NCSC Annual Review Warns AI-Powered Malware Highly Likely to Hit UK Critical Infrastructure by 2028

Analysis
UK energy, water and food-distribution operators face pressure to remove internet-exposed legacy equipment before 2028, because the NCSC attributes the coming rise in incidents to long-tolerated vulnerabilities rather than new AI techniques. The supermarket refrigeration intrusions show the mechanism: default passwords and exposed controllers allowed remote changes to physical equipment, and none was identified as AI-driven. The government's Cyber Shield and vulnerability centre funding targets detection and exposure scanning, not operator remediation, so patching and disconnection by operators will decide whether the warned-of ransomware attack materialises, and no source offers a measurable remediation indicator. Confidence is low: the four outlets relay one NCSC report, and no independent technical evidence shows AI-enabled malware in operation. The 2028 warning may mainly support the funding announcements and the pending Cyber Security and Resilience Bill, since current state-backed activity relies on simple exploitation of known vulnerabilities.