UK AI Cyberattack on Infrastructure by 2028: NCSC
337NCSC incidents handled in 2025-26
"Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.
"Dr. Richard Horne - NCSC CEO - 3 Nov 2026
Nationally significant incidents
80 of 337
Annual cost to UK organisations
~$20 billion
JLR attack direct losses (2025)
$260 million+
UK share of global phishing (Jun 2026)
1.06%
Govt Cyber Action Plan investment
£210 million+
Cyber Shield first phase (AI defence)
£60 million
NERV Centre (real-time vulnerability)
£70 million
State actors named in NCSC 2026 review
| Actor | NCSC assessment | Primary target |
|---|---|---|
| China | Highly likely has intent; best positioned to use AI against CNI | Critical national infrastructure |
| Russia | Sustained attempts to penetrate UK military networks; AI use highly likely by 2028 | Defence and government |
| Russia FSB | Linked to Dec 2025 Poland energy grid attack | Energy (500,000 at risk) |
What the NCSC says and what it does not
The review says it is "highly likely" AI-powered malware will be used in a ransomware attack on UK critical national infrastructure (CNI) by 2028. CNI covers power stations, airports, hospitals, water systems, food supply and financial services.
AI did not create these weaknesses, the report says; it accelerated their discovery and exploitation at scale.
China is described as the most sophisticated and sustained challenge; Russia as the most active near-term threat.
The report does not name a specific planned attack or name a specific target.
The 2025 Jaguar Land Rover breach is cited as a private-sector benchmark (more than $260 million in direct losses).
Defensive AI programme Project DROMOS already found hundreds of potential issues in government networks.
What is not yet confirmed
No date has been set for the NERV Centre to go fully operational.
No breakdown of the £210 million total investment by year or department has been published.
No assessment of whether the 2028 deadline applies equally to Scotland, Wales and Northern Ireland devolved infrastructure.
The AI Cyber Security Centre of Excellence in Manchester has no confirmed launch date.
What comes next
Cyber Shield phase 1 deployment (funded; timeline not yet public)
NERV Centre launch: real-time scanning of public-sector attack surface
AI Cyber Security Centre of Excellence to open in Manchester
Government Cyber Action Plan implementation milestones (expected Q1 2027)
Next NCSC Annual Review: covers Sept 2026 to Aug 2027
Sources: NCSC Annual Review 2026 (primary); The Guardian 00:01 UTC 3 Nov 2026; The Record Media; Washington Times; WSLS/AP wire. All figures sourced directly from the NCSC report or attributed press statements. No invented projections.