The UK will face AI-powered attacks from nation-states and criminal groups targeting critical national infrastructure within two years.
The use of artificial intelligence (AI) by hostile states and crime groups will increase the scale and speed of ransomware attacks, social engineering and the exploitation of vulnerabilities, according to an assessment published today.
Russia and China will routinely use AI-powered cyber tools to achieve their geopolitical goals, according to an assessment by the National Cyber Security Centre (NCSC), part of GCHQ.
The NCSC also predicts that between now and 2028, AI-powered malware will have been used in a ransomware attack on critical national infrastructure in the UK.
In a worst-case scenario, the UK could face automated attacks from frontier AI capable of self-replicating and conducting cyber attacks at will.
The UK is at a point of “enormous consequence” and faces “a moment of choice” over how to respond to AI-powered threats, the NCSC’s CEO Richard Horne is expected to say in a speech today.
Moment of choice
“When food isn’t on shelves, lights aren’t on, businesses have gone under … we may have to explain that we saw the warning signs, understood the risks, and still didn’t make the right choices,” he will warn.
Organisations will need to make “significant” changes to protect critical systems and will no longer be able to rely on “technology on the cheap”.
That includes securing the technology that controls physical infrastructure, including electricity switches, dams, manufacturing lines, and heating and refrigeration controls, where investment in security and resilience has been less of a priority.
Cyber attacks on hundreds of refrigerators in French supermarkets, which destroyed millions of euros of food last month, show that exposure of countries to cyber risks is “huge”.
Military networks targeted
Military networks are subject to sustained, persistent attempts to penetrate communications by countries such as Russia, which is exploiting tactics developed in Ukraine against states and institutions.
Hybrid warfare campaigns are “escalating”, while intentionally falling below the threshold of armed conflict, according to the NCSC.
Despite the pressures of the Middle East conflict, Iran is still carrying out malicious cyber operations targeting the UK and individuals seen as a threat to the regime.
China is the best positioned to use AI for operations against UK critical national infrastructure and other strategic targets.
It represents the most “sophisticated and sustained” cyber challenge faced by the UK, according to the NCSC.
Unprecedented rise in cyber attacks
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” Horne is expected to say.
Organisations will need to make “different choices” with their technology. That means addressing past failures to adequately invest in security, not having technology unnecessarily connected to the internet, and building greater resilience.
“We can be a nation where leaders of all organisations actively choose to invest with urgency … and where all organisations make security and resilience a fundamental requirement, not an afterthought,” he will say.
Failing to make these choices will mean business leaders having to “look their investors, shareholders, employees, customers, suppliers in the eye and explain … when food isn’t on shelves, lights aren’t on, businesses have gone under”.
The AI security divide
AI has the potential to be one of the greatest opportunities in cyber defence, allowing technology companies to fix hundreds of vulnerabilities in a single update, the NCSC claims.
Organisations with mature cyber security programmes, robust governance and sufficient resources will be able to detect threats, prioritise vulnerabilities and automate their defences, according to the NCSC’s State of the cyber nation report.
Weaker organisations are likely to struggle to keep pace with AI-assisted attacks, creating a widening gap between resilient and vulnerable organisations.
Cost of cyber attacks to UK
The NCSC estimates that malicious cyber activity costs UK organisations an estimated £14.7bn every year.
The attack on Jaguar Land Rover had a direct impact on GDP, contributing to lower growth in the UK economy than expected.
The centre received 1,830 reports of cyber attacks during the past year, of which 80 were classed as nationally significant.
The bulk of state-backed attacks seen by the NCSC to date do not use advanced, autonomous AI, but exploit common vulnerabilities and exposures that are known to work, but that could change rapidly.
Cyber Shield
The NCSC’s warning comes as the government is investing in the UK’s defence and resilience capabilities, including the development of a national Cyber Shield that will use agentic AI to build a national-scale cyber defence capability.
A National Exposure and Real-Time Vulnerability (NERV) Centre will use AI to identify security vulnerabilities across critical national infrastructure and the economy.
