Britain's cyber chief judges that AI-powered malware is highly likely to be used in a ransomware attack on critical national infrastructure by 2028, Reuters reported on Nov. 3, 2026, citing the UK National Cyber Security Centre's annual review. The striking part of the finding is what AI actually changes.
The centre's core point is that AI speeds up exploitation of old, unpatched weaknesses rather than inventing entirely new attacks. Automation shortens the distance between a known flaw and a working intrusion, which rewards attackers who move fast against systems that patch slowly.
The AI era does not retire the patch. It punishes the delay.
Canadian operators of energy, water, transport and health systems should read the timeline as a patching deadline. Legacy exposure that once sat unnoticed for months becomes reachable in days when exploitation is automated. Closing that gap takes disciplined managed maintenance and support: asset inventories that are actually current, patch cycles measured in days, and segmentation that keeps one old system from opening the whole network.
Pull your oldest unpatched systems into the open this quarter, rank them by exposure, and clear the list before automated exploitation clears it for you. The forecast is 2028. The weakness it names is already installed.