The UK’s National Cyber Security Centre (NCSC) said in its annual review, published on 3 November, that “it is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack” on the UK’s critical national infrastructure. The review covers September 2025 to August 2026, a year in which the NCSC handled 337 incidents needing its support, 80 of them nationally significant.
The agency says frontier AI makes sophisticated attacks “easier, faster and cheaper” even for low-skilled hackers, and that skilled people using AI can exploit old technical debt “at scale and at pace”. It expects a wave of software updates, some of them critical. Chief executive Richard Horne wrote: “AI did not create these cyber security weaknesses; it revealed them.”
The review also describes the defensive side. Project DROMOS, run with the AI Security Institute, uses frontier models to search government systems for flaws and has found “hundreds of potential security issues, including critical vulnerabilities”, with people deciding what to fix first. Cyber Shield is a five-year programme to build automated detection and response at national scale.
For organisations, the advice is practical: treat Cyber Essentials as a starting point, apply updates quickly, and know what access any AI agents have. The NCSC still expects AI to be a net positive for defence.
Source: NCSC Annual Review 2026