UK Cyber Chief Warns AI Attacks Will Hit Infrastructure by 2028

Richard Horne, head of the U.K.’s National Cyber Security Center, warned on Tuesday that artificial intelligence will be used against British critical infrastructure by 2028. The warning comes as the NCSC releases its annual cyber report detailing the growing use of AI by foreign states and criminal groups. Horne stated that criminals and governments, specifically China and Russia, are integrating AI into their cyber operations with increasing frequency.

The NCSC report identifies Chinese cyber activity as the most sophisticated and sustained challenge facing the U.K. The report notes that both Russia and China will routinely employ AI to advance their geopolitical goals. Meanwhile, Russia is conducting cyber campaigns that stay below the threshold of armed conflict, while Iran targets individuals who pose a threat to its regime. The report concludes that AI is likely to enhance and scale existing tactics rather than discover entirely new vulnerabilities.

Horne directed a message at business leaders who have relied on cheap technology for years. He argued that if they fail to invest in cybersecurity or update outdated systems, they will have to explain why essential services fail. Specifically, he cited scenarios where food is missing from shelves, lights are off, and businesses collapse due to technical neglect.

The urgency of the warning is reflected in recent global events. Last week, governments and corporations implemented urgent security updates after AI helped identify two critical flaws in a programming language used by 70% of websites globally. These flaws could allow attackers to access sites without authentication and potentially control web servers remotely without a password. Horne noted that technology underpins physical processes vital to modern life, including electricity switching, water sluice gates, dam operations, and manufacturing lines.

Horne pointed to recent cyberattacks on refrigeration systems in French supermarkets as evidence of how easily hostile actors can exploit civilian infrastructure. The threat is not hypothetical, as the U.K. and EU member states previously attributed an attack on Poland’s energy grid in December 2025 to Russia’s FSB security service. That attack, if successful, would have left 500,000 people without electricity during winter.

Financial impacts are already severe. The NCSC estimates that malicious cyber activity costs U.K. organizations nearly $20 billion annually. In 2025, Jaguar Land Rover suffered direct losses exceeding $260 million following a cyberattack that also impacted its suppliers and the wider economy. Anne Keast-Butler, director of GCHQ, emphasized that cybersecurity is now part of the nation’s front line defense. She called on every organization to take immediate action to protect customers, services, and livelihoods.

The NCSC recommends basic but effective measures for organizations. These include keeping devices up to date, limiting administrator access to systems, and backing up important files and data. The agency stressed that these steps are necessary to maintain operational resilience against the coming wave of AI-assisted threats.