UK Cyber Chief Warns AI Will Supercharge Ransomware, But Old Security Gaps Are the Real Problem

The UK's National Cyber Security Centre (NCSC) has warned that AI-powered malware is "highly likely" to be used by financially motivated criminals against the country's power stations, airports and hospitals by 2028. Speaking at the launch of the agency's State of the Cyber Nation report on November 3, NCSC CEO Richard Horne said the UK faces "a real prospect of an unprecedented rise in the number of cyber incidents." The report also warned that nation states including Russia and China will routinely use AI in their cyber activity.

Horne stressed that AI has not invented new ways to attack. The danger, he argued, is that vulnerabilities tolerated for far too long can now be found and exploited at a scale once unimaginable. He criticised organisations relying on "tech on the cheap", including end-of-life systems kept running for another year, delayed upgrades, access granted for convenience rather than necessity, services bought on price alone, and a lack of monitoring to detect when things go wrong.

He pointed to the PHP2Shell vulnerabilities as the best recent example, noting that the NCSC has issued 110,000 proactive notifications and Early Warning alerts to UK organisations in response. Horne said AI's impact "will be felt by us all, whether you and your organization choose to harness it or not." This summary draws only on the opening of the original article.