Source: UK National Cyber Security Centre
The UK’s National Cyber Security Centre published its Annual Review 2026 on 3 November, and the headline judgement is blunt: AI powered malware is highly likely to be used in a ransomware attack on Britain’s critical national infrastructure by 2028. NCSC chief executive Richard Horne used the launch to declare that the era of “tech on the cheap” is over, and that organisations must treat security and resilience as a fundamental requirement rather than an afterthought.
Why the warning matters for European businesses
The report assesses that by 2028 it is highly likely that China, Russia and other nation states will routinely use AI in cyber operations to achieve geopolitical goals, with an increase in the scale and speed of sophisticated attacks. It states that China highly likely has the intent and is best positioned to use AI for operations against critical national infrastructure and other strategic targets. Iran is also described as carrying out malicious cyber operations globally.
The most important point for anyone running production systems is Horne’s explanation of why the volume is rising. It is not because AI has invented entirely new attack techniques. It is because vulnerabilities that have been tolerated for far too long, weak passwords, unpatched legacy software and unmanaged internet exposure, can now be discovered and exploited at a scale that was once unimaginable. In other words, the backlog of technical debt you have been meaning to address is the threat model.
The NCSC estimates that malicious cyber activity costs UK organisations around £14.7 billion annually, roughly the value the cyber security sector itself creates each year. Alongside the report, the UK government announced around £10 million in funding to help small and medium sized businesses improve their defences.
What to do about it
The review makes clear that the tools, standards and frameworks needed to defend against both conventional and AI powered attacks already exist. The gap is implementation speed. For European operators that means an honest inventory of internet facing assets, enforced patch cycles, phishing resistant authentication and tested recovery paths for the systems your business cannot run without. The NCSC’s own framing is that organisations which delay will face attacks that are more frequent, more severe and more costly.
Is your organisation carrying tolerated vulnerabilities an AI tool could find in minutes? Contact the team at Excello Digital for a professional security review and a practical hardening plan.