Summary
- The NCSC assesses that AI-powered malware is highly likely to be used in a ransomware attack against UK critical national infrastructure by 2028.
- Its 2026 annual review identifies increasing use of AI by hostile actors alongside continued exploitation of familiar vulnerabilities.
- Data centres form part of UK critical national infrastructure, making the resilience of facility operations and supporting systems relevant to the assessment.
Britain’s National Cyber Security Centre has assessed that AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028, warning that hostile actors are becoming more capable of exploiting established security weaknesses.
The assessment forms part of the NCSC Annual Review 2026, published on 3 November. The agency expects artificial intelligence to increase the speed and scale of ransomware operations, social engineering, and vulnerability exploitation.
The forecast applies across critical national infrastructure rather than identifying a new incident at a particular data centre. Data centres were designated part of the UK’s critical national infrastructure in 2024, bringing the physical facilities supporting digital services within the wider national resilience debate.
The NCSC expects criminals to repurpose AI tools originally developed for legitimate activities, including security research, to automate elements of their existing attack processes. The assessment does not conclude that an entirely new form of malware is necessary for attacks to become more effective.
Evidence from the agency’s incident management work indicates that successful compromises continue to exploit familiar weaknesses. These include vulnerabilities in internet-facing systems and weaknesses that can be reduced through established security controls.
The NCSC also reports observing the use of AI in hostile operations during its review period, although the examples it examined had not enabled a novel class of attack. The distinction separates capabilities already observed from the more serious outcomes forecast for the period to 2028.
Operational dependencies inside data centres
Data centres combine computing and networking infrastructure with electrical distribution, cooling, access control, monitoring, and building management systems. Their cyber security requirements therefore extend beyond the customer workloads hosted inside the facility.
Operational technology may support equipment supervision, environmental controls, maintenance, and physical security. The potential consequences of a cyber incident depend on how these systems are connected, administered, and separated from other networks.
A compromise affecting an administrative system does not automatically interrupt electricity or cooling. The outcome depends on the architecture, the privileges obtained by an attacker, and whether essential equipment can continue operating independently.
Nevertheless, disruption to monitoring or management systems can complicate fault identification, maintenance, and recovery, even where the underlying physical equipment remains operational.
Access provided to specialist contractors and equipment suppliers introduces further dependencies. Remote maintenance can be necessary for complex infrastructure, but accounts, connections, and permissions need to be controlled according to the sensitivity of the systems involved.
Known vulnerabilities remain particularly important where equipment cannot be updated without careful planning or an interruption to services. Operators may need compensating controls, monitoring, and maintenance procedures while software or firmware changes are assessed and implemented.
Network separation and access controls can reduce the opportunity for an attacker to move between administrative, customer, and facility systems. Their effectiveness depends on the actual configuration and whether operational exceptions undermine the intended boundaries.
Recovery planning and critical services
Traditional data centre resilience engineering often addresses equipment failures, utility interruptions, and maintenance events. Cyber incidents can differ because they may affect several connected systems or suppliers at the same time.
A recovery plan that assumes administrators retain access to normal identity, monitoring, and management services may be insufficient where those services are themselves unavailable or compromised.
Operators therefore need arrangements that reflect the critical dependencies of their particular facilities. These may include access to essential configuration information, recovery of management systems, continuity of monitoring, and the ability to maintain safe equipment operation during an incident.
Testing can establish whether those arrangements work under realistic conditions. A documented plan alone does not prove that staff can restore services when normal communications or administrative tools are unavailable.
Supply chain security also affects recovery. A facility may depend on external organisations for specialist equipment support, network services, software platforms, or incident response capabilities, making coordination arrangements part of operational resilience.
The NCSC’s review covers activity between 1 September 2025 and 31 August 2026 while also assessing future threats. Its forecast of AI-enabled attacks should not be presented as evidence that every critical infrastructure operator has already experienced such an incident.
UK legislation is also moving towards more explicit cyber requirements for relevant data centre operators through the Cyber Security and Resilience (Network and Information Systems) Bill. That process is separate from the NCSC’s threat assessment, and the review does not itself introduce new legal duties.
The NCSC identifies established security weaknesses as a continuing source of successful attacks, even as automation becomes more capable. The practical consequences for data centres depend on the protection of facility systems, the management of external dependencies, and the ability to maintain or restore operations following a compromise.
