UK Warns Its Critical Infrastructure Faces Grave Risk
Britain’s new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.
Britain’s new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.
At various levels of the United Kingdom government, officials are warning about the threat of cyberattacks against its critical infrastructure.
His Majesty’s Government broadcasted its cybersecurity agenda on Nov. 3, releasing a variety of policy papers, an annual report from its lead cybersecurity agency, and related announcements pertaining to the security of small and medium-sized businesses (SMBs), supply chain vendors, critical national infrastructure (CNI), and more. These items all followed from an updated Autumn Budget 2026, released last week, which provisioned nearly two hundred billion pounds for AI-driven government cybersecurity projects.
Amid all of the practical policy updates, the headline quote of the day came from the state’s National Cyber Security Centre (NCSC), which assessed that it’s “highly likely that between now and 2028, AI‑powered malware will have been used in a ransomware attack on UK CNI.” It also labeled “highly likely” the prospect that “China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals” in the country.
The State of UK Critical Infrastructure
In a new report, Manchester-based NCC Group polled Members of Parliament (MPs) about the state of the UK’s CNI cybersecurity posture. About half (51%) of MPs reported that their areas of the country are “not keeping pace” with the threats to its infrastructure. Only 22% expressed confidence in their country’s posture. Asked about the nation’s ability to fight off a major attack against its CNI, 47% believe that it’s unprepared, whereas 41% feel it is.
The survey data is best read as aspirational, not prescriptive. There’s little evidence that the UK is less prepared than other nations in addressing threats to its critical infrastructure, or that politicians would be able to tell one way or the other. Leaders are simply aware of the magnitude of what faces them.
“The challenge isn’t a lack of government action, it’s proof that action translates into resilience,” says Katharina Sommer, head of government affairs at NCC Group. “There’s still no tested blueprint for coordinating cyber response effectively across government and industry, and that’s not a problem unique to the UK. The test for critical infrastructure operators is whether they can demonstrate, before an attack hits, that they can sustain essential services, recover quickly and maintain public confidence,” which remains an open question.
A clearer message came through on Tuesday, from the experts at the NCSC. Using a scale in which “likely” accords with roughly 55 to 75% odds, “highly likely” with 80% to 90% odds, and “almost certain” approaching 100%, it bet that it is:
-
Likely that threat actors will use AI cyber tools to needle vulnerabilities in CNI
-
Highly likely that nation-states will use AI to increase the speed and sophistication of their cyberattacks, in service of their geopolitical goals in the UK; in particular, the agency identified China as the foremost player in terms of intent and capability to hit CNI and other strategic targets
-
Almost certain that “many systems will remain vulnerable” to
The NCSC also drew out some future scenarios. Optimistically, it acknowledged that AI-driven cyber threat development might slow, allowing a window of time for the UK to catch up with the problem. Pessimistically, it painted a picture in which AI threats totally outpace the UK’s ability to keep up.
“The situation is likely to be worse than is currently known, with many variables and unknowns still to be discovered,” according to the report.
Andy Burnham’s Government Makes Cyber Changes
The message out of the UK government on Tuesday was, more or less: we’re trying to get ahead of this.
In a policy paper, the government acknowledged that 2018’s Network and Information Systems (NIS) Regulations — the UK’s only multisector cybersecurity law — is “out of date and insufficient to tackle the threats we face.” In a speech announcing its Annual Review 2026, NCSC CEO Richard Horne called the law built to replace NIS 2018 — November 2025’s Cyber Security and Resilience Bill — “a vital step forward.” The updated bill brings data centers, managed service providers (MSPs), and specific “critical suppliers” into the fold, and introduces stricter breach reporting requirements and hefty fines for negligence.
In a separate policy paper concerning the same bill, the government stated its intention to introduce a new vendor risk management framework focused specifically on the “national security risks posed by vendors” connected to essential service providers. And in yet a third, related paper, the government described how the Cyber Security and Resilience Bill will be used to account for agentic “loss of control” incidents, in the fashion of this summer’s AI industry lab leaks. Projected future measures include:
-
Security and resilience requirements to prevent loss of control incidents
-
Specialized reporting requirements
-
Evidence preservation requirements
-
Empowering ministers to perform postmortems
The bill is currently passing through Parliament.
Besides this one bill, the UK government also announced £2.4 billion in subsidies to help micro-, small, and medium-sized businesses attain “Cyber Essentials” certifications. All of this week’s announcements come on the heels of an Autumn Budget last week, which arranged for tens of billions of pounds each to fund, among other things:
-
A National Exposure and Real-Time Vulnerability (NERV) Centre, for vulnerability discovery across the country, including CNI
-
A National Cyber Shield, for training AI agents to automate cyber defense
-
A separate National Agentic Security Unit for fighting rogue AI agents
“Increasing the funding and focus on cybersecurity to help keep the UK secure is very welcome,” says Jack Chapman, senior vice president of threat intelligence for KnowBe4. At the same time, he adds, “the main challenge I see is scale.”
“£154 million for cyber-defenses is a good step,” he believes, “but the NCSC estimates cyberattacks cost UK organizations £14.7 billion a year.”
Cybersecurity Experts Weigh in on CNI Defense
Dark Reading asked cybersecurity experts what governments like the UK’s need to do to prevent future worst case scenarios. They consistently emphasized the same point:
“AI did not create new weaknesses, it revealed them. Most incidents still start through the same familiar routes, such as phishing, stolen credentials and the traditional kill chain paths attackers have relied on for years. The key to stopping these threats is, surprisingly, not exciting: it’s the fundamentals,” Chapman argues.
The fundamentals for Graham Taylor CBE, director of defense strategy for Northern Europe at OPSWAT, starts with protecting the edge. “Too many critical sites rely on firewalls and VPNs for connections that only need to send data one way. Where a facility only exports monitoring data, a hardware-enforced data diode removes the return path entirely, so neither a human attacker nor AI can use that link to send commands into the facility,” he says.
Jacob Krell, Suzu Labs senior director for secure AI solutions and cybersecurity, emphasizes network segmentation “built like a boat.” AI is going to make the perimeter easier to breach, he says, “and it cuts the time to objective once an attacker is inside. Critical infrastructure is notoriously vulnerable here because operators are hesitant to patch and test systems, and their caution is rational, a bad update takes a plant offline. So the perimeter fails more often and the interior offers nothing to slow lateral movement.”
John Strand, owner of Black Hills Information Security, tosses out a less conventional suggestion for fighting off AI threats to CNI. “If AI gives attackers the ability to do a tremendous amount of work very quickly, defenders have an opportunity to present them with large numbers of decoys to investigate. We need creative ways to make those decoys look realistic and dynamic. The more time attacking AI agents spend interacting with decoys, the less time they spend attacking real systems,” he argues.
Read more about:
