Another zero-day patched just in time for nobody to notice. And this time, everyone is pretending the star of the show is AI, as if criminals are going to stop using whatever works because a UK cyber chief said something about 2028. Spoiler: they will not. They will keep chaining flaws, abusing misconfigurations, and monetizing chaos. Meanwhile, your org will keep asking vendors for “visibility” and your CISO will keep scheduling another “alignment session” over lukewarm coffee.
The Only Prediction Anyone Needs: Attackers Already Adopted Your Weaknesses
The top thread running through this newsletter (and yes, it is basically a buffet of pain) is that attackers are getting better at two things: scaling and adapting. AI-assisted activity is showing up in real incidents, including ransomware activity against a UK school estate reported as “AI-assisted.” And in parallel, you also see resource hijacking in the cloud via “LLMjacking,” where criminals steal API key access to generate expensive billable nonsense. Because nothing says “fun for the whole enterprise” like paying $1 million in cloud charges to keep somebody else’s bot warm.
So when a UK cyber chief predicts AI cyberattacks on critical infrastructure by 2028, you should read it as: “We’re late to the party, but please clap anyway.” States and criminals have been using automation for years. AI just makes the automation louder and more flexible. That part is not new. What is new is the business impact moving faster than your governance process.
Vendors, Funding, and the Great Talent Delusion
Yes, there are acquisitions and platform upgrades. CrowdStrike reportedly paying $495 million for AI security firms is a classic move: buy capability, promise outcomes, and hope your customers will confuse procurement with progress. Meanwhile, Gartner predicts SOCs will have 50 percent more engineers than analysts by 2028 because AI agents will handle routine alert handling. That is adorable. It assumes your organization will actually staff, tune detections, and measure outcomes. In real life, alerts are still treated like tickets, and tickets are still treated like work, and work is still treated like evidence of safety.
And while the industry argues about whether the next big control plane should be scotch-aged, bourbon-fueled, or both, the boring stuff keeps breaking things: unmanaged systems, exposed services, compromised update channels, and third-party software flaws. AI does not fix that. Patching does. Segmentation does. Access control does. But those are not the kind of slides that impress management.
What You Should Do Instead of Another “Awareness” PDF
If you want to prepare for AI-powered threats, start where threats already live: inventory what you own, patch what is exploitable, and lock down the paths that allow remote code execution, credential theft, and lateral movement. Prioritize high-risk exposures over the vulnerability gardening hobby. Ensure critical systems and third-party integrations have update integrity and monitoring that actually gets reviewed. Then test incident response like you mean it, not like it is a ritual to appease auditors.
Because by the time 2028 rolls around, the only thing your organization will have automated is how quickly it can schedule a meeting about “lessons learned.”
Read the original article here: UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
