UK braces for AI-powered cyberattacks on infrastructure within five years

Horne cautioned that AI will enable the discovery and exploitation of long-standing vulnerabilities at an unprecedented scale, potentially leading to ransomware attacks and disruptions to vital services. He emphasized that organizations neglecting cybersecurity investments and outdated technology risk severe consequences, such as failures in food supply chains, power outages, and business collapses.

The NCSC report identifies Chinese cyber activity as the most significant and persistent challenge facing the U.K. Both China and Russia are expected to leverage AI to advance their geopolitical objectives. Russia is conducting cyber campaigns short of armed conflict, while Iran is targeting individuals perceived as threats to its regime.

The report suggests AI will primarily enhance existing cyber tactics rather than uncover entirely new vulnerabilities. Recent events underscore this concern, with governments and corporations scrambling to address vulnerabilities in a widely used programming language discovered through AI assistance, potentially granting unauthorized access to websites.

Critical infrastructure, including electricity grids, water facilities, and manufacturing lines, is increasingly reliant on automated systems. A recent attack on refrigeration systems in French supermarkets demonstrated the vulnerability of civilian infrastructure. Russia has previously targeted critical infrastructure in Europe; in December 2025, the FSB security service was implicated in an attack on Poland’s energy grid that could have left 500,000 people without power.

Cyberattacks are costing U.K. organizations nearly $20 billion annually. In 2025, Jaguar Land Rover experienced over $260 million in losses due to a cyberattack impacting suppliers and the broader economy. Anne Keast-Butler, director of GCHQ, urged all organizations to prioritize cybersecurity, stating it is now a vital component of national defense. The NCSC recommends basic security measures, including software updates, restricted access controls, and data backups.