# The NCSC expects AI to make familiar cyber attacks faster by 2028 The UK cyber agency judges that AI-powered malware will very likely appear in a ransomware attack on critical infrastructure by 2028. Its scenarios describe possible paths, not predictions.[1] The UK's National Cyber Security Centre published a scenario assessment on November 3, 2026 covering AI-enabled cyber intrusion through 2028.[1] It judges that states will routinely use AI for geopolitical cyber operations, that many systems will remain exposed to faster vulnerability discovery and exploitation, and that AI-powered malware will very likely appear in a ransomware attack on UK critical infrastructure.[1] The report does not predict an autonomous AI attacker or a specific incident. Its baseline, pessimistic and optimistic scenarios test how geopolitics, legacy systems, model progress, access to offensive tools and workforce skills could interact.[1] Teams do not need a speculative new security stack to respond. They need a current asset inventory, faster risk-based patching, tighter identity controls, tested recovery, protected logs and constrained AI deployments. The NCSC's own guidance puts those controls ahead of waiting for autonomous defence.[2][3] ## What the NCSC actually judged [The November 3 NCSC assessment [1]](https://www.ncsc.gov.uk/report/artificial-intelligence-and-cyber-intrusion) uses the UK intelligence community's probability terms. It calls routine state use of AI-cyber by 2028 highly likely and says sophisticated attacks will increase in speed and scale.[1] The agency calls continued exposure almost certain because AI tools can find and exploit weaknesses while many organisations still carry unpatched or unsupported systems.[1] Attackers can replace a lost access path cheaply, so they may accept more risk during an operation. For critical national infrastructure, the NCSC judges that attackers are likely to target known flaws in legacy technology and weaknesses introduced by new AI systems. It also judges that AI-powered malware will very likely have appeared in a ransomware attack on UK critical infrastructure by 2028.[1] ## Three scenarios, with different assumptions The baseline scenario combines high geopolitical tension, broader offensive access, more zero-day discovery and defensive adoption that trails the attackers. The NCSC treats this as a plausible path rather than a forecast.[1] The pessimistic scenario adds widespread frontier capability, weaker attribution, more criminal access and the possibility of an automated actor operating beyond its original operator's control. The agency labels that last outcome a realistic possibility inside a scenario, which carries less certainty than the report's main judgements.[1] The optimistic scenario assumes slower model progress, modernised infrastructure, better workforce education, strong basic security and effective regulation. It shows which conditions could preserve defensive advantage, but the report does not say those conditions will occur.[1] ## What changed, and what did not NCSC chief executive Richard Horne told Reuters that AI has not invented a new class of attack. He said tolerated vulnerabilities can now be discovered and exploited at far greater scale.[5] That distinction matters for planning: faster reconnaissance and exploitation shorten the time available to patch, detect and contain. AI can help a skilled operator search code, adapt tools, process stolen data and run parallel experiments. The assessment does not establish that models can independently plan and complete every stage of a sophisticated intrusion.[1] Defenders face a different constraint. An attacker can optimise for one technical success, while a defender must preserve safety, uptime, legal duties and business operations. The NCSC therefore warns that organisations cannot assume agentic defence will arrive soon enough to compensate for weak fundamentals.[4] ## A two-year defensive plan - Map internet-facing services, critical internal systems, unsupported technology, machine identities and AI agents to named owners. - Adopt update-by-default rules and use active exploitation, exposure, consequence and available mitigations to set patch order.[2] - Measure the time from vulnerability disclosure to inventory match, owner assignment, mitigation, patch and verification. Reduce that interval each quarter. - Give agents separate identities with short-lived credentials, narrow tool permissions, default-deny network rules and complete action logs. - Protect backups and recovery credentials from the production identity plane, then rehearse isolation and restoration under time pressure. - Keep deterministic controls for high-consequence defensive actions. Require a person to approve destructive, safety-critical or hard-to-reverse changes.[4] - Run a tabletop exercise where attackers discover and exploit an exposed weakness faster than the normal change process can patch it. ## How to use AI on defence without adding a second hazard [The NCSC's agentic AI guidance [3]](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai) recommends denying network traffic by default, allowing only required connections, setting the right level of human oversight and starting experiments when staff can watch them.[3] A safe first use is recommendation rather than autonomous action: let a system correlate asset data, advisories and logs, then require an accountable operator to approve the response. Deterministic automation can handle narrow, tested actions such as forcing re-authentication after a defined signal.[3] Evaluate the full workflow. Track missed assets, false priorities, unsafe tool calls, time saved, analyst corrections and recovery from a bad recommendation. A fast model that sends an incomplete asset list to the patch queue can make response worse. ## Limits and open questions - The report gives scenario judgements rather than a measured forecast of incident counts, losses or model capability.[1] - The public assessment does not expose the classified intelligence or all industry evidence behind each probability judgement.[1] - The pessimistic autonomous-actor scenario is a realistic possibility, not the report's central prediction.[1] - The assessment covers the UK through 2028. Other countries, sectors and organisations have different legacy estates, adversaries and response capacity. - Faster defensive tools do not remove approval, accountability, procurement and change-management constraints.[4] ## Frequently asked questions - Does the NCSC predict an autonomous AI cyber attacker by 2028? No. It includes that outcome as one realistic possibility in its pessimistic scenario.[1] - Does the report say AI created new attack methods? No. The NCSC's public explanation focuses on greater speed, scale and efficiency applied to known cyber work.[1][5] - What should a small organisation do first? Inventory exposed systems, patch active exploitation, protect administrator identities and test backups before buying specialised AI defence tools.[2] - Should defenders let agents patch production automatically? Begin with recommendations and narrow deterministic actions. Expand autonomy only after testing permissions, monitoring, rollback and human oversight.[3][4] - Why does legacy technology matter? Unsupported and hard-to-change systems give attackers a longer window to apply faster discovery and exploitation tools.[1] ## Sources - [[1] UK NCSC: Artificial intelligence and cyber intrusion](https://www.ncsc.gov.uk/report/artificial-intelligence-and-cyber-intrusion) - [[2] UK NCSC: Vulnerability management](https://www.ncsc.gov.uk/guidance/vulnerability-management) - [[3] UK NCSC: Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai) - [[4] UK NCSC: One does not simply defend agentically](https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agentically) - [[5] Reuters: UK cyber chief on AI-powered attacks](https://www.reuters.com/legal/government/uk-must-expect-ai-powered-attack-critical-infrastructure-within-two-years-report-2026-11-03/)