In brief
Britain’s National Cyber Security Centre (NCSC) has issued a stark warning that an AI‑powered cyberattack on its critical infrastructure could occur within the next two years, naming China as the most likely actor. The report stresses long‑standing supply‑chain vulnerabilities and cites ongoing cyber attempts by Russia and Iran. Uncertainties remain about the timing, exact nature, and countermeasures of such an attack.
Britain’s National Cyber Security Centre (NCSC) warned on Tuesday that an AI‑powered cyberattack on its critical infrastructure could occur within the next two years, with China identified as the most likely actor.
The NCSC, part of the GCHQ spy agency, framed the warning as a call for immediate action, noting that “far too many organisations and supply chains in Britain have got away with ‘doing tech on the cheap’ for decades, leaving them vulnerable.” Chief executive Richard Horne said the coming months could see an unprecedented rise in cyber incidents, not because AI has invented new ways to attack, but because long‑tolerated vulnerabilities can now be discovered and exploited at a scale formerly unimaginable.
In its annual report, the NCSC stated it is “highly likely” that AI‑powered ransomware would strike Britain’s critical infrastructure by 2028, highlighting that hostile actors are expected to use AI to increase the scale and efficiency of their operations.
Horne also highlighted ongoing cyber activity from other state actors: “Russia is making sustained attempts to penetrate UK military networks, and Iran is carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat.” He added that “China has the intent and the technology to use AI for operations against our critical national infrastructure and other strategic targets, representing the most sophisticated and sustained cyber challenge the UK faces.”
In the wake of attacks on supermarkets across Europe that exposed IT vulnerabilities, the NCSC urged organisations to take urgent action now or explain why they have failed to make the right choices. Horne warned that, “when food isn’t on shelves, lights aren’t on, businesses have gone under, that we saw the warning signs, understood the risks and still didn’t make the right choices.”
The NCSC report also notes that Russia, China, and Iran have repeatedly denied any malevolent cyber activity, adding a layer of diplomatic uncertainty to the threat assessment.
As the NCSC prepares to speak on the matter later that day, the report underscores that long‑held vulnerabilities in supply chains can be exploited at scale once AI is brought to bear.
The uncertainties that the NCSC and supporting reports highlight include: the exact timing within the two‑year window, whether an AI‑powered ransomware campaign will coincide with a broader strategic objective, the full extent of the cyber activity expected from China, Russia and Iran, and the effectiveness of potential countermeasures that have yet to be fully developed or deployed.
