Context
An NCSC assessment has examined current AI-enabled threat trends and projections of the threat landscape to 2028 through three scenarios.
The scenarios are assessed to be plausible possibilities but are not predictions. They are designed to provide insights into the potential trajectories of AI-driven cyber threats and inform the development of proactive security strategies. Development in AI capability and its application to cyber operations is changing quickly and therefore the prospect for surprise is high. The NCSC warns that ‘tech on the cheap’ has left UK organisations exposed to AI uncovering and exploiting longstanding cyber security weaknesses and calls for urgent investment in resilience. NCSC CEO Richard Horne has launched the Annual Review 2026: The State of the Cyber Nation.
Key points to note and next actions
To develop the three scenarios in this paper, the NCSC has identified key drivers likely to influence the AI-cyber threat to the UK in 2028 and these are Geopolitical tensions; UK critical national infrastructure (CNI) cyber defence; the pace of development for AI technologies; availability of AI-cyber capability; AI and a cyber-literate workforce and AI-cyber threat in 2028. The three scenarios in the NCSC assessment are:
- Baseline scenario: Increased global threat from AI-cyber capability.
- Pessimistic scenario: AI-cyber capability proliferation far outstrips the UK’s defensive ability.
- Optimistic scenario: AI-cyber development slows, allowing the UK to develop robust countermeasures.
The key judgments are:
- By 2028, Russia, China and other nation states are highly likely to routinely use AI-enabled cyber capabilities to pursue their geopolitical goals, increasing the scale and speed of sophisticated cyber-attacks against the UK.
- By 2028, many systems are likely to remain vulnerable to attack from AI-cyber tools which identify and exploit system weaknesses.
- By 2028, it is likely that attackers will apply AI-cyber capability against known vulnerabilities in CNI legacy technology.
- It is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.
NCSC CEO Richard Horne urges all organisations across the country to “take the responsibility now to make different choices”, including addressing the failure to adequately invest in their technology; not having technology unnecessarily connected to the internet; and making Cyber Essentials the starting point for cyber security, not the end goal, with organisations building greater resilience according to their size, complexity and risk.