Britain’s warning lands on a tight timetable. The country is likely to face AI-enabled cyberattacks against critical infrastructure by 2028, as criminals and state actors increasingly incorporate the technology into their operations. China and Russia were among the states identified as part of the threat picture.¹

The National Cyber Security Centre’s assessment is more specific: it expects AI-powered malware to be used in a ransomware attack on UK critical infrastructure within the next two years. Its annual report says AI is almost certain to act as a force multiplier for capable attackers, while 88% of incidents affecting large organisations can be traced to four familiar entry points: public-facing applications, phishing, valid accounts and remote services.²

That creates an awkward contrast. The attack routes are not exotic, but AI could make exploitation faster, broader and more convincing. Richard Horne, the NCSC chief executive, said the AI revolution must “force UK organisations to reckon with the current state of their cyber security.”²

The official response is moving toward stronger defensive infrastructure, including a National Cyber Shield and a vulnerability centre. But Heigor Freitas of industry body CREST argues that resilience cannot be outsourced to legislation. “Industry leaders do not wait for regulation to drive improvements,” he said, urging organisations to benchmark against recognised standards, seek independent assurance and embed professional competence.²

His point is blunt: compliance is a floor, not a shield. Firms deploying AI, he says, must assess risks and controls beyond current rules—and ensure their testing is backed by specialised, independently verified standards.²