BRITAIN must prepare for an AI-powered cyberattack on its critical national infrastructure within the next two years, with China considered the country best equipped to carry out such operations, the National Cyber Security Centre (NCSC) warned on Tuesday.
In its annual report, the NCSC said it was highly likely that the UK would face a ransomware attack involving AI-powered malware against critical infrastructure by 2028.
It also warned that hostile actors were expected to use artificial intelligence to increase the scale and efficiency of their cyber operations over the same period.
NCSC chief executive Richard Horne, whose agency is part of intelligence service GCHQ, said decades of underinvestment in technology had left too many organisations and supply chains vulnerable.
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” he was expected to say in a speech later on Tuesday.
“But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
Horne said China was highly likely to have the intent and capability to use AI against Britain's critical national infrastructure and other strategic targets, describing its activities as the country's most sophisticated and sustained cyber challenge.
He was also due to warn that Russia was making sustained attempts to penetrate UK military networks, while Iran was conducting malicious cyber operations globally, including against Britain and individuals it viewed as threats.
Moscow, Beijing and Tehran have repeatedly denied accusations of malicious cyber activities.
The warning follows hacking attacks on supermarkets across Europe that exposed vulnerabilities in their information technology systems.
Horne urged organisations to take immediate action to address weaknesses, warning that they could otherwise face serious consequences, including disrupted food supplies, power outages and business failures.
He said organisations would have to explain why they had ignored known risks despite being aware of the warnings. - November 3, 2026
