UK cyber chief warns AI-boosted attacks on critical infrastructure could emerge within two years

Britain could face AI-boosted attacks on critical national infrastructure within the next two years, according to a warning from the National Cyber Security Centre. The warning comes as the agency says hostile states and ransomware actors are increasingly likely to use artificial intelligence to scale their operations. Dr Richard Horne, the centre's chief executive, is due to set out the assessment as part of the organisation's annual report.

As an Amazon Associate we earn from qualifying purchases.

The report says hackers demanding ransom payments are highly likely to weaponise AI in the UK. It also names hostile states including Russia and China as actors expected to use the technology to pursue their goals and interfere abroad. Horne is expected to describe the current moment as one of "enormous consequence" for national cyber security and to warn of an "unprecedented rise" in cyber incidents in the coming months.

The annual report gives a sense of the scale of the challenge facing the UK's cyber defences. It says the incident management team received 1,831 reports of cyber attacks this year, with 337 requiring support and 80 judged nationally significant. The team also warned 8,500 organisations after their systems were compromised by attackers.

Those figures suggest the threat is already persistent, even before any wider use of AI by hostile actors. The warning matters because critical infrastructure is central to the functioning of the state and the economy. Systems in sectors such as energy, transport, health and communications can be disrupted by cyber incidents, with knock-on effects for public services and business continuity.

As an Amazon Associate we earn from qualifying purchases.

The report's message is that AI may not create entirely new attack methods, but it could allow existing weaknesses to be found and exploited at a much larger scale. The centre's assessment also reflects a broader shift in cyber risk, where both state-backed groups and financially motivated criminals are adapting quickly to new tools. The report argues that vulnerabilities tolerated for too long can now be identified and used more efficiently.

That raises the stakes for organisations that have not patched systems or improved basic defences, especially where essential services are involved. The warning has also prompted debate about how quickly the threat could materialise. One security expert quoted in the report said attacks on critical infrastructure could happen within two months, rather than two years, although that view was presented as a personal assessment rather than the agency's formal forecast.

What remains unclear is which sectors would be targeted first and how prepared operators are for AI-assisted attacks. The key question now is whether the UK can strengthen defences quickly enough before the threat becomes more acute.

#cybersecurity #artificialintelligence #criticalinfrastructure #NationalCyberSecurityCentre #UnitedKingdom