The UK’s National Cyber Security Centre (NCSC) has warned that AI-powered malware is “highly likely” to be used in a ransomware attack on the UK’s critical national infrastructure by 2028. That is the headline finding of the “State of the Cyber Nation” report, published on Tuesday 3 November as part of the NCSC Annual Review.
What the report says
The NCSC, part of GCHQ, reviewed the period from 1 September 2025 to 31 August 2026. Within two years, it says, hostile use of AI is highly likely to increase the scale and efficiency of ransomware, social engineering and the exploitation of software vulnerabilities.
The key caveat: AI is not inventing entirely new attack methods. Rather, long-tolerated weaknesses can now be found and exploited at far greater scale. NCSC chief executive Dr Richard Horne said that for decades “we have collectively got away with doing tech on the cheap”.
According to the Associated Press, the report names China as the most sophisticated and sustained cyber challenge facing the UK, and also describes activity by Russia and Iran. Horne pointed to physical processes that depend on technology: electricity switching, water sluice gates, manufacturing lines, refrigeration and heating.
What the government is doing
The NCSC highlighted investment announced the previous week: £60m for the first phase of a national Cyber Shield, £70m for the NERV vulnerability centre and a new AI Cyber Security Centre of Excellence in Manchester. The Cyber Security and Resilience Bill is going through Parliament.
On the same day the government opened the Cyber Essentials First Step Fund, giving small and medium-sized firms a 75% discount on Cyber Essentials certification.
What it means for Polish businesses in the UK
Our view: the most exposed firms are not the big players but their small suppliers. AI-assisted attackers look for the weakest link in the supply chain. A Polish construction, haulage, cleaning or IT firm serving a hospital, a water company, a cold store or a retail chain is exactly that kind of link.
The evidence: the NCSC explicitly lists refrigeration, heating and production lines as targets. The AP recalls that the 2025 attack on Jaguar Land Rover also hit its suppliers. The government estimates (an indicative figure, largely extrapolated from US data) that a significant cyber attack costs a UK business £195,000 on average.
Large customers increasingly require Cyber Essentials from their suppliers. But the NCSC stresses that the certificate is “the starting point, not the end goal”.
Three things to do now
- Updates. Switch on automatic updates for computers, phones, routers and accounting software.
- Admin rights. Only for people who genuinely need them. Staff should use standard accounts day to day.
- Backups. Regular, stored separately (offline or in a separate cloud) and tested to make sure data can be restored.
The NCSC also advises against connecting devices to the internet when they do not need it, such as machine or refrigeration controllers.
Beware of social engineering: AI can produce flawless emails and voice messages, including in Polish. Always confirm any urgent payment request or change of supplier bank details by phone, using a number you already know.
Sources:
- NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years (3.11.2026)
- GCHQ: NCSC Annual Review 2026 – The State of the Cyber Nation (3.11.2026)
- Associated Press (via WKMG): UK cyber chief says the UK will face AI cyberattacks on critical infrastructure by 2028
- GOV.UK: New Government-backed cyber security protections could save UK businesses thousands (3.11.2026)
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
