Britain will likely face cyberattacks powered by artificial intelligence on its critical infrastructure by 2028, the country’s cyber chief warned on Tuesday. Richard Horne, head of the U.K.’s National Cyber Security Centre, said criminals and states including China and Russia are using AI more often in their cyber activity.
Horne made the comments in a speech marking the release of the NCSC’s annual cyber report. He said the threat could include AI-powered malware used in ransomware attacks.
According to Horne, AI will allow “vulnerabilities that have been tolerated for far too long” to be found and exploited “at a scale that was once unimaginable.” He said this puts outdated technology at greater risk.
Horne also warned business leaders who have “got away with tech on the cheap.” He said they will have to explain why “food isn’t on the shelves, lights aren’t on, businesses have gone under” if they fail to invest in cybersecurity or update old systems.
China, Russia and Iran Named in Report
The report described Chinese cyber activity as the “most sophisticated and sustained cyber challenge facing the U.K.” It said both Russia and China will routinely use AI to reach their geopolitical goals.
Horne said Russia is deliberately running cyber campaigns that stay below the threshold of armed conflict. He added that Iran is carrying out attacks against the U.K. and targeting people it sees as a threat to the Iranian regime.
The report said the use of AI by states and criminals is highly likely to increase the scale and efficiency of hostile operations. However, it said AI is more likely to boost existing tactics than to find brand new vulnerabilities.
Russia has already attacked critical infrastructure in Europe, according to the U.K. and EU member states. They said Russia’s FSB security service was behind an attack on Poland’s energy grid in December 2025. If it had succeeded, 500,000 people could have lost electricity during winter.
Physical Systems at Risk
Horne said technology “underpins the automation of physical processes that are vital to modern life.” He listed electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, and heating and refrigeration controls.
He pointed to recent cyberattacks on refrigeration systems in French supermarkets. Horne said the incidents showed how easily hostile actors could exploit civilian infrastructure.
In the U.K., malicious cyber activity costs organizations almost $20 billion every year, the NCSC said. In 2025, carmaker Jaguar Land Rover suffered more than $260 million in direct losses after a cyberattack. The attack also hit its suppliers and dented the U.K. economy.
Anne Keast-Butler, director of GCHQ, Britain’s signals intelligence agency, also called for action. The NCSC is part of GCHQ.
“We need every organization in the UK to take action now,” she said. She added that this is “not only to protect their customers, services and livelihoods, but because cybersecurity is now part of the front line defense of our nation.”
The NCSC recommended basic but effective security steps. These include keeping devices up to date, limiting administrator access to systems, and backing up important files and data.
The warning comes days after a global rush to fix software flaws. Last week, governments and corporations worked on urgent security updates after AI helped discover vulnerabilities in a programming language used by 70% of websites worldwide.
The two critical flaws found by AI could let bad actors gain unauthenticated access to websites. In theory, that could allow them to control a web server remotely without needing a password.
