By 2028 the UK is likely to face cyberattacks on critical infrastructure that use artificial intelligence (AI), Richard Horn, head of the National Cyber Security Centre (NCSC), warned on Tuesday. According to him, criminals and states, including China and Russia, are increasingly using AI in their cyber activity.
Horn spoke at the presentation of the NCSC's annual report. He noted that AI will allow malicious actors to find and exploit vulnerabilities - weak points in software - on a scale that once seemed unthinkable. This concerns long-known but ignored security holes.
According to Horn, the heads of companies and organizations of any size that have economized on technology will have to explain why products are not on the shelves, the lights are not on, and the business has gone bankrupt if they do not invest in cybersecurity or do not update outdated equipment and software.
The NCSC report states: Chinese cyber activity is the most complex and prolonged cyber challenge for the UK. Russia and China are expected to regularly use AI to achieve geopolitical goals. Russia, according to the center, deliberately conducts cyber campaigns that do not reach the threshold of armed conflict. Iran, according to Horn, attacks the UK and pursues individuals who pose a threat to the Iranian regime.
The report emphasizes: the use of AI by states and criminals is likely to increase the scale and effectiveness of hostile operations. However, AI will more often amplify and scale existing tactics and techniques rather than find fundamentally new vulnerabilities.
Last week, governments and corporations urgently issued security updates after AI was used to discover vulnerabilities in a programming language critical to 70% of websites worldwide. Two serious flaws found by AI could have allowed malicious actors to access websites without authentication - that is, without confirming identity - and theoretically to remotely control a web server without a password.
Horn recalled that technology underlies the automation of physical processes vital to modern life. Among them are switching power grids, gates at water utilities, the operation of dams, production lines, and heating and cooling systems. Recent cyberattacks on cooling systems in French supermarkets showed how easily hostile forces can use civilian infrastructure, he noted.
According to the UK and EU countries, Russia has already attacked critical infrastructure in Europe: the FSB is blamed for an attack on Poland's power grid in December 2025. In the UK, malicious cyber activity costs organizations almost $20 billion annually, the NCSC reports. In 2025, automaker Jaguar Land Rover suffered more than $260 million in direct losses after a cyberattack that also affected suppliers and damaged the country's economy.
We need every organization in the UK to act now. Not only to protect their customers, services and livelihoods, but also because cybersecurity has become part of our country's front line of defense, said Anne Keast-Butler, director of GCHQ - the British signals intelligence service, which includes the NCSC.
The center recommends implementing basic but effective measures: keep devices up to date, limit administrator rights in systems, and back up important files and data.