AI-Driven Cyberattacks Could Threaten UK Critical Infrastructure by 2028

The United Kingdom could face artificial intelligence-powered cyberattacks on its critical infrastructure by 2028, as criminals and hostile states, including China and Russia, increasingly deploy AI for malicious cyber activities, Britain's cyber chief has warned.

Richard Horne, head of the UK's National Cyber Security Centre (NCSC), said AI could enable attackers to identify and exploit long-standing vulnerabilities on an unprecedented scale, potentially facilitating sophisticated ransomware attacks.

In a speech marking the release of the NCSC's annual cyber report on Tuesday, Horne warned that organisations failing to invest in cybersecurity or upgrade outdated technology could face severe consequences, including disruptions to essential services and business failures.The report described Chinese cyber activity as the most sophisticated and sustained cyber challenge facing the UK, while warning that Russia and China were likely to increasingly use AI to advance their geopolitical objectives.

Horne said Russia was deliberately conducting cyber campaigns below the threshold of armed conflict, while Iran was carrying out attacks against the UK and targeting individuals considered threats to its regime.The NCSC said AI was highly likely to increase the scale and efficiency of hostile cyber operations, although it would primarily enhance existing attack techniques rather than uncover entirely new vulnerabilities.

Horne also highlighted the risks to essential infrastructure, including electricity networks, water facilities, dams, manufacturing units and refrigeration systems. Recent cyberattacks targeting refrigeration systems in French supermarkets demonstrated how civilian infrastructure could be exploited.

According to the NCSC, malicious cyber activity costs UK organisations nearly USD 20 billion annually. Carmaker Jaguar Land Rover suffered more than USD 260 million in direct losses following a cyberattack in 2025, which also affected suppliers and the wider UK economy. GCHQ director Anne Keast-Butler urged organisations to strengthen their cyber defences, stressing that cybersecurity had become a frontline national security priority. The NCSC recommended basic safeguards, including updating devices, restricting administrator access and regularly backing up critical files and data.