NCSC Warns AI-Powered Ransomware Likely to Hit UK Critical Infrastructure by 2028
The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report, warning that AI-powered malware is highly likely to be used in ransomware attacks against UK critical national infrastructure—power stations, airports and hospitals—by 2028. NCSC CEO Richard Horne said the threat stems not from AI inventing new attack methods but from long-tolerated vulnerabilities now being discoverable and exploitable at unprecedented scale, citing poor investment, end-of-life systems, and weak access controls as root causes. He highlighted the PHP2Shell vulnerabilities as a recent example, noting 110,000 proactive notifications and Early Warning alerts issued to UK organizations. The report also warns that nation-state actors including Russia and China will increasingly use AI to pursue geopolitical goals via cyber operations.
Remediação
The UK government announced £60m for a national Cyber Shield initiative (including a £25m Challenge Fund and £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre), an additional £120m for the AI Security Institute (AISI), a new AI Cyber Security Centre of Excellence in Manchester run by NCSC, £40m for a National Agentic Security Unit, and £24m to strengthen public-sector AI-based cyber defenses. A 75% discount on Cyber Essentials certification was announced for micro, small and medium businesses, and 14 Software Security Ambassadors (including Fortinet, Thales, Capgemini and Zscaler) were named to promote secure software development. Bridewell CEO Anthony Young called the two-year warning timeline "generous," pointing to recent attacks on supermarket refrigeration systems as evidence attackers are already exploiting basic weaknesses at scale.
Linha do tempo
-
NCSC Warns AI-Powered Ransomware Likely to Hit UK Critical Infrastructure by 2028
ler a análise desta fonte ocultar
The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report, warning that AI-powered malware is highly likely to be used in ransomware attacks against UK critical national infrastructure—power stations, airports and hospitals—by 2028. NCSC CEO Richard Horne said the threat stems not from AI inventing new attack methods but from long-tolerated vulnerabilities now being discoverable and exploitable at unprecedented scale, citing poor investment, end-of-life systems, and weak access controls as root causes. He highlighted the PHP2Shell vulnerabilities as a recent example, noting 110,000 proactive notifications and Early Warning alerts issued to UK organizations. The report also warns that nation-state actors including Russia and China will increasingly use AI to pursue geopolitical goals via cyber operations.
Remediation
The UK government announced £60m for a national Cyber Shield initiative (including a £25m Challenge Fund and £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre), an additional £120m for the AI Security Institute (AISI), a new AI Cyber Security Centre of Excellence in Manchester run by NCSC, £40m for a National Agentic Security Unit, and £24m to strengthen public-sector AI-based cyber defenses. A 75% discount on Cyber Essentials certification was announced for micro, small and medium businesses, and 14 Software Security Ambassadors (including Fortinet, Thales, Capgemini and Zscaler) were named to promote secure software development. Bridewell CEO Anthony Young called the two-year warning timeline "generous," pointing to recent attacks on supermarket refrigeration systems as evidence attackers are already exploiting basic weaknesses at scale.