thousands of staff will need an IT owner, a change process and a record of which tools have access to which data. The steps are the same. The scale of the work differs.
What automation cannot do
Automation does not reduce cyber risk on its own. It can speed up patching and alerting, but it cannot fix a system that the vendor no longer supports, and it cannot decide whether a payment request is genuine. The NCSC's warning also notes that some industrial equipment cannot be patched quickly without safety or service consequences. Those systems need a person to plan the change and accept the risk.
What to watch next
Three things are worth tracking over the next year. The first is the NCSC's own follow-up guidance on AI-enabled attacks, which its report says will shape defence priorities. The second is the first phase of Cyber Shield, a national network of AI agents for defence, to which the government has allocated £60 million, according to The Record's report on the launch. The third is whether the Cyber Security and Resilience Bill, which the government has been taking through Parliament, changes the duties placed on organisations that run essential services. Owners outside those sectors should watch the NCSC's guidance rather than wait for a law to require it.
Sources
How AiStaffo would automate this
In a typical back-office setup, an AI worker that handles billing follow-ups or reconciliations reads from the accounting system and the bank feed. The first step in the free automation audit is to map those links and the accounts behind them. Each automated process would run under its own named login, limited to the screens and actions its task needs. Any change to a supplier's bank details would be routed to a named staff member for approval before it is made. The owner still decides who gets access, when backups are tested and which old systems stay in use. Book a free automation audit.
Questions people ask
What did the NCSC actually say about AI attacks by 2028?
Does this warning apply to small businesses or only to critical infrastructure?
What is Cyber Essentials and how does it help?
Will AI tools make a business less safe?
Who is responsible for checking an automated payment change?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
