UK likely to face AI-powered cyberattacks on critical infrastructure by 2028, cyber chief warns

The United Kingdom is expected to face AI-powered cyberattacks on critical infrastructure by 2028, according to Richard Horne, head of the National Cyber Security Centre. This is due to the increasing use of AI by criminals and state actors, including China and Russia, in their cyber activities. These AI technologies enable the discovery and exploitation of vulnerabilities at a scale previously unimaginable, according to Horne.

One recent example occurred in French supermarkets where hackers exploited outdated refrigeration systems connected to the internet with default passwords, causing refrigerators to malfunction. While this was not an AI attack, it highlighted the need for businesses to address the security of their operational technology.

Horne warned that leaders of businesses and organizations who have "got away with tech on the cheap" will be held accountable if they fail to invest in cybersecurity or use outdated technology. China is the most sophisticated and sustained cyber challenge facing the UK, while Russia and China routinely use AI in their geopolitical goals.

AI is likely to increase the scale and efficiency of hostile operations, but its use is more likely to enhance and scale existing tactics rather than discover new vulnerabilities. The report emphasized that technology underpins the automation of physical processes vital to modern life, including electricity switching, dam operations, and heating and refrigeration controls.

Recent examples include the AI-assisted discovery of vulnerabilities in a programming language used by 70% of websites globally, which could allow unauthorized access to web servers without passwords. Russia has already attacked critical infrastructure in Europe, and the NCSC estimates malicious cyber activity in the UK costs organizations nearly $20 billion annually.