NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 18 of 29
Why ‘building strong foundations’ has never mattered more
Applying cyber security fundamentals is still the best way to repel many of the commodity attacks we see today.
When the NCSC was launched in 2016, Ciaran Martin – our first CEO – outlined why the UK needed a National Cyber Security Centre. His advice to CNI, SMEs and larger organisations was “Work out which bits are most relevant to you. Then focus on getting the basics right."
Back then, ransomware attacks were still novel and artificial intelligence (AI) was a speculative issue for cyber security. 10 years later, cyber attacks by agentic AI tools can perform unsanctioned actions and can use ‘human-like deceptive behaviour’ on the open internet (what the media refer to as ‘tech going rogue’). But that original advice remains remarkably prescient, and it’s a consistent message that runs through all of the NCSC’s pages of guidance dedicated to mitigating the threats from AI-assisted attacks:
The best way to protect all systems, whether those threats are AI-assisted or not, is by making sure you have the cyber security foundations in place.
So what are ‘strong foundations’?
A frequent complaint from business leaders (and everyday citizens) is that experts use complicated jargon when describing technology and cyber security.
Cyber security best practice. Maintaining cyber security fundamentals. Doing the basics. Strong cyber foundations. What good cyber security looks like.
These are all terms used by the industry to describe ‘getting the basics right’. The reality is that without strong foundations in place, all organisations, regardless of size or sector they operate in, will be disrupted by cyber attacks. AI-powered cyber attacks are a force multiplier which makes it easier, faster and cheaper for an attacker to ruthlessly expose those organisations that don’t have ‘the basics’ in place.
How do you build strong foundations?
For the last ten years, the NCSC has been developing a range of frameworks, tools, advice and guidance that will help you build strong foundations, whether you’re a micro-business with a handful of devices to look after, or an SME with a growing IT estate to manage. These are summarised below, starting with the Cyber Action Toolkit for those who need help taking their first steps in cyber security.
The majority of cyber attacks rely on techniques that are well known, and that can be mitigated. Individuals and organisations that implement the NCSC’s world-leading guidance, which can be downloaded and shared free of charge from our website, would be protected from such attacks. Organisations that do this also stand the best chance of repelling the next generation of AI-powered attacks.
The Cyber Action Toolkit
What is it, and who is it for?
The Cyber Action Toolkit is a free, web-based toolkit for sole traders and micro-organisations that you can access from your phone, tablet or computer. It turns the advice from the NCSC’s experts into simple, achievable steps, with built-in features that recognise your progress.
How does it help me ‘build strong foundations’?
The toolkit helps you to build layers of protection around your business. You’ll start by protecting your most important accounts (such as your email and banking accounts) and learn how to protect accounts and devices by using password managers and 2SV.
By the time you’ve completed the toolkit, you’ll be able to spot cyber attacks, and to know how to recover your important data should the worst happen. You’ll also have the foundations in place to work towards Cyber Essentials certification.
The actions covered in the Cyber Action Toolkit
As you work through the toolkit, progressing from Foundation to Improver to Enhanced, you will build layers of protection around your organisation which defend against common cyber threats.
Foundation | Improver | Enhanced |
|---|---|---|
| Secure your business's email accounts | Remove unnecessary user accounts | Plan your response to a cyber attack |
| Use a password manager | Back up your important work files and data | Limit administrator access to cloud services |
| Secure your important online accounts | Create separate admin and user accounts on devices | Review your digital footprint |
| Check your devices are up to date | Learn how to spot a cyber attack | Consider Cyber Essentials |
| Update apps and remove unused ones | Check your antivirus and firewall | |
| Secure your devices |
As of 3 September 2026
23,978
users have landed on the toolkit
14,200
steps have been marked as 'done'
376
users completed Foundation level, 247 Improver level and 188 Enhanced level
1,761
accounts created
From action to certification: Supporting the journey to Cyber Essentials
Our ambition is for every UK organisation to get Cyber Essentials to reduce cyber risk and strengthen protection. To help organisations get there and meet the UK minimum standard for cyber security the NCSC provides a range of free support:
30 minutes of free support from a Cyber Advisor
Cyber Advisor is a network of cyber security consultants who’ve been assured by the NCSC to work specifically with smaller organisations. They understand how to apply the five steps that make up Cyber Essentials in a way that’s practical, realistic and relevant for your business.
Since January, around 1235 requests for free consultations have been made. By August 2026 around 858 have been completed. This has already led to over 256 small organisations successfully gaining Cyber Essentials certification – which translates to a 30% conversion rate – with many more under way.
The Cyber Essentials Readiness Tool
The Cyber Essentials Readiness Tool helps organisations understand how well they align with the Cyber Essentials requirements and provides tailored guidance on the steps needed to achieve certification.
The CE Readiness tool has been used 8815 times by organisations (August 2025 - September 2026).
| Organisation size | Usage |
|---|---|
| Large | 1,235 |
| Medium | 1,563 |
| Small | 2,250 |
| Micro | 3,112 |
| Single person / sole trader | 655 |
Top sectors using the CE Readiness tool, include: IT, Consultancy, Manufacturing, Charities, Construction, Health, Finance, Engineering, Managed Services, Academia, Legal, Retail
Download the Assessment Questions
The free Question Set helps organisations understand the Cyber Essentials assessment questions, identify gaps and prepare for certification with greater confidence.
Cyber Essentials is an annually renewable cyber security certification that works in the form of a self-assessment questionnaire.
You can download the self-assessment Question Set in advance, identify gaps and and prepare for certification with greater confidence.
Downloads of the ‘Question set’: 31,408
Downloads of ‘Question set’ and ‘Requirements for IT Infrastructure’: 51,424
Cyber Essentials
What is it, and who is it for?
Cyber Essentials is the minimum standard of cyber security recommended by the government for UK organisations of all sizes.
Developed by the experts at the NCSC, the certification scheme is aligned to five technical controls designed to prevent the most common internet based cyber security threats. With Cyber Essentials in place, you’ll have peace of mind that your organisation is protected against common online threats, and build customer trust as you’ve shown you take cyber security seriously.
How does it help me ‘build strong foundations’?
Cyber Essentials helps organisations stay safe by ensuring 5 technical controls are in place.
- 1
Firewalls
Create a security filter between the internet and your network.
- 2
Secure configuration
Set up computers securely to minimise ways that a cyber criminal can find a way in.
- 3
Security update management
Prevent cyber criminals using vulnerabilities they find in software as an access point to your systems.
- 4
User access control
Control who can access your data and services and what level of access they have.
- 5
Malware protection
Identify and immobilise viruses or other malicious software before it has a chance to cause harm.
September 2025 to August 2026
47,661
(+19.6%) Cyber Essentials certifications awarded
15,646
(+21.5%) Cyber Essentials Plus certifications awarded
444
(+10.4%) Cyber Essentials Certification Bodies across the UK
Ten years of Cyber Essentials (2017- Aug 2026)
| Year | Number of certifications |
|---|---|
| 2017 | 6,037 |
| 2018 | 11,831 |
| 2019 | 15,945 |
| 2020 | 19,379 |
| 2021 | 26,369 |
| 2022 | 31,293 |
| 2023 | 39,878 |
| 2024 | 47,368 |
| 2025 | 55,796 |
| 2026 (to end of Aug) | 42,869 |
Reducing barriers to Cyber Essentials for SMEs
We know that organisations using Managed Service Providers (MSPs) can face additional complexity when working towards Cyber Essentials certification. To address this, the NCSC ran a pilot to explore the possibility of 'badging' MSPs that can provide Cyber Essentials compatible services, with 28 providers taking part and 73% meeting the required threshold. The pilot is informing a formal scheme, expected to launch late 2026. This will help organisations identify providers who offer a service that will align with Cyber Essentials requirements and support wider adoption of the scheme across the UK.
Early Warning
What is it, and who is it for?
Early Warning is a free service available to any organisation within the UK. Once you’ve registered with the service, you’ll be sent alerts that warn you of suspicious activity affecting your network.
How does it help me ‘build strong foundations’?
Early Warning will notify enrolled organisations of any cyber attacks detected by our feed suppliers. It warns you about potential intrusions and vulnerabilities on your network, so you can act on them before they become bigger problems. Early Warning delivers an average of 2,000 alerts each month to nearly 20,000 organisations, offering potentially invaluable time to detect and stop a cyber incident.
Early Warning numbers
- 19,922 organisations signed up to Early Warning service - a 52% increase from last year.
- Over 50 million total events matched and sent in a 12 month period.
- Over 1 million assets now signed up to Early Warning.
Vulnerabilities:
- We sent alerts to 232,777 unique IP addresses with a vulnerability (so if one IP got 50 alerts this would be counted as 1).
- This breaks down to 11,558 unique organisations.
Malware:
- We sent alerts to 296,235 unique IP addresses with a malware infection.
- This breaks down to 3,222 unique organisations.
- We alerted 1,018 unique organisations to a compromised server in the reporting period, across 4,280 unique IP addresses.