NCSC warns AI-powered attacks on UK critical infrastructure are coming within two years

The National Cyber Security Centre has published a significant threat assessment warning that the UK faces AI-enabled attacks on critical national infrastructure within two years. The NCSC's assessment, which projects the threat landscape through to 2028, describes how AI is lowering the barrier for adversaries to discover and exploit longstanding security weaknesses — the product of years of underinvestment that the NCSC characterises as 'tech on the cheap'. The warning comes directly from the NCSC's leadership and is accompanied by a call for urgent and sustained investment in resilience across both public and private sector organisations.

Why this matters for UK organisations

The NCSC's assessment is significant because it reframes AI as an accelerant of existing risk rather than a source of entirely new attack techniques. Threat actors using AI-assisted tooling can scan for unpatched systems, identify misconfigured services and discover exploitable weaknesses far more quickly and at far greater scale than was previously practical. This means that organisations carrying technical debt — deferred patching, legacy systems, poor network segmentation, weak access controls — are now facing a materially shorter window before those weaknesses are found and exploited. The assessment is particularly relevant for sectors that form part of the UK's critical national infrastructure, including energy, water, transport, healthcare and financial services, but its implications extend to any organisation with ageing technology or unresolved security gaps. Boards and senior leadership teams should treat this as a strategic signal that the cost of continued deferral is rising.

What to review

Organisations should use this assessment as a prompt for an honest review of where security investment has been deferred and what the realistic exposure looks like. Vulnerability management programmes should be assessed for coverage and timeliness — are all asset types included, and are patches being applied within a timeframe that reflects actual risk? Network architecture should be reviewed to ensure that critical systems are appropriately segmented. Resilience planning, including incident response and recovery capabilities, should be tested rather than assumed. For boards and executive teams, the NCSC's assessment provides a clear basis for a structured conversation about cyber risk appetite and investment priorities ahead of the 2028 horizon it describes.

Source: NCSC UK