NCSC Annual Review 2026

Over the past decade, we have built world-class cyber security capabilities, established the NCSC as a trusted authority at home and abroad, and strengthened partnerships with government, industry and academia. 

Across Scotland, Wales and Northern Ireland, the NCSC expanded its engagement with devolved governments, helping public services, democratic institutions and critical national functions better understand cyber risk and make greater use of NCSC advice, services and expertise.

We can be proud of that progress, and we must also be honest. The UK’s cyber resilience is not yet where it should be. The cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could – and should – be prevented.

The cyber security challenge for the next decade is ensuring organisations are adequately prepared and can adapt quickly enough to defend themselves against AI-powered attacks.

 

AI brings this reality into sharper focus. AI makes cyber attacks easier, faster and cheaper to execute, and at greater scale. But AI did not create these cyber security weaknesses; it revealed them. It exposed years of technical debt and the failure to implement even basic cyber protections, with technology and security investments too often deferred. 

The biggest cyber security challenge of the next decade requires us to look not at our attackers, but at ourselves. It is whether organisations can modernise their technologies and build resilience at the pace that’s required. 

And there is reason for optimism. AI, and the investment organisations will make to adopt it, also represent the best opportunity we have to improve cyber security at scale. 

Used responsibly, AI can help us identify weaknesses faster, automate defensive actions, accelerate recovery and extend advanced capabilities to organisations for whom they would previously have been out of reach. As organisations invest in developing technology to enable them to adopt AI, they have the opportunity to refresh their technology and build proper full-life maintenance regimes with focus and urgency. 

10 years on from the NCSC’s formation, we face a moment of choice. If we act now, cyber security can become a source of national strength, driving economic growth and building trust in our increasingly digital world. 

If we delay, cyber attacks will become more frequent, more severe and more costly. 

The future is not set. The UK’s ability to withstand disruption – and to exploit the opportunities that AI promises – will be determined by the choices we make now, the speed with which we adapt, and our collective willingness to act. 

This Annual Review is both a reflection on the progress the NCSC has made, and a call to action for the decade ahead. Inside, you’ll see that the tools, standards and frameworks that can protect the UK from conventional and AI-powered cyber attacks already exist. The challenge now is quickly implementing these at scale.

Richard Horne, CEO NCSC