In brief
The National Cyber Security Centre (NCSC) has warned that Britain may face an AI‑exploited cyberattack on its critical infrastructure within the next two years. The report singles out China as the best‑equipped actor and calls for urgent rectification of long‑standing supply‑chain weaknesses, while noting ongoing threats from Russia and Iran.
The NCSC released an annual report on Tuesday, 3 November 2026, warning that Britain should expect an AI‑powered cyberattack on its critical national infrastructure within the next two years. The analysis identifies China as the most likely actor, citing the country's capacity to use machine‑learning systems to discover and exploit previously tolerated vulnerabilities on a large scale.
AI‑enabled attacks employ algorithms that analyze network traffic, discover configuration mistakes, and design bespoke exploits automatically. In a security landscape where supply‑chain components are increasingly sourced globally, a single software flaw can now be amplified across thousands of connected devices, a scenario that the NCSC describes as “unimaginable” when unchecked.
Richard Horne, chief executive of the NCSC, said that many organisations have pursued cost‑cutting in technology for decades, leaving their infrastructures "doing tech on the cheap" and unconsciously inviting adversaries.
"Doing tech on the cheap" is the prevailing attitude that has masked systemic risk, he said.
Horne also warned of "an unprecedented rise in the number of cyber incidents" in the coming months and urged that, if low‑cost strategies were not amended, the knock‑on effects could result in food shortages, power outages, and business failures.
The report forecasts that, by 2028, if current trends continue, a ransomware campaign that harnesses AI‑powered malware will target a broad swathe of the nation’s key systems. The term “AI‑powered malware” refers to malicious code that adapts its behavior based on environmental data, thereby allowing it to bypass static defenses.
Alongside China, the NCSC highlighted ongoing attempts by Russia to penetrate UK military networks and by Iran to conduct worldwide cyber operations that may target UK entities and individuals perceived as threats. Each nation has repeatedly denied any malicious cyber engagement.
Recent breaches in European supermarkets have underscored the fragility of retail supply chains, exposing how quickly an exploited vulnerability can cascade through multiple systems. These incidents prompted the NCSC to suggest a “continuous surface, deep, and dark web monitoring” approach that tracks threat actors as they progress from reconnaissance to exploitation.
Mitigation strategies urged by the NCSC include a thorough reassessment of supply‑chain contracts, implementation of zero‑trust principles in data access, and mandatory use of continuous vulnerability scanning. Horne emphasized that if organisations do not adopt these measures, the resulting cascade—when critical utilities fail—could resemble the worst‑case scenarios outlined in the report.
Given the emphasis on AI as a force multiplier for both attackers and defenders, the NCSC calls on the UK government, industry, and academia to collaborate on a national AI‑security strategy. This should incorporate early threat detection systems that learn from global threat‑intelligence feeds and integrate automated incident response to reduce dwell time in the event of an attack.
