NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure

The UK’s National Cyber Security Center handled 80 nationally significant cyber incidents during its latest reporting year, warning that artificial intelligence is making attacks faster, cheaper and easier to carry out. Its 2026 Annual Review records 1,831 attack reports, with 337 incidents requiring support from its Incident Management Team.

The review covers 1 September 2025 to 31 August 2026, marking the NCSC’s tenth year as part of GCHQ. Published on November 3, the NCSC Annual Review 2026 warns that AI is increasing pressure on organizations still struggling to fix known security weaknesses.

The 80 nationally significant incidents represent a subset of the 337 cases that needed NCSC support, not the total number of cyber attacks across the UK. Alongside its response work, the agency notified 8,500 organizations of events indicating suspected system compromise through its Early Warning service.

The NCSC cautions against reading incident totals as a simple measure of whether threats are rising or falling. Reporting levels vary, major incidents can influence annual figures, and early alerts may prevent smaller compromises from developing into cases requiring national support. Response complexity also differs widely between incidents.

That context matters when comparing this review with earlier reporting on nationally significant UK cyber attacks. A lower incident count does not, by itself, prove that organizations face less risk or that the impact of individual attacks has decreased.

AI Could Accelerate Ransomware

The report’s central finding is not that attackers have abandoned established techniques. Instead, AI is helping them research targets, produce convincing social engineering messages, discover software flaws, and develop exploit code more efficiently. Skilled operators currently gain the greatest benefit because they can check results and correct mistakes.

The agency’s incident management findings draw an important line between observed activity and future risks. Its responders have begun seeing attackers use AI tools, but none of those observed uses enabled a new class of attack. Existing security controls therefore remain directly relevant.

Across the large organizations covered by its incident data, 88% of incidents involved four initial access routes: public-facing applications, phishing, valid accounts and external remote services. These findings show why exposed software, stolen login details and poorly protected remote access remain immediate concerns, even as AI capabilities improve.

Human involvement also remains important. The NCSC assesses that attackers will continue using AI mainly to improve existing operations rather than routinely handing complete attacks to autonomous systems. Operators still need to direct tools, validate findings and adapt when an approach fails.

The review warns that AI-powered malware is highly likely to feature in a ransomware attack against UK critical national infrastructure between now and 2028. This is a forecast, not confirmation that such an incident has already happened.

Its assessment of threats to the UK also expects China, Russia and other states to routinely use AI cyber capabilities by 2028. The likely result is an increase in the speed and scale of sophisticated operations against UK targets.

Businesses face risks from their own AI adoption too. The report warns that employees using unapproved AI services can expose sensitive company information and leave employers unable to track how that data is handled. Earlier coverage of CISA and NCSC secure AI development guidance explains why security must be considered throughout an AI system’s life.

For defenders, AI-assisted flaw discovery could create a growing workload of security updates. The NCSC urges organisations to prepare for a “patch wave” by improving their ability to deploy fixes quickly, frequently and across suppliers. Not every AI-discovered flaw will be exploitable, but delays can give attackers opportunities.

The immediate priorities remain practical: maintain an accurate view of systems, patch exposed services, control account access, protect backups and rehearse incident response. The review also supports wider passkey adoption and better understanding of supplier dependencies. These measures address the access routes responders continue to encounter.

AI can also help defenders identify weaknesses, review alerts, and support faster response. However, automated actions need clear limits and human oversight to avoid disruption. The challenge is turning that potential into reliable protection while replacing aging technology and consistently applying the basic controls that many organizations still lack today.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure appeared first on Cyber Security News.