UK Cyber Chief Warns of AI-Powered Attacks on Critical Infrastructure by 2028
Britain faces a high probability of artificial intelligence-driven cyberattacks targeting its critical infrastructure by 2028, driven by hostile states and criminal organizations adopting automated malware and scaling exploitation tools, the National Cyber Security Centre warned Tuesday.
National Cyber Security Centre Warning On Artificial Intelligence Threats
The U.K. will likely encounter AI-powered cyberattacks on essential national systems by 2028, according to an annual cyber report released by the National Cyber Security Centre. Richard Horne, head of the NCSC, stated that threat actors including China and Russia are increasingly integrating artificial intelligence into their offensive operations. This adoption will enable the discovery and exploitation of long-tolerated vulnerabilities at an unprecedented scale, Horne noted in a speech in London.
The agency’s findings indicate that artificial intelligence is more likely to augment and scale existing tactics rather than unearth entirely novel flaws. Last week, governments and corporations raced to apply urgent security updates after an AI-assisted discovery revealed two critical vulnerabilities in a programming language underpinning 70% of global websites. These flaws could theoretically grant unauthenticated remote access to web servers without requiring a password.
State-backed cyber activity presents distinct challenges across different geopolitical actors. The NCSC report identifies Chinese cyber operations as the most sophisticated and sustained challenge facing the United Kingdom. Meanwhile, Russia regularly conducts campaigns operating beneath the threshold of armed conflict, and Iran targets both the U.K. and individuals perceived as threats to the Iranian regime, according to Horne.
Infrastructure Vulnerabilities Across Transportation, Water, and Energy Systems
Modern automated physical processes vital to daily operations remain exposed to hostile digital intrusions. Horne highlighted systems controlling electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls as primary targets. Recent incidents, such as cyberattacks targeting refrigeration systems in French supermarkets, demonstrate the ease with which bad actors can exploit civilian infrastructure.
Cross-border aggression against critical assets has already materialized in Europe. U.K. and European Union member states attributed a December 2025 cyberattack on Poland’s energy grid to Russia’s FSB security service, an incident that nearly cut electricity to 500,000 people during winter. Within Britain, malicious cyber activity drains nearly $20 billion annually from organizations. In 2025, automaker Jaguar Land Rover sustained more than $260 million in direct losses from a cyberattack that disrupted suppliers and impacted the broader national economy.
Organizations of all sizes that have relied on cheap technology without adequate security investments face stark accountability. Horne warned that business leaders will ultimately have to explain why food supplies vanished from shelves or lights went out if they neglect cybersecurity infrastructure.
UK Government Funds National Cyber Defense Capabilities
To counteract escalating threats, the U.K. government is advancing defensive capabilities through the Cyber Security and Resilience Bill and the National Cyber Action Plan. Recent funding allocations include £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre, and an AI Cyber Security Centre of Excellence in Manchester run by the NCSC.
Anne Keast-Butler, director of GCHQ—the signals intelligence agency housing the NCSC—emphasized that cybersecurity constitutes part of the nation’s frontline defense. Officials are urging organizations to adopt basic protective measures immediately, including updating devices, restricting administrative access, and maintaining comprehensive data backups.
Despite these institutional measures, the timeline for commercial sectors to overhaul outdated technology remains tight. Whether private enterprises will address foundational software vulnerabilities before automated attacks scale by 2028 is an open question.