Britain’s cybersecurity agency warns that AI-powered malware is highly likely to feature in a ransomware attack against critical infrastructure by 2028. Its assessment focuses on attackers finding and exploiting longstanding weaknesses faster. Organizations are being urged to address underinvestment and unnecessary internet exposure while using AI to strengthen their defenses.
The UK cybersecurity agency NCSC, part of its signals intelligence service GCHQ, has warned that an attack using AI-powered malware against critical national infrastructure is highly likely by 2028. Its warning concerns the ransomware threat. The assessment sets a time horizon for a prospective attack on essential systems.[1], [2]
The agency’s State of the Cyber Nation assessment, published on November 3, identifies ransomware, social engineering and exploitation of vulnerabilities among the activities AI could make more efficient. In prepared remarks for its launch, chief executive Richard Horne points to decades of inadequate technology investment. He says weaknesses tolerated for too long can now be discovered and exploited at a previously unavailable scale. The same technology also offers an opportunity to improve collective cyber defense, the agency says.[1]
The NCSC calls on organizations to remove unnecessary internet connections and make technology investment a leadership responsibility. Cyber Essentials, its baseline security framework, is presented as a starting point. The additional protection should reflect each organization’s size, complexity and risk. Horne’s appeal places responsibility for resilience with leaders making investment choices as well as with the security specialists who maintain systems.[1]
