The UK’s National Cyber Security Centre (NCSC) has raised alarms that artificial intelligence could dramatically speed up ransomware attacks targeting critical infrastructure. In its Annual Review for 2026, which covers incidents from September 1, 2025 through August 31, 2026, the agency recorded 1,831 cyberattack reports. Of those, 337 incidents required assistance from its Incident Management Team. Nationally significant incidents numbered 80—representing a subset of those needing support. Meanwhile, its Early Warning service flagged suspected compromises in over 8,500 organizations. These figures are intended to help organizations understand threat levels, not to suggest attacks are definitively up or down.
How AI Is Changing the Ransomware Game
The NCSC’s report outlines how AI tools are already being used in ways that make ransomware attacks faster and less expensive. Threat actors are relying on AI to: conduct reconnaissance on targets, craft more credible social engineering campaigns, find software vulnerabilities, and generate exploit code more efficiently. Most currently benefit skilled operators who can vet and correct AI outputs. So far, no new type of attack has emerged thanks to AI—but its use is amplifying attack velocity.
Nearly nine in ten incidents impacting large organizations traced initial attack vectors back to just four areas: publicly facing applications, phishing, compromised valid credentials, and remote services exposed externally. These findings show that even as AI improves, traditional weak spots like login security, remote access controls, and exposed systems are still the most significant risks.
What’s Coming—and What to Do
The NCSC expects that AI-powered malware could be used in ransomware attacks against UK critical national infrastructure by 2028. Though this is a warning, not a reflection of confirmed incidents yet, it underscores that organizations should prepare now. Meanwhile, state-backed threat actors—including those from Russia, China, and other nations—are expected to leverage AI-based cybercapabilities regularly by that same deadline.
On the flip side, using AI tools internally is risky too. Employees using unauthorized AI services may unintentionally expose sensitive data and circumvent controls intended to ensure safe handling of corporate information. One challenge for defenders will be managing the growing load of security flaws AI helps uncover—what the report describes as a coming wave of patches. Firms need agility in deploying fixes across suppliers and vendors.
Recommendations from the report stress returning to basics: maintain accurate visibility of systems, patch exposed software, control access credentials, protect backups, and rehearse incident response readiness. The NCSC also supports wider deployment of passkeys for authentication and encourages clearer mapping of supplier dependencies. While AI can assist defenders—spotting weaknesses and reviewing alerts—the report cautions that automated actions must be transparent, constrained, and overseen by humans to avoid introducing new risks. Modernizing legacy systems and solidifying basic security controls are still foundational.
Why this matters: the NCSC’s analysis shows that while AI hasn’t yet introduced wholly novel cyberattack categories, its boost to existing methods could change the stakes. With experts warning of AI-enhanced ransomware by 2028, organizations must raise both technical and strategic defenses. Those who fail to shore up fundamentals—patching, account hygiene, remote access protection—are likely to be the most vulnerable. It’s only through pragmatic improvement today that the rising tide of AI-driven threats can be held back tomorrow.
