IC Technology & Cyber — 2026-11-04

UK NCSC Publishes Assessment on AI-Enabled Cyber Intrusion Threat Projections to 2028

BLUFNCSC's assessment gives UK regulators a dated, citable baseline that raises the legal and compliance cost of deferred patching, particularly for critical infrastructure operators running end-of-life systems.

The UK National Cyber Security Centre issued an assessment on November 3 setting out three scenarios for AI-enabled cyber intrusion to 2028, which it characterises as plausible but not predictions 1. Its key judgements state it is highly likely that Russia, China and other states will routinely use AI-cyber by 2028, and highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure before then 1. It also rates as almost certain that many systems will remain vulnerable to AI tools that find and exploit weaknesses 1. NCSC CEO Richard Horne, speaking at the State of the Cyber Nation launch, stated the risk originates from long-tolerated vulnerabilities rather than new attack methods, according to Infosecurity Magazine 2.

Analysis
UK critical infrastructure operators and their regulated suppliers now face a dated government baseline against which regulators can test patching and recovery decisions. The exposure lies in vulnerabilities that already exist: Horne framed AI as accelerating discovery of long-tolerated flaws, so end-of-life systems and deferred upgrades carry the risk. Only two of the four key judgements apply to critical national infrastructure, and NCSC calls its scenarios plausible rather than predictive, so the ransomware judgement does not automatically extend to other sectors. Legal commentary already cites the document as evidence of risk under UK GDPR Article 32, raising the cost of leaving known flaws unpatched. Confidence is moderate: the assessment rests on one primary document, and the three outlets repeating it add no independent threat data. The publication may mainly build momentum for the Cyber Shield, the Cyber Security and Resilience Bill and the National Cyber Action Plan.

4 sources

Artificial intelligence and cyber intrusion - NCSC UK
NCSC Chief Warns of AI Ransomware Threat to UK Critical Infrastructure - Infosecurity Magazine
Britain on notice: AI-powered ransomware attacks to arrive by 2028 - The Register
NCSC AI cyber intrusion assessment and UK GDPR security - Bratby Law