:COUNTER [links:https://www.ncsc.gov.uk/collection/annual-review-2026]
337 NCSC incidents handled in 2025-26

:QUOTE [links:https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years, quotetype:plain, subtitle:Dr. Richard Horne - NCSC CEO - 3 Nov 2026]
Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.

:STATS [links:https://www.ncsc.gov.uk/collection/annual-review-2026]
[icon:BOLT] Nationally significant incidents | 80 of 337
[icon:FIRE] Annual cost to UK organisations | ~$20 billion
[icon:TRENDING_UP] JLR attack direct losses (2025) | $260 million+
[icon:CHART] UK share of global phishing (Jun 2026) | 1.06%
[icon:DOLLAR] Govt Cyber Action Plan investment | £210 million+
[icon:TARGET] Cyber Shield first phase (AI defence) | £60 million
[icon:CLOCK] NERV Centre (real-time vulnerability) | £70 million

:TABLE [title:State actors named in NCSC 2026 review, links:https://www.ncsc.gov.uk/collection/annual-review-2026]
Actor | NCSC assessment | Primary target
China | Highly likely has intent; best positioned to use AI against CNI | Critical national infrastructure
Russia | Sustained attempts to penetrate UK military networks; AI use highly likely by 2028 | Defence and government
Russia FSB | Linked to Dec 2025 Poland energy grid attack | Energy (500,000 at risk)

:TIMELINE [links:https://www.ncsc.gov.uk/collection/annual-review-2026]
AI cyber threat: from isolated incidents to systemic risk
2025-12-01 | Russia's FSB linked to Poland energy grid attack; 500,000 at risk of blackout
2026-09-01 | NCSC review period opens (Sept 2025-Aug 2026): 337 incidents, 80 nationally significant
2026-11-03 | NCSC Annual Review 2026 published; "highly likely" AI malware will hit UK CNI by 2028
2026-11-03 | UK Government Cyber Action Plan announced; more than £210 million in backing
2027-01-01 | NERV Centre (National Exposure and Real-Time Vulnerability) begins operations
2028-01-01 | NCSC assessment window: AI-powered ransomware attack on UK CNI expected by this date

:INFO
What the NCSC says and what it does not
The review says it is "highly likely" AI-powered malware will be used in a ransomware attack on UK critical national infrastructure (CNI) by 2028. CNI covers power stations, airports, hospitals, water systems, food supply and financial services.
• AI did not create these weaknesses, the report says; it accelerated their discovery and exploitation at scale.
• China is described as the most sophisticated and sustained challenge; Russia as the most active near-term threat.
• The report does not name a specific planned attack or name a specific target.
• The 2025 Jaguar Land Rover breach is cited as a private-sector benchmark (more than $260 million in direct losses).
• Defensive AI programme Project DROMOS already found hundreds of potential issues in government networks.

:INFO
What is not yet confirmed
• No date has been set for the NERV Centre to go fully operational.
• No breakdown of the £210 million total investment by year or department has been published.
• No assessment of whether the 2028 deadline applies equally to Scotland, Wales and Northern Ireland devolved infrastructure.
• The AI Cyber Security Centre of Excellence in Manchester has no confirmed launch date.

:CHECKLIST [links:https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years]
What comes next
[ ] Cyber Shield phase 1 deployment (funded; timeline not yet public)
[ ] NERV Centre launch: real-time scanning of public-sector attack surface
[ ] AI Cyber Security Centre of Excellence to open in Manchester
[ ] Government Cyber Action Plan implementation milestones (expected Q1 2027)
[ ] Next NCSC Annual Review: covers Sept 2026 to Aug 2027

:LINK
https://www.ncsc.gov.uk/collection/annual-review-2026
NCSC Annual Review 2026 (primary source)

:LINK
https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
NCSC press release: AI-powered attacks within two years

:LINK
https://therecord.media/uk-ncsc-predicts-rise-cyberattacks-coming-months
The Record: UK NCSC predicts unprecedented rise in attacks

:LINK
https://www.theguardian.com/technology/2026/nov/03/ai-powered-malware-artificial-intelligence-hacking-critical-uk-infrastructure
The Guardian: AI-powered malware 'highly likely' to hack UK infrastructure

:NOTE
Sources: NCSC Annual Review 2026 (primary); The Guardian 00:01 UTC 3 Nov 2026; The Record Media; Washington Times; WSLS/AP wire. All figures sourced directly from the NCSC report or attributed press statements. No invented projections.