Artificial intelligence and cyber intrusion

* The assessment examines current AI-enabled threat trends and projections to 2028 through three scenarios.
* By 2028, it is highly likely that Russia, China, and other nation states will routinely use AI-cyber to achieve geopolitical goals, resulting in an increase in the scale and speed of sophisticated cyber attacks on the UK.
* Many systems are almost certain to remain vulnerable to attack from AI-cyber tools exploiting system weaknesses with minimal cost for replacement.
* Attackers are likely to apply AI-cyber capability against known vulnerabilities in CNI legacy technology and new attack surfaces created by AI deployment in CNI.
* AI-powered malware is likely to have been used in a ransomware attack on UK CNI between now and 2028.
* Five key drivers influencing the threat include geopolitical tensions, UK CNI cyber defence, the pace of AI development, availability of AI-cyber capability, and AI and a cyber-literate workforce.
* In the baseline scenario, nation states likely leverage AI for cyber capabilities.
* Russian cyber actors are likely to have leveraged open-source AI models for pre-positioning and espionage against UK interests.
* Defensive AI-cyber tools have reduced the window of a vulnerability but do not eliminate systemic risk without correct configuration.
* The optimistic scenario suggests that robust defence measures, workforce education, and responsible regulation will significantly mitigate the threat to UK CNI by 2028.

The presentation of three distinct scenarios—baseline, pessimistic, and optimistic—effectively frames the discussion not as a single prediction but as a spectrum of possible futures dependent on external dynamics such as geopolitical stability and domestic response capacity. The shift from assessing direct capability to analyzing potential trajectories requires recognizing that the likelihoods described are themselves products of the underlying assumptions regarding AI proliferation and defensive adoption.
The baseline scenario paints a picture where systemic vulnerabilities, amplified by rapid AI application, persist despite some defensive measures. This suggests a fundamental tension between offensive acceleration and reactive security deployment. The pessimistic scenario introduces the concept of non-state actor autonomy and the complexity of attribution when frontier AI capabilities proliferate beyond state actors, suggesting that threats may become less predictable and more diffuse. This perspective forces a critical examination of where accountability lies when automated or autonomous entities are involved in cyber conflict.
The optimistic scenario offers an alternative pathway predicated on successful institutional response: modernization of infrastructure, comprehensive workforce upskilling, and stringent regulation. This path highlights that technological capability alone is insufficient; resilience is intrinsically tied to the governance structures and cultural commitment within the UK. The narrative implicitly suggests that cognitive sovereignty relies on steering the development trajectory—whether towards a chaotic proliferation (pessimistic) or structured control (optimistic).
The question for the reader shifts from merely understanding *what* might happen to analyzing *which* set of drivers can be most effectively influenced by human agency and policy decisions. What structural changes are necessary to shift the probability distribution away from the more perilous scenarios, particularly concerning the integration of AI into CNI and the accountability surrounding autonomous cyber activity?