Eighty serious incidents in a year, and London fears AI-assisted ransomware against vital services within two years

Britain's National Cyber Security Centre (NCSC), part of the GCHQ intelligence agency, considers it highly likely that AI-driven malware will feature in a ransomware attack on the country's critical infrastructure by 2028. That is stated in its annual review and an accompanying assessment published on Tuesday, The Register and Cyber Security News report. According to the NCSC, China, Russia and other states will routinely use AI in cyber operations by then, although attackers for now mainly use AI to improve existing methods.

Between September 2025 and the end of August 2026 the NCSC handled 80 nationally significant incidents, out of a total of 337 incidents in which its team stepped in and 1,831 reports of attacks, Cyber Security News writes. In 88 percent of incidents at large organisations, the attack began through one of four routes: public-facing applications, phishing, valid accounts or external remote services.

The Register lists the planned investments, including 60 million pounds for Cyber Shield, a defence system using AI agents to be rolled out over five years, and 40 million pounds for a national agentic security unit. NCSC chief executive Richard Horne urges companies to invest urgently in security and resilience rather than cutting corners on technology.