NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 19 of 29
Securing the UK's internet
The NCSC works with internet service providers, hosting companies and cyber security partners to improve the underlying security of the internet, reducing opportunities for cyber criminals to operate and making the UK safer online.
The NCSC's Active Cyber Defence programme has grown from a pioneering initiative into a national cyber resilience capability, helping organisations across the UK reduce exposure to common threats. It is a practical example of how the NCSC works with the wider ecosystem to raise security standards and strengthen resilience at scale.
Takedown
The NCSC’s Takedown Service works with hosting providers to remove malicious websites from the internet - at scale and in near real time - and blocks any attack infrastructure to limit the harm that cyber criminals can cause. No registration is required for the Takedown Service. Central government organisations benefit automatically without having to sign up.
1.6million+
cyber‑enabled commodity campaigns disrupted.
30,000
confirmed phishing attacks impersonating GOV.UK first taken down within a median of 90 minutes of detection.
1.06%
Using our Takedown providers data (Netcraft), the UK share of global phishing was at 1.06% in June 2026. This is the lowest it has been since the service started back in 2016 (previously over 5%).
Suspicious Email Reporting Service (SERS)
Since its inception in April 2020, the Suspicious Email Reporting Service (SERS) has enabled the public and businesses to report suspicious emails to the NCSC, leading to the removal of thousands of scams.
-
Over 13.4 million reports received in the 12 months from Sep 25 to Aug 26 - the highest since the service started.
-
Total number of reports since April 2020 reached over 58.9 million.
-
460,000 malicious URLs removed by the NCSC since 2020.
The NCSC Proactive Notifications Service
The NCSC:
- identifies organisations operating without essential security services
- sends these organisations emails to help them install software updates that can reduce vulnerabilities
This notification is based on scanning open source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services.
More than 52,000 notifications have been sent, with 70% of the identified vulnerabilities subsequently resolved. Although some organisations may have remediated independently of the notification, the results and feedback indicate that the service is successfully identifying vulnerabilities and reaching affected organisations.
A recent trial found that organisations receiving notifications remediated identified vulnerabilities up to
45%
faster than organisations that did not receive notifications.
Share and Defend
The NCSC works with the UK’s Internet Service Providers to reduce the likelihood of individuals and organisations interacting with malicious content, criminal or otherwise. Developed by the NCSC, the Share and Defend service helps combat online crime by providing internet service providers with near real-time data on fraudulent and malicious websites. Providers can then use this information to prevent customers from accessing harmful sites, reducing the risk of cyber crime. This is one of the ways the NCSC works in partnership with businesses to strengthen the UK's cyber resilience and keep the public safe online.
Share and Defend protects over 61 million mobile subscribers and over 12 million fixed broadband subscribers across the UK from cyber-related harm, including cyber crime and cyber-enabled fraud.
Since launch,
1billion+
early-stage cyber attacks and attempts to access scam websites have been blocked.