NCSC Assessment: 'Artificial intelligence and cyber intrusion' — AI-enabled threat trends and projections to 2028

Published 3 November 2026 (json-ld datePublished=2026-11-03). This is an authoritative NCSC-A assessment that examines current AI-enabled threat trends and projects the threat landscape to 2028 through three scenarios (baseline, pessimistic, optimistic). Key judgements include: by 2028 it is highly likely Russia, China and other nation states will routinely use AI-cyber against the UK; it is almost certain many systems will remain vulnerable to AI-cyber tools that identify and exploit weaknesses; it is likely attackers will apply AI-cyber capability against known vulnerabilities in UK critical national infrastructure (CNI) legacy technology and the new attack surface created by deploying AI within CNI; and it is highly likely AI-powered malware will be used in a ransomware attack on UK CNI between now and 2028. It is published alongside the NCSC Annual Review 2026 (also 3 November 2026), whose 'Impact of AI on cyber threat' chapter carries the same key judgements (AI as a force multiplier, AI-assisted vulnerability discovery creating a patching race, 'shadow AI' risk, and a widening digital divide between AI-defensive 'haves and have-nots'), and press coverage quoting the NCSC cyber chief warning that 'tech on the cheap' has left UK organisations exposed to AI uncovering and exploiting longstanding weaknesses.

This is the UK's authoritative national assessment of the AI-cyber threat to 2028 from NCSC-A, the mandated authoritative voice on the cyber threat to the UK. Its key judgements directly drive UK CNI resilience priorities, investment decisions, and the security posture of all UK organisations; it sets expectations for AI-enabled attacker scaling, AI-accelerated zero-day exploitation and the urgency of patch/response timeline compression, and flags 'shadow AI' as an exploitable exposure. It is the reference baseline for the AI threat landscape that AI-security controls and incident-response planning should be aligned against.

Use the assessment to inform CNI resilience and AI-security investment cases; shorten vulnerability patch/deployment timelines to counter AI-accelerated exploit development; treat AI-enabled ransomware on UK CNI as the planning baseline; review and govern employee 'shadow AI' use as a control gap.