LONDON — The United Kingdom is likely to face AI-driven cyberattacks targeting critical infrastructure by 2028, as both criminal groups and nation-states — notably China and Russia — escalate their use of artificial intelligence in offensive operations, Britain’s top cyber official warned Tuesday.
These threats could involve AI-powered malware deployed for ransomware campaigns, enabling threat actors to discover and exploit long-ignored vulnerabilities “at a scale that was once unimaginable,” said Richard Horne, chief executive of the National Cyber Security Centre (NCSC).
Speaking at the launch of the NCSC’s annual review, Horne cautioned that executives who have “got away with tech on the cheap” must answer for the consequences of inaction — empty shelves, power outages, and business failures — if they neglect to invest in cybersecurity or modernize obsolete systems.
The report identifies Chinese cyber activity as the “most sophisticated and sustained” threat facing the U.K., noting that both Beijing and Moscow will routinely leverage AI to advance geopolitical aims. Russia is deliberately conducting campaigns below the threshold of armed conflict, while Iran continues to target U.K. interests and individuals perceived as threats to the Iranian regime, Horne added.
While AI adoption by hostile actors is almost certain to amplify the scale and efficiency of attacks, the assessment concludes the technology will primarily enhance and automate existing tactics rather than uncover entirely novel vulnerability classes.
The urgency was underscored last week when governments and corporations scrambled to patch critical flaws in a programming language underpinning roughly 70% of global websites — vulnerabilities discovered with AI assistance. The two flaws could grant unauthenticated remote access to web servers, effectively allowing threat actors to seize control without credentials.
“Technology underpins the automation of physical processes vital to modern life,” Horne said, citing electricity distribution, water facility sluice gates, dam operations, manufacturing lines, and climate control systems. He pointed to recent attacks on refrigeration systems in French supermarkets as evidence of how readily civilian infrastructure can be compromised.
The U.K. and EU allies have attributed a December 2024 attack on Poland’s energy grid to Russia’s FSB security service. Had the operation succeeded, an estimated 500,000 people could have been left without power in winter.
Malicious cyber activity costs U.K. organizations nearly $20 billion annually, according to the NCSC. In 2024, a cyberattack on Jaguar Land Rover inflicted over $260 million in direct losses, disrupting suppliers and damaging the wider economy.
“We need every organisation in the U.K. to act now — not only to protect their customers, services, and livelihoods, but because cybersecurity is now a front-line component of national defence,” said Anne Keast-Butler, director of GCHQ, the signals intelligence agency that oversees the NCSC.
The NCSC recommends implementing fundamental hygiene measures: keeping devices patched, restricting administrative privileges, and maintaining robust data backups.
