LONDON (AP) – The U.K. is projected to encounter artificial intelligence-enhanced cyberattacks targeting its critical infrastructure by 2028. This warning comes from Richard Horne, the head of the U.K.'s National Cyber Security Center (NCSC), who emphasized that both criminal entities and nation-states, notably China and Russia, are increasingly harnessing AI capabilities for cyber activity.
Horne highlighted the potential for AI-powered malware, which could facilitate ransomware attacks by identifying and exploiting "vulnerabilities that have been tolerated for far too long" and doing so "at a scale that was once unimaginable." This significant shift necessitates urgent action from business and organizational leaders who have previously cut corners on technology investments.
In a speech coinciding with the release of the NCSC's annual cyber report, Horne stressed that leaders must prepare to answer for the repercussions of outdated technology, particularly in scenarios where "food isn’t on the shelves, lights aren’t on, [and] businesses have gone under" due to insufficient cybersecurity measures.
The report categorizes Chinese cyber operations as the "most sophisticated and sustained cyber challenge facing the U.K." Both Russia and China are anticipated to leverage AI in pursuit of their geopolitical objectives. Specifically, Horne mentioned that Russia is conducting cyber campaigns that intentionally remain below the threshold of armed conflict, while Iran is reportedly targeting individuals in the U.K. posing perceived threats to its regime.
While the use of AI by states and criminals is likely to enhance the scale and efficiency of these malicious operations, the report indicates that AI will more probably be used to refine existing tactics rather than uncover entirely new vulnerabilities. This methodology of exploitation is already apparent, as demonstrated by recent developments where governments and corporations were compelled to implement urgent security updates following AI-assisted identification of critical vulnerabilities in a programming language used by approximately 70% of global websites.
These vulnerabilities could potentially allow unauthorized access to websites, enabling cybercriminals to gain control of web servers without needing a password. Horne pointed out that modern technology is deeply integrated into the automation of vital physical processes—such as electricity management, water control, manufacturing, and refrigeration systems. Recent cyberattacks on refrigeration systems in French supermarkets underscore the ease with which hostile actors can disrupt civilian infrastructure.
In light of these developments, U.K. officials have reported that malicious cyber activities are costing organizations nearly $20 billion annually. Notably, in 2025, the car manufacturer Jaguar Land Rover experienced over $260 million in direct losses due to a cyberattack that also adversely affected its suppliers and had a detrimental impact on the broader U.K. economy.
Anne Keast-Butler, director of GCHQ—Britain's signals intelligence agency, which encompasses the NCSC—urged every organization in the U.K. to take immediate action. She emphasized that cybersecurity is now an essential component of the nation’s defense, calling for measures that protect not only customers and services but also livelihoods.
The NCSC recommends implementing fundamental yet effective cybersecurity practices. These include ensuring that devices are updated regularly, restricting administrator access to critical systems, and backing up essential files and data. The pressing need for enhanced cybersecurity measures is evident, especially as the threat landscape continues to evolve with the integration of AI technologies in cyber operations.
