NCSC Annual Review 2026: Key Findings and Analysis

The NCSC Annual Review 2026, "The State of the Cyber Nation", was published on 3 November to mark ten years of the National Cyber Security Centre. This is a full summary of its 84 pages: the key findings, the NCSC's formal judgements on AI and state threats, and the numbers behind them. Alongside each section is Precursor's analysis, including a year-on-year comparison the review doesn't make, honeypot data from the week before it came out, and a practical plan for teams that have to act on it.

What is the NCSC Annual Review 2026?

The NCSC Annual Review is the National Cyber Security Centre's yearly account of the cyber threat to the UK and of its own work. The 2026 edition is a ten-year anniversary issue and covers, for most of its figures, 1 September 2025 to 31 August 2026. It has forewords from Richard Horne (NCSC chief executive), Security Minister Dan Jarvis and GCHQ Director Anne Keast-Butler, then six chapters: a decade of cyber threat, technology and the future of cyber security, building strong foundations, securing the UK's critical organisations, the future of cyber defence, and global cyber resilience. You can read the full report (PDF) or the online collection.

Its argument fits in one line from Horne's foreword: the weaknesses AI is exploiting were already there, in the form of "years of technical debt and the failure to implement even basic cyber protections." He says the UK's cyber resilience "is not yet where it should be" and that "the tools, standards and frameworks that can protect the UK... already exist. The challenge now is quickly implementing these at scale." The Security Minister's three asks of organisations are equally plain: implement Cyber Essentials, sign the Cyber Resilience Pledge and join NCSC Early Warning.

NCSC Annual Review 2026 key findings at a glance

The threat: ten years on, the same adversaries

The review opens with a trick. It describes a year in which Russian groups disrupted Ukrainian power, a huge breach exposed government personnel records and ransomware hit UK telecoms and health, then reveals the year is 2015. "The most serious adversaries we face today are the same as they were a decade ago," it says, and the bulk of recent state capability is "a much simpler exploitation of common vulnerabilities and exposures (CVEs)."

The NCSC's state threat assessment in brief:

• China is "the most sophisticated and sustained cyber challenge facing the UK", with a whole-of-state approach built around acquiring data. In December 2025 the UK sanctioned i-Soon and Integrity Technology Group (which the FBI links to Flax Typhoon), and in April 2026 the NCSC and 15 partners published an advisory on the covert networks most China-linked actors use.
• Russia is "the most audacious cyber threat to the UK". In July 2026 the NCSC and 18 international partners called out the FSB's Centre 16 for exploiting vulnerable routers to target critical infrastructure, and the UK and EU attributed the December 2025 attack on Poland's energy grid, which could have cut power to 500,000 people, to the same unit.
• Iran-linked groups are assessed as pursuing indiscriminate disruption at scale.
• Cyber espionage is judged highly likely to be the most significant cyber threat to the UK's long-term economic growth, and the commercial intrusion market has almost certainly lowered the barrier for states.
• Democracy was a focus in a year of local, Holyrood and Senedd elections and a change of Prime Minister, with persistent spear-phishing of high-risk individuals and growing attempts to compromise their messaging apps.

Precursor's read: the case studies are a reminder that "advanced" actors mostly arrive through ordinary kit. Centre 16's campaign ran on routers, and the China advisory was about networks of compromised devices. For most organisations, the useful response to the state threat section is an accurate list of their own edge devices.

Cyber incidents in 2025–26: what the NCSC handled

The NCSC received 1,831 reports of cyber attacks. After triage, 337 needed its support and 80 were classed as nationally significant (the top three categories in the UK's incident categorisation model). It also notified 8,500 organisations of a suspected compromise through Early Warning.

From those 337 incidents the NCSC draws seven lessons:

1. Attackers exploit the basics: known vulnerabilities, poorly secured systems and internet-facing assets.
2. People remain a target, through social engineering and credential theft.
3. State and criminal actors share the same routes in.
4. Ransomware remains highly disruptive, with long recoveries.
5. Preparation (logging, monitoring, incident response plans, supply chain resilience) determines outcomes.
6. Early action, such as acting on an Early Warning alert, reduces impact.
7. Sophisticated actors don't have to be sophisticated to gain access. The skill shows in what they do once they're in.

Precursor's analysis: nationally significant incidents fell 61%

Last year's review had a grim headline: 204 nationally significant incidents, more than double the year before, or about four a week. This year the same measure is 80, roughly one and a half a week.

Some of the fall is probably genuine, but three things argue against reading it as "the UK got safer".

The review itself doesn't claim it. There's no year-on-year comparison anywhere in the 84 pages, and last year's "highly significant" category (18 incidents in 2024–25) isn't reported at all. The NCSC says incident numbers don't follow a simple trend and that past peaks were often tied to "a small number of particularly significant incidents", so a year without one will look calmer on paper.

More is being caught early. Early Warning grew 52%, and the review says its alerts are likely to have headed off some incidents. That's a real gain in detection, though it says nothing about whether fewer attackers were trying.

And the NCSC isn't celebrating. At the launch Horne warned of a possible surge in the coming months, because "vulnerabilities that have been tolerated for far too long can now be discovered and exploited." Reports rose too, though some of that may be more organisations reporting. Anyone putting the 80 in a board pack should put the rising reports figure next to it.

How attackers get in: four routes and old flaws

For large organisations, 88% of incidents came through four initial access routes: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services.

The same holds at the top end. Some state-linked incidents used previously unknown flaws, but the NCSC says "many involve vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion." In critical infrastructure, it sees potentially increasing exploitation of internet-facing systems, and notes that "even sophisticated adversaries frequently gain initial access through known and often preventable weaknesses."

Precursor's data: what attackers were hitting the week before the review

Shadowserver's honeypots, which EdgeProtect tracks daily, tell a similar story. These were the most-attempted exploits against business kit in the week of 26 October, a few days after PHP2Shell broke:

That's firewalls, VPN gateways and a mobile device management server, and the newest flaw is three years old. Ranked by number of attacking IPs (26 to 29 October), the top six were all router and network-device flaws, four of them between eight and twelve years old, led by a 2014 Realtek bug. Much of that is botnets recruiting home and small-office routers, which matters less to most businesses. Honeypots only see opportunistic, internet-wide scanning, but the pattern matches the NCSC's: the most-attacked flaws are old, and they sit on exposed edge and network devices.

Two of the four routes (public-facing apps and external remote services) are about what an organisation exposes, and stolen valid accounts are often used against those same services. The first question worth asking after reading this section is "what exactly is on the internet, and who owns each bit?"

The NCSC's AI assessment: how big is the AI cyber threat to the UK?

The review's AI judgements use the UK intelligence community's probability yardstick, where the wording carries a specific meaning:

The key judgements on AI and the cyber threat:

• Almost certain: AI will act as a force multiplier, letting skilled actors operate at greater scale, speed and efficiency. Its biggest impact will be speeding up existing techniques rather than creating new attack vectors.
• Highly likely: attackers will keep folding AI into their operations to speed up existing methods. Humans remain essential, and losing control of their own AI agents will hinder some threat actors.
• Highly likely: AI-assisted vulnerability discovery and exploit development will pose a significant threat, giving attackers a better chance of hitting systems before they're patched. Defenders face "a race to shorten patch deployment timelines".
• Almost certain: a widening digital divide between organisations that can use AI for defence and those that can't, with weaker organisations on legacy technology becoming "increasingly attractive targets".
• Highly likely: China is best placed to use AI against UK critical infrastructure and strategic targets.
• Highly likely: "shadow AI" (staff using AI tools the organisation doesn't know about) will leave organisations open to exploitation.
• Highly likely: AI malware will be used in a ransomware attack on UK critical national infrastructure by 2028.

The review also includes a deliberately pessimistic 2028 scenario, "the age of autonomous attack", in which a self-replicating AI agent escapes its operator's control. That's rated a "realistic possibility" within the scenario, and the NCSC presents the whole thing as an illustration of what inaction could lead to. It isn't a forecast.

The incident team's own observation is more down to earth. It has started seeing attackers use AI tools, and "none of the observed uses of AI enabled a novel class of attack."

For AI models and agents an organisation runs itself, the NCSC says it needs to know what data a model can access, what tools an agent can invoke, what instructions it trusts, and how its actions are observed and constrained. The review also warns that automating entry-level security work without redesigning training could weaken the routes by which people build deep expertise.

Precursor's analysis: the gap between two clocks

The real risk sits between two clocks. Finding vulnerabilities is now something you can throw compute at. Project DROMOS, run by government's cyber coordination centre with the AI Security Institute, applied frontier AI models to government code and then to selected government environments, and turned up hundreds of potential issues, including critical ones. Fixing still happens at human speed, because someone has to test the patch, book the change and chase the supplier. Horne said at the launch that major vendors are now fixing hundreds of vulnerabilities in a single update, and that the Linux kernel project alone patched more than a thousand in October. The organisations that come out on the right side of the NCSC's digital divide will be the ones that can fix faster.

Shadow AI is the most practical judgement here for most teams. Asking each team what they use and checking sign-in and expense records finds most of it, and answering the NCSC's four questions for each tool costs nothing but time.

The vulnerability patch wave, and what PHP2Shell showed

The review asks every organisation to prepare for a "patch wave": a rush of updates "across all severities", with "a number to be critical", as AI digs up years of technical debt. Organisations are told to deploy updates "quickly, more frequently, and at scale, including across their supply chains." The NCSC's patch wave blog adds the order of work: reduce internet-facing exposure, patch external systems first if you can't patch everything, replace exposed out-of-support kit and adopt a policy of "update by default".

The patch wave is about volume. October gave a sharp lesson in speed with PHP2Shell, two critical remote code execution flaws in PHP that Precursor covered live. Emergency patches had been pre-announced for that afternoon, and attackers were already trying their luck by late morning.

Horne said the NCSC sent more than 110,000 proactive notifications and Early Warning alerts to UK organisations about it. That figure combines both services for a single issue after the review's year closed, so it isn't comparable with the review's 52,000, which counts Proactive Notifications alone. For anyone running internet-facing PHP, the response window was the afternoon of 21 October, a long way short of Cyber Essentials' 14-day window for critical updates.

Two lessons follow. First, organisations need a plan for the hours before a patch exists. At 11:07 there was nothing to install, so the options were a WAF rule in front of the service, restricting who could reach it, or taking it offline until the fix landed.

Second, KEV is a confirmation signal. CISA's catalogue is the usual starting point for prioritisation, and with PHP2Shell it arrived five days after the first attempts. For those first days the signals that mattered were the vendor's advisory, national alerts and reports of exploitation in the wild, so whoever watches those needs the authority to act before KEV catches up. The organisations that were safe by that evening already knew where they ran PHP on the internet and who could sign off an emergency change.

What's working: Early Warning, notifications and faster fixing

The "building strong foundations" chapter is the review's good-news section, and its figures are worth knowing:

• Early Warning grew 52% to 19,922 organisations covering more than a million assets. It sent vulnerability alerts covering 232,777 IP addresses at 11,558 organisations.
• Proactive Notifications scan public information, such as software versions, and email whoever runs vulnerable kit. More than 52,000 have been sent, 70% of the flagged vulnerabilities were later resolved, and in a trial notified organisations fixed issues up to 45% faster.
• Cyber Essentials certifications rose 19.6% to 47,661 in the year to August 2026, with Cyber Essentials Plus up 21.5% to 15,646.
• Phishing: the UK's share of global phishing fell to 1.06%, the lowest since 2016, and 30,000 phishing attacks impersonating GOV.UK were taken down in a median of 90 minutes. The suspicious email reporting service had a record 13.4 million reports.
• Passkeys: the NCSC calls the UK a global leader in passkey adoption, and GOV.UK One Login now offers them.

The two numbers that matter most for vulnerability management are these.

Government cut its median time to fix domain-related vulnerabilities from 50 days to 8, through the £210m+ Government Cyber Action Plan. The review doesn't define exactly which vulnerabilities that covers. Government runs some of the oldest and most tangled estates in the country, though, which makes "we're too complex to move that fast" a hard argument to sustain.

In a trial, organisations that received an NCSC Proactive Notification fixed the issue up to 45% faster than those that didn't. "Up to" means the best result in the trial, and the NCSC notes some organisations may have fixed issues independently, so treat it as a sign of what's possible.

Precursor's read: the review doesn't spell out how either result was achieved, but the common thread looks like visibility and ownership. Someone sees the problem from the outside, a named person is told, and it's tracked until it closes. Two metrics follow from that:

1. Median time to fix exploited or likely-to-be-exploited vulnerabilities on internet-facing systems, meaning anything on KEV, seen in honeypots or with a high EPSS score. Government's 8 days covers a different set of flaws, but it gives a reference point.
2. The share of internet-facing assets with a named owner. If a scan finds something nobody owns, the fixing clock hasn't even started.

The cost, critical infrastructure and supply chains

UK government research cited in the review puts the cost of malicious cyber activity to UK organisations at an estimated £14.7bn a year, roughly the size of the whole UK cyber security sector. A manufacturer dominates the cost story. JLR reported around £196m in direct cyber-related costs from its 2025 attack, suppliers who relied on its schedules and payments felt it too, and the NCSC says the attack contributed to UK GDP growth of just 0.1% in the third quarter of 2025.

For critical and large organisations, the review's message is that "the challenge is no longer identifying risks... it is acting on them." It points to the Cyber Security and Resilience Bill, a new CAF Core Profile as the recommended minimum benchmark for essential services, new guidance on recovering from a highly disruptive attack, and boards being asked for evidence of measurable improvement as well as policies. On supply chains, the NCSC's Supplier Check Tool handled more than 1.5 million supplier searches, and the Cyber Resilience Pledge includes rolling Cyber Essentials out across supply chains.

Precursor's analysis: if you run factories, plants or anything physical

Operational technology is where "update by default" gets hard. The NCSC's patch wave advice carves out safety-critical systems and OT, and maintenance windows on a production line follow the production schedule. Horne was specific about the kit that worries him: electricity switching, sluice gates, dams and refrigeration controls.

When OT can't be patched quickly, the job shifts to exposure:

• Find every way in from outside, especially vendor and OEM remote access. Remote support tools installed on line PCs years ago are a classic blind spot.
• Keep the OT asset list current, with what each device is, what it talks to and who can change it.
• Test the segmentation. Try to reach the plant network from an ordinary office laptop. If that works, an attacker who lands on that laptop gets the same route.
• Watch the boundary. For a small team, that might just mean alerting on any new connection between the IT and OT networks, or any remote access session outside agreed hours.

Then walk through the NCSC's new recovery guidance with the operations lead, because the plant decides how long the business can run without IT. Expect larger customers to ask about Cyber Essentials, and ask the same of suppliers who could stop the line. Precursor's supplier vetting guide has the questions.

What comes next: Cyber Shield, national detection and post-quantum

The final chapters look ahead. The NCSC expects cyber security to move "from periodic, human-led activity towards continuous, machine-assisted defence," and says "vulnerability management will no longer be limited to periodic scanning", becoming a joined-up pathway of discovery, prioritisation, remediation and verification.

• Cyber Shield is a five-year NCSC and DCMS programme to build a national agentic cyber defence ecosystem. The NCSC provides the core platform and intelligence, and the defensive agents are to be built and run by the security market and open-source community. Stage one is detection and blocking.
• The National Detect Strategy (in pilot) aims for defenders to detect and respond to known vulnerabilities and techniques at national scale by 2030. The NCSC admits it remains difficult to build "an authoritative picture" of exploitation and vulnerabilities affecting the UK, and is working with edge-device vendors on forensic visibility.
• Post-quantum cryptography has fixed dates: discovery and planning by 2028, priority migration by 2031 and completion by 2035.
• At the launch, Horne also mentioned a new National Exposure and Real-Time Vulnerability Centre, without further detail.

For the board: one paragraph

The NCSC Annual Review 2026 shows serious incidents fell this year, but reports rose and the NCSC is warning of a possible surge as long-tolerated vulnerabilities are found and exploited faster. Most successful attacks still use familiar routes, starting with known flaws in internet-facing systems. JLR's 2025 attack cost it around £196m in direct costs and hit its suppliers too. In October, attackers went after a critical PHP flaw before the patch was even released. The board is asked to approve an emergency route for same-day action on internet-facing systems (blocking, isolating or patching), and a named owner for each of them.

A 90-day plan for a small team

This is how the review's advice translates for a team of two with no new budget.

Week 1

1. Make a first list of everything exposed to the internet and put a name next to each item: websites, VPN and remote access, email, firewalls and other edge devices. A day gets a first pass. Free sources like certificate transparency logs and NCSC Early Warning help fill the gaps, and keeping the list right is the ongoing job.
2. Sign up to NCSC Early Warning. It's free.
3. List every vendor and remote-access path into the plant, if there is one. Remote services are one of the NCSC's four routes.
4. Write down the emergency route, for both mitigation and patching. Who can approve a WAF rule, an access restriction or a same-day patch on an internet-facing system? If the answer is "the change board on Thursday", that's the first thing to fix.

Month 1

1. Patch the edge first. Firewalls, VPNs, routers and anything else in front of the network, with anything end-of-life and exposed flagged for replacement.
2. Prioritise by exploitation, then severity. For a brand-new critical flaw, act on the vendor advisory and NCSC alerts. After that, work from CISA KEV, EPSS and honeypot evidence. Precursor's guide to vulnerability triage walks through it.
3. Move admin and remote access to passkeys or phishing-resistant MFA. Valid accounts are one of the four routes.

Quarter 1

1. Turn on automatic updates everywhere it's safe, which is the NCSC's "update by default" in practice, and agree the exceptions with whoever runs the plant or safety-critical kit.
2. Answer the NCSC's four AI questions (data, tools, instructions, oversight) for every AI model or agent in use, including the ones staff brought in themselves.
3. Start measuring the two metrics above, monthly.

To make room, stop working through medium-severity internal findings in date order. The NCSC itself says to start with what's external.

With budget, continuous external monitoring is the first place to put it, followed by Cyber Essentials for organisations that don't hold it yet. Larger and regulated organisations should also read up on the Cyber Security and Resilience Bill and the CAF Core Profile. For framing the conversation upwards, see Precursor's guide to communicating cyber risk to the board.

How EdgeProtect tracks exposure and exploited vulnerabilities

The honeypot and exploitation data in this summary comes from EdgeProtect, Precursor's continuous monitoring and exposure management platform. Its attack surface management maps and watches an organisation's external domains, hosts, ports, services and certificates, and its vulnerability intelligence scores CVEs from 0 to 100 using EPSS, CVSS, CISA KEV, the type of flaw and evidence of exploitation. The Shadowserver figures come from its In the Wild feed, and alerts can go straight into Slack, Teams, Splunk or Sentinel.

The same data feeds Precursor's weekly threat roundup and threat intelligence platform. For organisations that would rather have people watching it, Precursor's vulnerability management and security operations centre (SOC) teams can help, or get in touch to see how your estate looks from the outside.

Frequently asked questions

References

• NCSC Annual Review 2026: The State of the Cyber Nation (PDF)
• NCSC Annual Review 2026 collection
• Richard Horne's speech at the NCSC Annual Review 2026 launch
• NCSC Annual Review 2025: Incident management
• NCSC blog: Preparing for a 'vulnerability patch wave'
• NCSC: Critical security issue affecting PHP
• CISA Known Exploited Vulnerabilities catalogue
• FIRST Exploit Prediction Scoring System (EPSS)

Report figures are from the NCSC Annual Review 2026 (reporting period 1 September 2025 to 31 August 2026, though some service figures use slightly different windows) and the NCSC Annual Review 2025 (September 2024 to August 2025), both published under the Open Government Licence. Year-on-year percentages and the nationally significant share of incidents are Precursor's own calculations. The 88% figure covers large organisations only. The PHP2Shell timeline is from Precursor's live coverage and EdgeProtect platform data, and the honeypot figures are Shadowserver telemetry via EdgeProtect from the week of 26 October 2026 (attacking-IP counts cover 26 to 29 October; attempt counts cover the seven days in the 30 October roundup). Both fall after the review's reporting period. The NCSC presents its 2028 scenario as an illustration of what inaction could lead to.