UK cyber chief warns AI will exploit old infrastructure flaws at scale by 2028: 75% of CNI incidents were state-linked

The head of the UK's National Cyber Security Centre has put a date on a worry that infrastructure operators have carried for years. Richard Horne, the NCSC's chief executive, said the agency's latest assessment finds it "highly likely" that by 2028 attackers will use AI cyber capabilities against known vulnerabilities in legacy technology in the UK's critical national infrastructure (CNI). He also said roughly three-quarters of recent incidents at CNI organisations were believed to be linked to state actors.

Those two statements come from different dates, and the difference matters. Here is what each source says.

What Horne said in June: the 200 incidents and the 75%

The figures come from Horne's speech at the RUSI Annual Security Lecture in London on June 17, 2026, as published by the NCSC. Covering the period from June 2025 to May 2026, he said: "we managed more than 200 incidents impacting organisations within our CNI and supporting ecosystem." Then: "And of those incidents, 75% were believed to be linked to state actors." RUSI's own write-up carries the same figures and names Russia, China and Iran as the states increasingly targeting essential services.

Two cautions on how this is usually repeated. First, the base is "more than 200" incidents, so the 75% implies roughly 150 or more, but the NCSC gave no exact count and we are not calculating one. Second, the wording is "believed to be linked", which is an assessment, not a confirmed attribution. Headlines that say hostile states were "behind" three-quarters of attacks on UK infrastructure are a step firmer than the speech. It also does not cover all cyber attacks on the UK, only incidents the NCSC handled at CNI and its supporting ecosystem.

The same speech carried the 2028 judgment. Horne said the NCSC's latest assessment shows that by 2028 it is highly likely AI cyber capabilities will be used by attackers against known vulnerabilities in legacy technology in CNI. He also said "frontier AI models have demonstrated their effectiveness at finding inherent vulnerabilities" and described adversaries "prepositioning today", establishing footholds inside technology, pointing to the campaign often called Volt Typhoon against largely US infrastructure.

What the November 3 Annual Review adds

The NCSC published its Annual Review 2026 on November 3, covering September 1, 2025 to August 31, 2026. The Next Web and Intelligent CISO both report the headline numbers: 1,831 reports of cyber attacks received, 337 that needed NCSC incident-management support, and 80 rated nationally significant. We read the review's landing page and Horne's launch speech on the NCSC site, but the incident figures were not in the pages we could read, so they rest on those two outlets agreeing with each other, not on a page we saw directly. Those outlets also report the review judging it highly likely that AI-powered malware will be used in a ransomware attack on UK CNI by 2028, and that hostile states will routinely use AI cyber tools by then. The Next Web adds that the NCSC calls its pessimistic 2028 scenario "not a prediction".

The 75% figure is not in the Annual Review coverage we found. It is a June number, for a different twelve months and a different group of incidents, so it should not be set beside the 80 or the 1,831 as if they were one dataset.

In his launch speech Horne warned of "a real prospect of an unprecedented rise in the number of cyber incidents", and said weaknesses tolerated for too long can now be found and exploited "at a scale and pace that was once unimaginable." He called AI potentially "a force multiplier increasing the speed and scale of our adversaries' operations", while also saying it could be "one of the greatest opportunities in cyber defence".

Why a government warning belongs on a business page

The NCSC's argument is not that AI invents new attacks. It is that old, known weaknesses become cheap to find and use. For an owner, "known vulnerability in legacy technology" is a plain list: end-of-life servers kept running for one more year, remote-access tools nobody patched, controllers on a shared vendor network. Horne's launch speech cited exactly this, urging leaders to invest "with urgency" in replacing end-of-life technology, and pointed to the disruption of refrigeration units across Europe as an example of exploitation. We covered that incident in our report on the supermarket freezer attacks, where nobody has claimed responsibility and attribution remains open.

Who this hits most is the operator one step behind the big names: the supplier, contractor or regional utility that sits inside the "supporting ecosystem" the NCSC counts alongside CNI itself. Those firms often run older equipment on thinner budgets and connect to bigger customers.

What the UK is doing about it

In the launch speech Horne said the Chancellor backed a national Cyber Shield, that a new National Exposure and Real-Time Vulnerability Centre will use AI to find vulnerabilities across critical infrastructure and the economy, and that the Cyber Security and Resilience Bill will set a minimum level of resilience across CNI. A National Cyber Action Plan is to be announced "soon". None of those have dates or costs in the text we read.

What to take from it

• The 2028 date is an NCSC judgment of likelihood, expressed as "highly likely" for a specific scenario, not a forecast that attacks will arrive that year.
• The three-quarters figure is state-linked, per the NCSC's belief, among 200-plus CNI-related incidents in the year to May 2026.
• The 80 nationally significant incidents are a different, later period. We could not confirm from a primary page how this compares with last year, so do not read it as a fall in risk, especially since Horne himself warned of a possible rise.

The NCSC's practical message to boards, in the June speech, was to understand exposure, defend starting with foundational controls, and be able to respond and recover. The agency says the fundamentals are still where most significant incidents begin.

Sources: NCSC, Richard Horne at the RUSI Annual Security Lecture, June 17, 2026; RUSI; NCSC, Annual Review 2026 launch speech, November 3, 2026; NCSC Annual Review 2026; The Next Web; Intelligent CISO. This is information, not investment advice.