NCSC's Richard Horne: AI attacks on UK critical infrastructure likely by 2028

Richard Horne, head of the UK's National Cyber Security Center, used the publication of the agency's annual cyber report to deliver a warning with a deadline attached: the UK will likely face AI-driven cyberattacks on its critical infrastructure by 2028.

Horne said criminals and states including China and Russia are increasingly using AI in their cyberactivity. That could include AI-powered malware for ransomware attacks, he said, with the technology allowing vulnerabilities "that have been tolerated for far too long" to be found and exploited "at a scale that was once unimaginable."

The threat is not purely hypothetical. Horne cited a vulnerability discovered in refrigeration units, which hackers targeted by raising the temperature and causing food to thaw. The UK has been affected, he said.

That example matters because it moves the conversation away from abstract cyber risk and toward the things people notice when they stop working: food supply, power, and business continuity. A hacked refrigerator is not a metaphor. It is a demonstration that the gap between a digital vulnerability and an empty shelf is smaller than most leaders assume.

Horne aimed his message at the people who control budgets. Leaders of businesses and organizations of all sizes who have "got away with tech on the cheap," he said, will have to explain why "food isn't on the shelves, lights aren't on, businesses have gone under" if they fail to invest in cybersecurity or update out-of-date technology.

That is a shift in where responsibility lands. Horne is framing them as leadership failures with public consequences, and he is naming the consequences in plain terms.

What remains unclear is the scope of the risk beyond the refrigeration example. Horne did not specify which critical infrastructure sectors are most exposed, what investments the NCSC is recommending, or whether there are indicators the timeline could be shorter than 2028. No specific numbers or cost estimates were cited.

The 2028 projection is a likelihood, not a certainty. But the vulnerability Horne described is not a forecast. It has already been exploited, and the UK has already been affected.