NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 17 of 29
Embedding cyber security into everything
Building a resilient UK starts with embedding cyber security into technology, services, organisations, people and leadership.
It also requires organisations of every size, from sole traders and small businesses to major employers and public sector bodies, to make cyber security part of their everyday business.
The NCSC is helping organisations strengthen resilience through practical guidance, training, services and support. But the central message remains simple: cyber resilience needs to be built on strong foundations.
The good news is that we already know what works. Knowing what technology you rely on, keeping systems updated, controlling access to important accounts and information, backing up critical data and preparing for incidents remain the foundations of effective cyber defence. The challenge is no longer understanding what good cyber security looks like. It is putting it into practice, consistently, at scale and at the speed the threat now demands. For all organisations, this starts with implementing the five technical controls at the heart of Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection.
Many successful cyber attacks still exploit weaknesses that are well understood and preventable. The NCSC continues to see the same vulnerabilities exploited time and again. These are vulnerabilities that are often straightforward for attackers to identify and for organisations to address.
This matters because AI is changing the economics of cyber attacks. It is making it easier to identify weaknesses, easier to target organisations and easier to operate at scale. AI did not create these weaknesses. It is exposing them faster than ever before. AI is increasing the urgency, but organisations still have a choice. Those that strengthen resilience, modernise ageing technology and address known weaknesses now will be better placed to manage risk and safely realise the benefits of AI.
AI does not fundamentally change what good cyber security looks like; it makes proven cyber security foundations more important than ever.
Success will increasingly depend on organisations' ability to remediate, recover and adapt quickly, while using AI to strengthen cyber defence, identify threats earlier and improve resilience.
Ultimately, the organisations that invest in strong cyber foundations today will be the ones most capable of navigating future challenges and opportunities. In doing so, they will help build the trusted digital foundations on which the UK's future prosperity, security and growth depend.