Britain should expect artificial intelligence to be used in cyberattacks against its critical infrastructure within the next few years, according to the head of the country's National Cyber Security Centre. Richard Horne said such attacks are likely by 2028 as both criminal groups and nation states fold AI into their operations.
The warning came in a speech on Tuesday marking the release of the NCSC's annual cyber report, as reported by SecurityWeek. Horne pointed to China and Russia among the states expanding their use of the technology, and cautioned that AI-enabled malware could fuel ransomware campaigns.
His central concern is that AI will make it far easier to find and exploit long-ignored weaknesses in the systems that keep the country running, at a speed and volume defenders have not faced before.
Business Leaders Put on Notice
Horne directed much of his message at executives. He said leaders of organizations of every size who have "got away with tech on the cheap" will be held accountable if a failure to invest leads to empty shelves, power outages or collapsed businesses.
The point was that underinvestment in cybersecurity and reliance on outdated technology are no longer just internal IT problems. In his framing, they now carry consequences for the wider public and economy.
China, Russia and Iran Named as Leading Threats
The NCSC report describes Chinese cyber activity as the most sophisticated and persistent challenge facing the UK. It also says both China and Russia will routinely turn to AI to advance their geopolitical aims.
Horne said Russia is deliberately running cyber campaigns designed to stay below the threshold of armed conflict. He added that Iran is conducting attacks against the UK and going after individuals it regards as threats to its regime.
The report expects AI use by states and criminals to make hostile operations larger and more efficient. However, it assesses that AI will mostly be used to amplify existing tactics rather than to uncover entirely new classes of vulnerabilities.
Recent Flaws Show How AI Is Changing Discovery
The warning follows a week in which governments and companies rushed to apply urgent security updates. The fixes addressed two critical vulnerabilities, found with the help of AI, in a programming language that underpins roughly 70 percent of websites worldwide.
The flaws could let attackers reach sites without authentication, which in theory could allow them to take remote control of a web server without a password. The episode illustrates how AI can accelerate the search for weaknesses in widely used software.
Physical Systems Increasingly in the Crosshairs
Horne stressed that technology now automates many physical processes essential to daily life. He cited electricity switching, sluice gates at water facilities, dam operations, manufacturing lines, and heating and refrigeration controls.
He pointed to recent cyberattacks on refrigeration systems in French supermarkets as evidence of how readily hostile actors can exploit civilian infrastructure. The UK and EU member states have also attributed an attack on Poland's energy grid in December 2025 to Russia's FSB security service. Had it succeeded, around 500,000 people could have been left without electricity in winter.
The Rising Cost of Cybercrime in Britain
According to the NCSC, malicious cyber activity costs UK organizations nearly $20 billion each year. A prominent example is Jaguar Land Rover, which suffered more than $260 million in direct losses after a 2025 cyberattack that also affected its suppliers and weighed on the national economy.
Anne Keast-Butler, director of GCHQ, the signals intelligence agency that houses the NCSC, called on every UK organization to act immediately. She argued that cybersecurity now forms part of the country's frontline defense, not just a means of protecting customers and services.
What the Warning Means for Organizations
The NCSC's recommended response is not exotic. It urges organizations to keep devices updated, restrict administrator access to systems and back up important files and data.
For founders and executives, the message is that AI is likely to shrink the window between a weakness existing and it being exploited. Companies running legacy systems or deferring security spending may find that tolerance for those risks is running out, both from attackers and from regulators and the public.
Source: SecurityWeek
