NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 4 of 29
Minister of State
If a week is a long time in politics, then a decade is an epoch in cyber security.
The cyber security landscape has changed considerably since the National Cyber Security Centre opened its doors ten years ago. The raw number of cyber attacks is increasing. State threats and their proxies are becoming more brazen.
But by far the biggest development in cyber security over the last decade is the advent of artificial intelligence.
AI opens up practical opportunities to strengthen our defences, putting new tools to the test, protecting our systems and tracking our adversaries. But it also empowers those seeking to do us harm, upgrading their capabilities and exposing previously unknown vulnerabilities in our defences.
Maximising opportunities whilst minimising risks from AI is an era-defining challenge. This year’s Annual Review shows the NCSC stands on the frontline of meeting it, as national initiatives like Cyber Shield and the National Detect Strategy are using AI to deliver automated defence at scale.
Government action to respond to fast-changing cyber threats is accelerating too. This government has published the Government Cyber Action Plan – backed by more than £210 million of investment, improving the resilience of public services and our incident response. The National Cyber Action Plan will soon follow, as we continue to progress through the Cyber Security and Resilience Bill, the biggest update to UK cyber regulation in years.
Yet despite the pace of change, I am struck in reading this year’s Annual Review that the core components of good cyber security remain exactly the same today as they did in 2016. Familiar and preventable weaknesses like unpatched software and password compromise remain open doors for our adversaries that too many organisations are not taking seriously.
As the NCSC enters its second decade, I express my utmost gratitude for the tireless work it does to keep us safe, every single day. I also encourage businesses and organisations across the UK to step up and play their part in our defences. Implement Cyber Essentials. Sign up to the Cyber Resilience Pledge. Join the NCSC’s Early Warning service.
By working together to strengthen the foundations of our cyber security today, we can ensure our country remains secure for the decade ahead.