The United Kingdom is projected to face significant artificial intelligence-powered cyberattacks targeting its critical infrastructure by 2028, according to Richard Horne, head of the National Cyber Security Centre (NCSC).
Horne stated that both state-sponsored actors, including China and Russia, and criminal organizations are increasingly employing AI in their cyber activities. This trend could lead to AI-driven malware, such as ransomware, capable of identifying and exploiting vulnerabilities at an unprecedented scale and speed. He noted that AI could uncover "vulnerabilities that have been tolerated for far too long."
One recent example cited involved hackers exploiting vulnerabilities in refrigeration units, causing temperatures to rise and spoil food. The UK has also experienced similar impacts.
In a speech accompanying the NCSC's annual cyber report, Horne emphasized the responsibility of business and organizational leaders. He warned that those who have opted for cheaper technological solutions without adequate cybersecurity investment or timely updates will face scrutiny if essential services are disrupted. "Food isn't on the shelves, lights aren't on, businesses have gone under," he cautioned, highlighting the potential consequences.
The report identifies Chinese cyberactivity as the "most sophisticated and sustained cyber challenge facing the U.K." Both Russia and China are expected to utilize AI to advance their geopolitical objectives.
Horne also pointed to Russia's ongoing cyber campaigns, which operate below the threshold of armed conflict, and Iran's targeted attacks against individuals deemed a threat to its government. The NCSC anticipates that AI will primarily be used to enhance and scale existing cyberattack tactics rather than discover entirely new vulnerabilities, significantly increasing the efficiency and scope of hostile operations.
Horne underscored the pervasive role of technology in automating physical processes crucial to modern life, including electricity management, water facility operations, dam control, manufacturing, and climate regulation in commercial settings. The recent cyberattacks on refrigeration systems in French supermarkets serve as a stark illustration of how easily civilian infrastructure can be compromised by malicious actors.