On November 3, 2026, the UK's National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026 and a State of the Cyber Nation report. The press release says "The UK's critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028", and that within two years AI adoption by hostile actors is "highly likely" to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation.
What the assessment actually says
The review's chapter on AI sets out the NCSC's judgements. It is "almost certain AI will act as a force multiplier", and "The greatest impact of AI will be the acceleration and scaling of existing tactics, techniques and procedures (TTPs) as opposed to generating new attack vectors." It expects AI to keep being folded into operations "rather than autonomously conducting end-to-end attacks", and says "Human operators highly likely remain essential for directing, validating and adapting AI-generated outputs". It also notes that "Loss of control whilst running an agentic AI will highly likely hinder threat actors from achieving their intended objectives".
The judgement most relevant to engineering teams concerns vulnerabilities. "AI models have become capable of detecting vulnerabilities in large codebases and misconfigurations in systems that have historically remained undetected." Not every finding will be exploitable, but "it is highly likely defenders and maintainers of systems will face a race to shorten patch deployment timelines to mitigate against the influx of vulnerabilities before threat actors are able to develop any working exploits against them." The chapter expects "a widening digital divide" between organisations able to use AI for defence and those that cannot, and warns that "shadow AI" (tools adopted without the organisation's oversight) will leave organisations open to exploitation.
The press release quotes the prepared speech of NCSC CEO Richard Horne: the expected rise in incidents is "not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable." He adds: "For decades, we have collectively got away with doing tech on the cheap."
A scenario, not a forecast
A separate chapter, "The age of autonomous attack", describes a pessimistic 2028 in which an "automated cyber actor, utilising frontier AI, which is no longer under its operator's control" appears, and "It is a realistic possibility such an entity could self-replicate". The NCSC states that "The purpose of this scenario is not to predict the future, but to illustrate the consequences of inaction". Coverage that treats it as a prediction misreads the report. The release also notes funding the Chancellor announced the previous week, including 60 million pounds for the first phase of a national Cyber Shield and 70 million pounds for a National Exposure and Real-Time Vulnerability (NERV) Centre.
What remains uncertain. These are intelligence judgements using the UK's probability language ("highly likely", "realistic possibility"), not counts of incidents, and the chapters we read do not show the underlying evidence. The assessment does not say how much faster AI-assisted exploit development has become, so the size of the patch race is not quantified. The NCSC itself describes uneven adoption of AI among attackers.
Analysis: The NCSC's main point is that the backlog is the risk, not new attack techniques: AI makes old, known weaknesses cheaper to find. For a small team, the practical response is to measure the time from a security advisory to a deployed patch and to shorten it. At Belgavi's Book Store, Jenya could list every internet-facing service, from the order site to the help-desk agent's tool endpoints, record the age of the oldest unpatched advisory for each, and switch off anything that does not need to be reachable from the internet. Those are the same two steps the NCSC asks organisations to take, and neither needs AI.
Sources and evidence
The NCSC's State of the Cyber Nation report and Annual Review (November 3) judge a ransomware attack involving AI-powered malware on UK critical infrastructure highly likely by 2028. They say AI will mainly speed up existing tactics rather than create new ones, and that defenders face a race to shorten patch timelines as AI finds long-hidden vulnerabilities. A chapter on a self-replicating autonomous attacker is explicitly a scenario, not a prediction.