UK Cyber Warning Puts AI, Aging Systems and Supply Chains in Focus

The central risk in the UK’s latest cyber assessment is the combination of increasingly capable automated tools and weaknesses that organizations have left in place for years. The National Cyber Security Centre (NCSC) says a ransomware attack involving AI-powered malware on the country’s critical infrastructure is highly likely by 2028. It also warns that hostile actors could use AI to increase the scale and efficiency of their operations.

That forecast points to a change in the economics of cyberattacks. AI doesn’t need to create a new way into a system to raise the danger. As NCSC chief executive Richard Horne put it, vulnerabilities tolerated for too long can now be “discovered and exploited at a scale that was once unimaginable.” Faster discovery can give attackers more opportunities to find weak points across connected organizations and suppliers, while defenders still need to identify and fix each exposure.

Old weaknesses, faster discovery

Horne’s criticism is aimed at years of underinvestment in technology and security. He said too many organizations and supply chains had “doing tech on the cheap,” leaving them vulnerable. The concern is practical: when systems are outdated, poorly maintained or connected to less secure suppliers, one organization’s weakness can create a route toward others.

AI can intensify that exposure by helping hostile actors work through potential targets more quickly and efficiently. The NCSC’s warning describes a likely increase in the scale of activity, rather than claiming that AI has invented a wholly new class of attack. That distinction matters for organizations deciding where to focus. The basic work of finding known weaknesses, limiting access and keeping systems maintained remains central, even as attackers gain tools that may make their operations faster.

Horne also warned of a “real prospect of an unprecedented rise in the number of cyber incidents” in the coming months. The statement describes a near-term risk of more incidents alongside the NCSC’s longer horizon for an attack on critical infrastructure. It doesn’t provide a forecast for incident totals or identify a particular organization as a target.

Attribution and uncertainty

The NCSC assessed China as highly likely to have both the intent and the strongest position to use AI against UK critical infrastructure and other strategic targets. Horne described activity linked to China as the most sophisticated and sustained cyber challenge facing the UK. Those are assessments of capability and intent, not a prediction that a particular attack will occur on a particular date.

The assessment also points to cyber activity associated with Russia and Iran. Horne was due to say that Russia had made sustained efforts to penetrate UK military networks and that Iran had conducted malicious operations internationally, including against the UK and people it viewed as threats. China, Russia and Iran have repeatedly denied similar accusations of hostile cyber activity.

Attribution carries uncertainty: identifying the actor behind an intrusion can be difficult, and assessments of capability don’t establish who will carry out a future attack. For companies and infrastructure operators, the practical concern is that attack methods can spread across sectors and supply chains regardless of who is responsible. The assessment offers no incident probability beyond its stated judgment that an AI-enabled ransomware attack by 2028 is highly likely.

Potential costs beyond IT

Cyber disruption to infrastructure can reach well beyond an organization’s technology teams. Horne pointed to the consequences of food disappearing from shelves, power failing and businesses collapsing. Those examples show why the potential effects extend to customers, workers and suppliers, as well as the organization whose systems are compromised.

Recent hacking attacks on supermarkets across Europe have exposed weaknesses in IT systems, the source report said. The examples make supply chain exposure more tangible: retailers depend on interconnected systems and external providers to keep operations running. A disruption at one point can complicate the flow of goods or services elsewhere, even when an affected business was not the attacker’s original target.

For companies, the financial exposure may include interruption, recovery costs and lost business; the assessment doesn’t quantify those costs or estimate how widely a future attack could spread. The potential impact will depend on which systems are reached, how quickly organizations contain the incident and whether essential services can continue through alternative arrangements.

What to watch

The NCSC’s warning puts the next two years in view, while Horne’s comments point to possible growth in incidents over the coming months. The key question for organizations is whether their current technology and supplier relationships can withstand faster, more efficient attacks. The assessment does not specify a checklist or prescribe a spending level, but it makes clear that long-standing weaknesses are part of the risk.

Operators and their customers will be watching whether organizations act on known exposures before they become openings for attackers. The NCSC’s warning is a forecast, not evidence that an attack is inevitable. Its clearest message is that AI may increase the speed and reach of existing threats, while the consequences will depend heavily on how well organizations have secured the systems and supply chains they already rely on.