"will be felt by us all, whether you and your organization choose to harness it or not." — NCSC CEO Richard Horne
NCSC issues a timed warning: AI-driven ransomware against critical national infrastructure by 2028
At the launch of the National Cyber Security Centre’s annual State of the Cyber Nation report in London on 3 November, NCSC CEO Richard Horne warned that AI-powered malware is "strongly expected" to appear in ransomware campaigns against the United Kingdom’s critical national infrastructure by 2028. Horne described the country as facing "a real prospect of an unprecedented rise in the number of cyber incidents," and identified power stations, airports and hospitals as likely targets of financially motivated attackers using AI-assisted tools.
AI magnifies old weaknesses rather than creating entirely new attacks
Horne argued the danger is not that AI has invented fundamentally new techniques, but that it lets attackers find and exploit pre-existing vulnerabilities at unprecedented speed and scale. "Not because AI has invented new ways to attack us," he said, "but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." He singled out organizational choices — running end-of-life systems, delaying upgrades as a cost efficiency, granting unnecessary access, buying services on price alone and failing to deploy sufficient monitoring — as the failings AI will expose.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePHP2Shell response: 110,000 proactive notifications and Early Warning alerts
The report and Horne’s remarks pointed to the PHP2Shell vulnerabilities as a recent example of the threat surfacing in practice. In response to those PHP vulnerabilities the NCSC said it issued 110,000 proactive notifications and Early Warning alerts to UK organisations. That scale of outreach underlines the agency’s contention that existing, long-standing weaknesses can be rapidly weaponised.
Government funding: Cyber Shield, NERV, AISI, Manchester centre and agentic security
The UK government has announced a set of investments the NCSC and its partners say are intended to blunt the coming AI-enabled threats. On 24 October the government revealed a £60m commitment to develop the first phase of a national Cyber Shield. That package includes a £25m Challenge Fund to support UK AI and cyber security innovators and £70m to stand up a National Exposure and Real-Time Vulnerability (NERV) Centre.
Separately, the government has allocated £120m to the AI Security Institute (AISI) and supported the NCSC’s establishment of an AI Cyber Security Centre of Excellence in Manchester to provide "world leading AI security expertise within government." The government has also committed £40m to create a National Agentic Security Unit to monitor and respond to uncontrolled AI bots, plus £24m to strengthen public-sector cyber defences using advanced AI technologies.
Measures for businesses: discounted Cyber Essentials, Cyber Resilience Pledge and software ambassadors
At the NCSC Annual Review event Cyber Security Minister Baroness Lloyd announced a 75% discount on Cyber Essentials certification for micro, small and medium-sized businesses, reducing the cost to between £80 and £125, plus VAT. More than 230 businesses have signed the government's Cyber Resilience Pledge; participating organisations will be able to refer SMEs in their supply chains for free Cyber Essentials certification and some selected businesses will receive support from a free cyber security advisor.
The government also named 14 new Software Security Ambassadors — including Fortinet, Thales, Capgemini and Zscaler — to promote secure software development and wider adoption of the Software Security Code of Practice.
What this means for technologists, policymakers, and SMEs
- Technologists and security teams: Expect pressure to inventory and replace end-of-life systems, accelerate upgrades, tighten access controls and expand monitoring — Horne warned these specific failings will be exposed as AI lowers the cost of vulnerability discovery.
- Policymakers and regulators: The NCSC flagged that nation-states such as Russia and China will "routinely use AI in their cyber activity" to advance geopolitical goals, and the UK is advancing a Cyber Security and Resilience Bill alongside a forthcoming National Cyber Action Plan to strengthen defences.
- Micro, small and medium-sized enterprises: The government’s discounted Cyber Essentials offer, the Cyber Resilience Pledge signup and free referral pathway create practical, cost-limited routes to basic certification and advisory support designed to raise minimum resilience.
Richard Horne framed the moment as a "moment of choice" for organisations: choose to invest urgently in security and resilience, he said, or face leaders having to explain "when food isn’t on shelves, lights aren’t on, businesses have gone under." The NCSC’s data point on PHP2Shell notifications, the list of targeted critical infrastructure, and the package of government funding together compose a clear policy response — but also a public reminder that much of the coming risk hinges on decisions organisations still control.
https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/
