Bleak outlook from NCSC

The UK’s critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, warns a new report by the National Cyber Security Centre (NCSC).

The NCSC’s ‘State of the Cyber Nation’ report warns that within the next two years, AI adoption by hostile actors is ‘highly likely’ to increase the scale and efficiency of their operations, including ransomware attacks, social engineering and vulnerability exploitation.

In a speech to launch the report, the CEO of the NCSC, Dr Richard Horne, said, “We have built world-class cyber security capabilities, established the NCSC as a trusted authority at home and abroad … We can be proud of that progress, and we must also be honest. The UK’s cyber resilience is not yet where it should be. The cyber threat has increased faster than our defensive capabilities.”

China and Russia threats

This sobering assessment clearly identified China and Russia as the main source of serious cyber disruption. Cyber attacks are no longer just a means of stealing secrets or disrupting systems; they are increasingly a tool used to shape economic outcomes, project state power and pursue strategic advantage.

The report identified Russia as currently representing the most 'audacious' cyber threat. Elsewhere, Iran-linked groups continue to demonstrate how cyber operations can be used to create indiscriminate disruption at scale. 

China's adversarial cyber activity represents the most sophisticated and sustained cyber challenge facing the UK, said the report. China’s rapid development into a tech superpower is distinguished by its scale and its ‘whole-of-state’ approach, acquiring large amounts of information from the UK and elsewhere. "It trains models, improves capability and generates insight. 

China's ability to acquire, process and exploit vast quantities of information therefore has implications far beyond traditional espionage," warned the report.  

The NCSC accepts that AI’s role in both defending and attacking cyber security will increase, not only in traditional computer systems but across all internet-accessed systems.

Autonomous end-to-end AI capability is beginning and is attacking across the full threat stack.

Economic security depends on cyber security

Cyber threats are increasingly translating into real economic harm in the UK. Ransomware, data breaches and supply chain compromises disrupt business operations, halt production and impose significant recovery costs. 

According to UK government research, malicious cyber activity costs UK organisations an estimated £14.7 billion every year. Put another way, cyber attacks are wiping out value equivalent to the size of the UK's cyber security sector annually. 

Key messages for leaders and board members

Currently, for large organisations, 88% of incidents came from four initial access vectors:

• Exploiting external public-facing applications.
• Phishing.
• Misuse of valid accounts.
• Exploiting external remote services.

But these threats are evolving fast and moving to all elements of online systems. National Critical Infrastructure and industrial processes are more frequently under attack, from freezers to rail management systems.

Programmable Logic Controllers are widespread in industrial computing. They have been adapted for their function to control specific processes, such as assembly lines, laser cutting machines or any activity that requires high reliability, ease of programming and process fault diagnosis.

As a result, the NCSC has called for board-level executives of large and small companies to sit up and pay attention. It makes no bones about it: there will need to be investment across the technology stack, including training.

Secure development practices should make vulnerability prevention part of normal engineering. Hardware-backed security, strong identity and trustworthy update mechanisms can provide dependable control points.

 Dr Horne made it clear, “Ten years on from the NCSC’s formation, we face a moment of choice. If we act now, cyber security can become a source of national strength, driving economic growth and building trust in our increasingly digital world. If we delay, cyber attacks will become more frequent, more severe and more costly.” 

To read the full report, which includes links to training, tools and alert systems, go here: https://www.ncsc.gov.uk/collection/annual-review-2026 

Looking for advice? Check out our full range of services. From payroll help to taxation advice, our expert team is available to lend a hand.