NCSC Projects AI-Scaled Attacks on UK OT Systems by 2028, Citing Existing TTP Enhancement Over Novel Exploits

The NCSC report details Chinese activity as the most sustained challenge, with Russia conducting sub-threshold campaigns and Iran targeting regime opponents. It explicitly states AI will scale existing tactics rather than create new zero-days, cross-referenced against the December 2025 FSB-linked attempt on Poland's grid that risked 500,000 customers. Procurement records and incident reports show repeated OT exposure in refrigeration, dams, and manufacturing controls. Official attribution to Russia relies on UK-EU statements without public packet-level indicators released.

Cost data records nearly $20 billion in annual UK organizational losses, including Jaguar Land Rover's $260 million direct hit. The report links these to deferred patching and over-privileged accounts, patterns visible in prior NCSC advisories on supply-chain exposure. French supermarket refrigeration incidents demonstrate physical process automation as the attack surface. AI-assisted flaw discovery in widely used languages last week aligns with the predicted efficiency gain on known weaknesses.

Operational risk centers on legacy OT lacking segmentation. Horne's warning ties directly to GCHQ director Keast-Butler's call for baseline controls across all sectors. Independent verification of AI attribution remains limited to observed automation rates in malware samples, not state-specific tooling. Next milestones include 2026 NCSC procurement for AI anomaly detection on ICS protocols.