UK NCSC Warns AI-Powered Ransomware Attack on Critical Infrastructure ‘Highly Likely’ by 2028

The NCSC's warning reframes AI as a force multiplier for attackers, not just a defensive tool, which matters most for operators of critical national infrastructure where legacy systems and cost-driven procurement have left long-standing vulnerabilities. The explicit critique of "tech on the cheap" signals that the agency sees underinvestment, not novel attack techniques, as the core exposure. The open question is whether this warning shifts procurement and security spending priorities across the sectors the NCSC covers, or remains a forecast without operational follow-through.