NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 5 of 29
Message from Director, GCHQ
In an age of radical uncertainty, contested geopolitics and rapidly changing technology, cyber security must be an urgent priority for all organisations.
Over the past decade, the NCSC has established and continued to evolve and reimagine the role of cyber security and helped organisations and individuals understand cyber risk, respond to incidents and strengthen resilience. Since its establishment in 2016, its mission has been clear: to make the UK the safest place to live and work online. The NCSC continues to deliver against that mission today.
New technologies are creating extraordinary opportunities for growth, innovation and prosperity. But they are also reshaping the cyber threat landscape. Artificial intelligence is accelerating change, increasing the scale and speed at which cyber threats can emerge, and exposing weaknesses in the technologies and systems we rely upon every day.
The response is not to fear technological change, but to adapt to it.
Across GCHQ and the NCSC, we are developing new approaches to cyber defence, including pioneering work on Cyber Shield and the responsible application of AI to strengthen the UK's cyber resilience.
But technology alone will not solve this challenge. We need every organisation in the UK to take action now. Not only to protect their customers, services and livelihoods, but because cyber security is now part of the frontline defence of our nation.
Looking at Russia alone, it is clear that cyber operations are increasingly integrated into conflict, and that tactics developed against Ukraine are now being directed more widely against states and their institutions.
We cannot know what the next decade will bring, but we do know we must be ready.
That means modernising technology and building resilience at the pace demanded by a rapidly changing world. It means moving from understanding cyber risk to reducing it. And it means preparing for disruption, ensuring essential services can be maintained, recovery can happen quickly, and organisations can operate with confidence during periods of heightened threat.
These are no longer optional choices. They are fundamental requirements of a secure and resilient society.
None of us can meet this challenge alone, but together we are greater than the sum of our parts. The NCSC's success over the past decade has been built on partnerships, and its future will be too. I’m immensely proud of the entire NCSC team for their work protecting our national security, our economy and our way of life.