NCSC Annual Review 2026: AI didn’t create the weak spots. It’s finding them faster.

The NCSC Annual Review 2026 landed on 3 November. It's the National Cyber Security Centre's tenth, it's called The State of the Cyber Nation, and it covers the year from September 2025 to August 2026. I've read all 84 pages so you don't have to.

The short version: the attacks hitting UK organisations are mostly the same ones that worked ten years ago. What's changed is the speed. AI hasn't invented new ways in. It's finding the old weaknesses faster than most businesses can fix them.

The headline: a moment of choice

NCSC chief executive Richard Horne opens the review by calling this "a watershed moment" for the UK. He doesn't sugar-coat it: "The UK's cyber resilience is not yet where it should be. The cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could, and should, be prevented."

At the launch in London, he went further. "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he said, and it's "not because AI has invented new ways to attack us. It is because vulnerabilities that have been tolerated for far too long can now be discovered and exploited, at a scale and pace that was once unimaginable."

His diagnosis is blunt. For decades, he said, we've "got away with tech on the cheap": end-of-life systems kept running "for just one more year", access granted where it was convenient rather than necessary, services bought on price alone, and no monitoring to spot when things go wrong.

AI did not create these cyber security weaknesses; it revealed them.

Richard Horne, NCSC chief executive

The numbers at a glance

What	Figure
Reports of cyber attacks received by the NCSC	1,831
Incidents that needed NCSC support	337
Of those, nationally significant	80
Organisations warned of a suspected compromise through Early Warning	8,500
Incidents at large organisations that started one of four familiar ways	88%
Estimated yearly cost of malicious cyber activity to UK organisations	£14.7 billion
Jaguar Land Rover's reported direct costs from its 2025 attack	about £196 million
Cyber Essentials certificates awarded (up 19.6%)	47,661
Cyber Essentials Plus certificates awarded (up 21.5%)	15,646
Suspicious emails reported by the public	13.4 million

One word of caution from the NCSC itself: incident numbers don't follow a neat year-on-year trend, because a handful of huge incidents can skew any one year. The pattern behind them is the useful part.

Same attacks, ten years on

The review has a clever opening trick. It describes a year of power grid attacks, a massive breach of government personnel records, and ransomware hitting telecoms and healthcare. Then it reveals the year is 2015, not 2026.

The point is that the most serious attackers are the same as a decade ago, and so are their favourite ways in. For large organisations, 88% of the incidents the NCSC handled started with one of four things:

• exploiting a public-facing application, like a website, portal or VPN
• phishing
• logging in with a real account that had been stolen or misused
• exploiting remote access services

Even state-backed attackers mostly aren't using anything exotic. The review says the bulk of what it saw in state-backed incidents was "much simpler exploitation of common vulnerabilities", often ones with a patch available that hadn't been applied in time.

What AI actually changes

This is the part most coverage will lead with, so it's worth being precise. The NCSC's judgements are:

• AI is a force multiplier. It's "almost certain" AI lets skilled attackers work at greater scale, speed and efficiency. It speeds up existing attacks rather than inventing new ones.
• The race to patch is on. AI can now find flaws in large codebases that went unnoticed for years. The NCSC says defenders face "a race to shorten patch deployment timelines" before attackers build working exploits.
• A widening divide. Organisations with mature security and the resources to use AI defensively will pull ahead. Those with weak security and ageing tech "may struggle to keep pace", and will become more attractive targets.
• Shadow AI is a real risk. When staff paste company data into personal AI tools, you lose sight of where it goes and who can see it.
• AI ransomware is coming to critical services. It's "highly likely" AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028.

And here's the reassuring bit, if you can call it that. Of the incidents the NCSC handled this year where attackers used AI, "none of the observed uses of AI enabled a novel class of attack." The way to defend against an AI-assisted attack is the same as defending against any other: get the basics right.

The patch wave is coming

One phrase in the review stuck with me: prepare now for "a 'patch wave'". As AI finds more flaws, vendors will ship more fixes, more often, and some will be critical. Horne said the Linux kernel project alone patched more than a thousand vulnerabilities in October.

We've already had a taste of it. During the PHP2Shell flaws this autumn, the NCSC sent more than 110,000 proactive notifications and Early Warning alerts to UK organisations. If your updates happen "when someone gets round to it", that won't hold.

There's good news too. Across government, the Government Cyber Action Plan cut the median time to fix domain-related vulnerabilities from 50 days to 8. Faster is possible when someone owns it.

Seven things 337 incidents taught the NCSC

This is the most useful page in the whole review for anyone running a business. Here's the NCSC's list, in plain English:

1. Attackers exploit the basics. Known vulnerabilities, poorly secured systems and internet-facing kit remain the main way in.
2. People remain a target. Social engineering and stolen passwords still work. Security culture matters.
3. State and criminal attackers share the same routes in. Poor cyber hygiene helps all of them.
4. Ransomware remains highly disruptive. Extortion, data theft and long recovery times.
5. Preparation determines outcomes. Logging, monitoring, an incident response plan and a resilient supply chain.
6. Early action reduces impact. Early warnings and faster detection stop small problems becoming big ones.
7. Sophisticated attackers don't need to be sophisticated to get in. The clever stuff happens after they're inside.

The NCSC's own takeaway: "Most successful attacks continue to exploit familiar weaknesses."

Your suppliers are part of your attack surface

The Jaguar Land Rover attack gets its own case study, and it's the clearest example in the review of why this isn't just an IT problem. The disruption spread to suppliers, retail and the wider economy. The review says it had a direct impact on GDP, with the UK economy growing by only 0.1% in the third quarter of 2025.

That's why the government's Cyber Resilience Pledge includes a commitment to roll out Cyber Essentials across supply chains. The NCSC's Supplier Check Tool, which lets organisations check suppliers' Cyber Essentials status in bulk, already has 797 large organisations signed up and has run more than 1.5 million supplier searches. If you sell to larger organisations, expect to be asked.

The NCSC also piloted a way to "badge" managed service providers that deliver Cyber Essentials-compatible services, with 28 taking part and 73% meeting the bar. A formal scheme is on the way, which will make it easier to tell whether your IT provider is doing the basics properly.

Cyber Essentials is the government's answer to all of this

If there's one message the review repeats more than any other, it's this. The NCSC's stated ambition is "for every UK organisation to get Cyber Essentials." Security minister Dan Jarvis's foreword ends with three asks of organisations: "Implement Cyber Essentials. Sign up to the Cyber Resilience Pledge. Join the NCSC's Early Warning service."

Horne put it this way at the launch: the fundamentals "we recognise through Cyber Essentials" are "the foundations of a resilient business for most organisations in an AI-enabled world."

The numbers suggest businesses are listening. Certifications have grown every year for a decade, from about 6,000 in 2017 to nearly 56,000 in 2025. The NCSC's free readiness tool was used 8,815 times, and its free Cyber Advisor sessions led to 256 organisations getting certified.

Passwords are on their way out

The NCSC now recommends passkeys as the preferred way to sign in, and says the UK leads the world on adoption. GOV.UK One Login and NHS England's app both offer them. Its reasoning is simple: most attacks on individuals start with a stolen or reused password, and even two-step verification can be phished. Passkeys are far harder to phish.

If you haven't got multi-factor authentication on every account yet, start there. Then switch to passkeys wherever your services offer them.

It's not just computers any more

Horne made a point I've been banging on about too. The kit that runs physical processes, from manufacturing lines to heating and "refrigeration controls", is "even more overlooked in investment decisions". He pointed straight to the disruption of refrigeration units across Europe we covered yesterday.

If your business has CCTV, door access, a building management system or anything else on the network that nobody thinks of as "IT", it counts. Our guide to securing CCTV and smart devices covers the checks.

What I'd do in your business this month

None of this needs a big budget. It needs someone to own it. Here's where I'd start:

1. Sign up to Early Warning. It's free from the NCSC and now covers nearly 20,000 organisations. It tells you when something on your network looks compromised or vulnerable.
2. Know what you've got. List your devices, software and cloud services, and flag anything that's out of support. You can't patch what you don't know about.
3. Get ready for the patch wave. Switch on automatic updates wherever you can, and aim to apply critical fixes within days, not weeks. Cyber Essentials asks for 14 days on high and critical updates, and that's a sensible ceiling.
4. Lock down sign-ins. Multi-factor authentication everywhere, a password manager for the team, and passkeys where you can.
5. Set some AI ground rules. Decide which AI tools staff can use and what they must never paste into them. That deals with shadow AI before it becomes a leak.
6. Plan for a bad day. Test your backups, and write a one-page plan for who does what if you're hit. The NCSC's lesson five is that preparation decides the outcome.
7. Get Cyber Essentials. It covers the basics the review keeps coming back to, and your customers will increasingly ask for it.

My take

I've read a lot of these reports, and this is the most direct one yet. It doesn't ask organisations to fear AI. It asks them to stop putting off the boring jobs: the update that keeps getting snoozed, the old server nobody wants to touch, the shared admin password.

Horne closed his speech with a warning about "boardroom conversations" that end up being about "what should have been done." For most businesses, the work to avoid that conversation is well understood, and much cheaper than the incident. The basics didn't get less important when AI arrived. They got urgent.

FAQ

What is the NCSC Annual Review 2026?

It's the National Cyber Security Centre's yearly report on the state of UK cyber security. The 2026 edition, called The State of the Cyber Nation, was published on 3 November 2026 and covers 1 September 2025 to 31 August 2026. It's the NCSC's tenth annual review.

How many cyber incidents did the NCSC handle this year?

It received 1,831 reports of cyber attacks. After triage, 337 incidents needed its support, and 80 of those were classed as nationally significant. Its Early Warning service also alerted 8,500 organisations to a suspected compromise.

Does the review say AI is creating new kinds of cyber attack?

Not yet. The NCSC says AI is a force multiplier that makes existing attacks faster, cheaper and more scalable. Of the AI use it saw in incidents this year, none enabled a new class of attack. It does expect AI-powered malware to be used against UK critical infrastructure by 2028.

What does the NCSC want businesses to do?

Implement Cyber Essentials, sign up to the Cyber Resilience Pledge and join the free Early Warning service. Behind that, it wants organisations to replace end-of-life technology, patch faster, use multi-factor authentication or passkeys, and plan for incidents.

What is a patch wave?

It's the NCSC's term for the rush of security updates it expects as AI finds more vulnerabilities in software. Organisations should plan to deploy updates more quickly and more often, including across their supply chains.

Sources

• NCSC Annual Review 2026: The State of the Cyber Nation (NCSC, 3 November 2026)
• NCSC Annual Review 2026, full report (PDF) (NCSC)
• Richard Horne's speech at the NCSC Annual Review 2026 launch (NCSC, 3 November 2026)