The UK’s National Cyber Security Centre (NCSC) says AI-powered ransomware attacks on critical national infrastructure are “highly likely” between now and 2028. Its annual review notes that open-source AI security tools, such as the Chinese-made red-teaming platform ARTEX launched in July, are already being repurposed in attacks on 123 Reg, Microsoft 365 and other targets. In a pessimistic 2028 scenario the NCSC envisions a significant increase in attack frequency and sophistication, with AI making attribution harder and even autonomous agents that could self-replicate and act without human control. To prepare, the NCSC piloted Project DROMOS earlier this year, is expanding the Cyber Shield defence system over the next five years, and has set aside £60 million for the initiative plus £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre. NCSC CEO Dr Richard Horne urges organisations to “invest with urgency” and treat Cyber Essentials certification as a baseline. 1