UK Cyber Agency Warns AI Malware Likely to Hit Critical Infrastructure by 2028

The UK's National Cyber Security Centre has warned that AI-powered malware is "highly likely" to be used to hack critical national infrastructure by 2028, according to a Guardian report. The agency expects attacks targeting facilities including power stations, airports and hospitals, marking a significant escalation in the threat landscape facing operators of essential services.

The warning carries direct implications for investors in utilities, transport and healthcare infrastructure, where cyber resilience is becoming a core operational and regulatory risk. Operators may face pressure to increase security spending, upgrade legacy systems and strengthen incident-response capabilities ahead of the projected threat window. For companies in these sectors, failure to prepare could expose them to service disruptions, regulatory scrutiny and reputational damage, while vendors supplying cyber defence tools and services stand to benefit from rising demand.

What to watch next is how the NCSC's assessment translates into policy and enforcement. Investors should monitor whether regulators move to tighten security requirements for critical infrastructure operators, how companies respond with capital allocation toward cyber defences, and whether insurers and lenders begin pricing in elevated risk for exposed sectors. Any confirmed AI-enabled attack on UK infrastructure before 2028 would likely accelerate both regulatory action and security spending across the economy.