The situation
The published its 2026 annual review and a companion assessment on 3 November, concluding that AI is highly likely to increase the speed, scale and efficiency of hostile cyber activity. It expects AI chiefly to enhance reconnaissance, social engineering, vulnerability discovery and exploit development, while human operators remain necessary to direct and validate outputs.
The agency judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. It describes this as a likelihood assessment and set of plausible scenarios, not evidence of a current AI-enabled attack or a prediction of a specific operation.
Why it matters
Faster AI-assisted vulnerability discovery and exploit development could shorten the time available for critical-infrastructure operators to patch exposed systems, increasing the resilience burden on UK defenders. The assessment also places AI-enabled cyber activity within strategic competition: the agency judges that Russia, China and other states will likely use such capabilities for geopolitical aims by 2028.
What to watch
Key questions
- Do UK authorities report verified AI-enabled ransomware or malware affecting critical national infrastructure?
- Do future NCSC assessments identify AI-assisted vulnerability discovery or exploit development as materially reducing patching time for critical-infrastructure operators?
Current state
Worsening reflects the NCSC’s current assessment that AI is highly likely to accelerate hostile cyber operations and expand attackers’ ability to identify vulnerabilities and develop exploits before systems are patched. No confirmed AI-enabled attack on UK critical national infrastructure is reported.
Impacts
Military & Security
AI-assisted reconnaissance, social engineering and exploit development could make hostile cyber operations faster and more scalable, increasing the defensive burden on UK critical-infrastructure operators.
Political Stability
A ransomware disruption of critical national infrastructure could place pressure on public confidence and government crisis management, though no such AI-enabled incident is reported in the evidence.