Britain’s Critical Systems Exposed as AI Threat Grows

Britain will likely face AI-powered cyberattacks on critical infrastructure by 2028, Richard Horne, head of the U.K.'s National Cyber Security Center, warned Tuesday. The systems at risk aren't remote abstractions: they include electricity switching, water-facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls. Horne said AI could help attackers exploit vulnerabilities “at a scale that was once unimaginable.”

His warning, delivered as the NCSC published its annual cyber report, puts a question to the leaders responsible for these systems: what happens when the technology underpinning daily life is left exposed? Horne said business and organization leaders who have “got away with tech on the cheap” would have to explain “why food isn't on the shelves, lights aren't on, businesses have gone under” if they fail to invest in cybersecurity or replace outdated technology.

Civilian systems, exposed

The NCSC report said state and criminal use of AI is highly likely to increase the scale and efficiency of hostile operations. It said AI is more likely to enhance and scale existing tactics than uncover entirely new vulnerabilities. That distinction offers little comfort to people relying on systems that attackers can already reach.

Last week, governments and corporations worked on urgent security updates after AI-assisted discovery of two critical flaws in a programming language used by 70% of websites globally. The flaws could let attackers gain unauthenticated access to websites and, in theory, remotely control a web server without a password.

Supermarket refrigeration has already shown how connected infrastructure can become a target. Euronews reported cyber incidents affecting supermarket chains in Belgium, Luxembourg, Estonia, the Netherlands and Ireland on Monday. Sweden was also affected, and one store blamed a cyberattack. Weeks earlier, freezers in about 500-700 French supermarkets were hit, with temperatures rising as high as 50 degrees Celsius.

No group has claimed responsibility or been blamed for the supermarket refrigeration hacks. French authorities believe international actors were involved in the October 12 attack, but no official attribution has been made. Marta Rybczynska, founder and cybersecurity expert at Ygreky, told Euronews Next that the absence of a claim could mean attackers want to cause unrest or are planning further attacks. She said there was no monetary gain for hackers.

Old systems, new scale

Rybczynska called supermarket fridges and freezers “easy targets,” saying instructions for attacking them are readily available online. She questioned why shops hadn't better protected their systems after the French attacks. “The big problem I see is that shops didn't consider themself as possible targets,” she said. “I think there's an urgent need to start protecting those services that didn't consider them important enough.”

Pavlina Pavlova, founder of cybersecurity firm Critical Cyber, said the hacks are likely to continue because the systems are vulnerable. Refrigeration controllers hit in France included older models that no longer receive security updates, despite flaws known since 2025. Pavlova said they are targeted because “they are reachable and undefended.”

AI, she said, lowers the barrier to entry for sophisticated attacks and can automate them at a speed and scale humans cannot match. “AI-driven vulnerability detection makes finding and exploiting weak points easier and faster than ever, including in vital functions on which people depend — while patching at this speed remains a bottleneck for defenders,” she said. “It will probably get worse before it gets better.”

Security as a state demand

The report described Chinese cyber activity as “the most sophisticated and sustained cyber challenge facing the U.K.” It said Russia and China will routinely use AI to pursue geopolitical goals. Horne said Russia is conducting cyber campaigns below the threshold of armed conflict, while Iran is carrying out attacks against the U.K. and targeting people who pose a threat to the Iranian regime.

The U.K. and EU member states said Russia's FSB security service was behind an attack on Poland's energy grid in December 2025. If successful, it could have left 500,000 people without electricity during winter. Malicious cyber activity costs U.K. organizations almost $20 billion every year, the NCSC said. In 2025, a cyberattack caused Jaguar Land Rover more than $260 million in direct losses, hit suppliers and dented the U.K. economy.

Anne Keast-Butler, director of GCHQ, Britain's signals intelligence agency, said cybersecurity is “now part of the front line defense of our nation.” The NCSC urged organizations to update devices, limit administrator access and back up important files and data. The immediate burden falls on organizations to secure the networks that run essential services; the consequences of failure reach people facing empty shelves, dark homes and disrupted work.