---
title: UK NCSC: AI cyber tools will 'almost certainly' leave many systems exploitable through 2028, and AI-powered malware has 'highly likely' hit UK critical infrastructure with ransomware by then | ctxsec
url: https://ctxsec.com/items/ncsc-ai-and-cyber-intrusion-assessment-2028-zero-days-cni
description: "The NCSC's assessment says that by 2028 Russia, China and other states will highly likely use AI-enabled cyber operations routinely; that it is almost certain many systems will remain vulnerable to AI tools that find and exploit weaknesses, letting attackers care less about burning an access because it is cheap to replace; that attackers will likely aim AI at known flaws in legacy critical-infrastructure technology and at AI deployed inside it; and that AI-powered malware will highly likely have been used in a ransomware attack on UK CNI. It adds that defensive AI has shortened the zero-day-to-n-day window, but patching and testing processes must speed up to match."
status: "official (UK NCSC assessment, Nov 3)"
published: 2026-11-03
---

> The NCSC's assessment says that by 2028 Russia, China and other states will highly likely use AI-enabled cyber operations routinely; that it is almost certain many systems will remain vulnerable to AI tools that find and exploit weaknesses, letting attackers care less about burning an access because it is cheap to replace; that attackers will likely aim AI at known flaws in legacy critical-infrastructure technology and at AI deployed inside it; and that AI-powered malware will highly likely have been used in a ransomware attack on UK CNI. It adds that defensive AI has shortened the zero-day-to-n-day window, but patching and testing processes must speed up to match.

[← AI](/ai) · [markdown](/items/ncsc-ai-and-cyber-intrusion-assessment-2028-zero-days-cni.md)

official (UK NCSC assessment, Nov 3)

2026-11-03

### UK NCSC: AI cyber tools will 'almost certainly' leave many systems exploitable through 2028, and AI-powered malware has 'highly likely' hit UK critical infrastructure with ransomware by then

The practical message is speed: shorten time-to-patch for internet-facing and legacy OT systems, assume found-and-exploited faster than before, and invest in recovery for critical services rather than only prevention.

Sources: [NCSC: Artificial intelligence and cyber intrusion](https://www.ncsc.gov.uk/report/artificial-intelligence-and-cyber-intrusion)