Britain faces an imminent surge in cyber incidents as attackers deploy artificial intelligence to uncover and exploit technical vulnerabilities at massive scale, according to a stark NCSC cyberattack warning published on Tuesday. The National Cyber Security Centre cautioned that automated malicious code will hit national infrastructure before 2028.
Key points
- The NCSC warned that AI tools allow hostile actors to discover and exploit long-neglected software flaws far faster than human engineers can patch them.
- State intelligence officials consider an AI-driven ransomware strike against British critical infrastructure highly likely within two years.
- Ministers have allocated £130 million to deploy automated defence systems, including real-time network scanning and autonomous software agents.
- The UK government is preparing consultations on legal liability for technology companies that sell insecure software products.
The scale of technical exposure
Richard Horne, chief executive of the NCSC, delivered the assessment during the launch of the agency’s annual review in London. The agency, which operates as part of intelligence organisation GCHQ, concluded that machine learning tools have altered the operational tempo of cyber warfare.
Horne explained that attackers are not necessarily inventing brand new intrusion methods. Instead, automated tools allow threat actors to scan global networks, identifying weaknesses that organisations left unaddressed for years.
The agency pointed to surging vulnerability numbers across standard computing platforms. The Linux kernel project alone fixed more than 1,000 vulnerabilities last month, while commercial operating system vendors now issue single updates covering hundreds of bugs simultaneously.
Software security researchers have turned to automated tools to root out systemic flaws. Last month, automated code analysis helped uncover a severe security flaw in PHP, a backend programming language that powers 70% of the world’s websites. When defensive researchers can scan codebases this quickly, hostile teams possess the same capability.
Industry research into recent malware vulnerability trends shows that the window between bug disclosure and automated exploitation continues to narrow. Attackers deploy specialised scripts within hours of a vendor announcement.
Recent security incidents highlight the growing automation of network intrusions. Security teams have tracked specialized deployments such as automated cyberattack frameworks that run end-to-end network penetration campaigns without human intervention.
Ransomware threats to critical infrastructure
The annual review set out a specific timeline for critical national infrastructure. The agency said it is highly likely that attackers will deploy AI-powered malware during a ransomware extortion campaign against British utilities, transport or health services by 2028.
Critical national infrastructure covers facilities whose disruption would paralyse public life, including power stations, air traffic control, hospitals, water supplies and financial clearers. Previous ransomware incidents hit organisations such as Royal Mail and administrative contractor Capita using standard malicious tools.
Machine learning models alter how extortionists work by reducing the labour needed to breach enterprise boundaries. Hostile groups use models to write customized file encryptors, scout network routes, and locate unencrypted backups in minutes rather than weeks.
Alan Woodward, professor of cybersecurity at Surrey University, said the pace of development leaves defenders with little margin for error. Nation states and private companies require access to leading frontier models to identify software defects before hostile actors find them.
The warning arrives alongside heightened civil defence messaging across the country. Last month, government ministers advised citizens to keep three days of food and bottled water at home to prepare for severe disruptions to digital and physical utilities.
Decades of technical debt and vendor liability
The NCSC argued that artificial intelligence is simply stripping away the obscurity that previously shielded poor security habits. Organisations across both public and private sectors have accumulated decades of technical debt.
Many organisations continue to run obsolete software and delay system updates to preserve operational budgets. Horne criticised this practice directly during his address to industry executives.
“For decades, we have collectively got away with doing tech on the cheap,” Horne said. He warned that leadership teams will face scrutiny from investors, workers and customers if prolonged outages disrupt basic supplies or shut down businesses.
A recurring vulnerability vector remains simple neglect. The agency found that foreign state actors repeatedly penetrate corporate targets by finding unpatched internet-facing servers. System administrators often have security updates available for months but fail to install them promptly.
Engineering teams frequently discover that patching compromised server software after an intrusion requires far more capital than maintaining regular software cycles. The British government recently confirmed plans to consult on legislation that would hold technology vendors financially liable for software that lacks basic security controls.
Ollie Whitehouse, chief technology officer at the NCSC, argued last year that the tech sector knows how to engineer secure systems. He warned that commercial incentives currently fail to encourage the adoption and maintenance of secure solutions over the long term.
Government funding for automated defence
Despite the warnings, the agency maintains that system defenders retain a natural structural advantage because they dictate network architecture and control telemetry data. To preserve that edge, British authorities are funding domestic AI defence projects.
“AI has the potential to be one of the greatest opportunities in cyber defence,” Horne said. The government tested frontier models on its own digital estate through an initiative called Project DROMOS. The trial located hundreds of severe vulnerabilities across live departments.
Whitehall has committed £70 million to establish the National Exposure and Real-Time Vulnerability Centre, known as the NERV Centre. The facility will use machine learning systems to track digital attack surfaces across commercial and public networks.
A separate £60 million package funds Cyber Shield, an ecosystem of autonomous software agents. Under this structure, the NCSC supplies threat intelligence and platform access, while commercial software providers develop defensive agents capable of isolating intrusions at machine speed.
Defensive spending has grown across the sector as enterprises attempt to block automated credential abuse and cloud-targeted security breaches that drain computing resources.
State operations and hybrid warfare
Hostile intelligence agencies represent the other primary driver of autonomous attacks. The NCSC assessment projected that intelligence services in Russia and China will use artificial intelligence routinely during network operations by 2028.
The review noted that British military communications systems face persistent daily interference from Russian intelligence units. These electronic and digital probes remain calibrated to stay below the threshold of conventional armed conflict.
Broader assessments of Russian digital operational risks indicate that state hackers continue to combine network reconnaissance with disruptive infrastructure sabotage across Europe.
The report pointed to recent hybrid actions across mainland Europe, where intruders manipulated industrial cooling controllers in commercial supermarkets to push refrigeration temperatures above 50 degrees Celsius, spoiling food inventories.
The warning follows an alert from the Five Eyes intelligence alliance earlier this year, which told allied nations that artificial intelligence would change offensive capabilities within months rather than years.
The NCSC said its upcoming work will focus on coordinating with enterprise software vendors to ensure security patches are delivered and applied before automated exploitation tools locate unpatched networks.
