NCSC warns AI will accelerate attacks on UK critical infrastructure by 2028

The National Cyber Security Centre has published a new threat assessment warning that the UK faces AI-enabled attacks on critical infrastructure within the next two years. The assessment, which projects the threat landscape through to 2028, sets out that years of underinvestment in cyber resilience — described by the NCSC as 'tech on the cheap' — has left many UK organisations carrying longstanding security weaknesses that AI tools are increasingly capable of identifying and exploiting at scale and speed. The NCSC is calling for urgent investment in resilience across both public and private sector organisations.

Why this matters for UK organisations

The NCSC's warning is grounded in observed trends rather than speculation, and the two-year timeframe places this squarely within current business planning cycles. The key insight in the assessment is that AI does not create new categories of vulnerability — it makes existing weaknesses faster and easier to find and exploit. Unpatched systems, weak identity controls, poor network segmentation and legacy infrastructure are not new problems, but they become significantly more dangerous in an environment where attackers can automate the discovery and exploitation of those weaknesses at a scale that was previously impractical. Sectors that have historically underinvested in security — including parts of healthcare, education, local government, manufacturing and logistics — are likely to face the most acute exposure as AI-enabled attack capability matures. For organisations in these sectors, the NCSC's assessment is a prompt to treat security investment as a strategic priority rather than a cost to be minimised.

What to review

Organisations should begin by taking stock of known security debt — the systems, configurations and processes that have been identified as weaknesses but not yet addressed. This includes unpatched or end-of-life software, legacy systems without compensating controls, identity and access management gaps, and incident response plans that have not been tested recently. The NCSC's call for investment in resilience is practical rather than abstract: organisations that address foundational weaknesses now will be better positioned to withstand the more sophisticated, AI-assisted attack activity the agency expects to emerge over the next two years. Security leaders should use this assessment to build the case for investment with boards and senior leadership, framing it in terms of the operational and reputational risk of inaction rather than the technical detail of the threat itself.

Source: NCSC UK