NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 25 of 29
The National Detect Strategy: Building the future of cyber defence
The UK's critical services are frequently vulnerable to known cyber attacks.
While significant progress has been made in strengthening cyber resilience, organisations across the UK continue to be exposed to common vulnerabilities and well-understood attacker techniques.
To address this challenge, the NCSC is piloting the National Detect Strategy (NDS): a long-term national approach to improving the UK's ability to detect and respond to cyber threats. The strategy supports defenders in tackling known vulnerabilities and adversary tactics, techniques and procedures (TTPs) across critical systems and networks.
The NDS provides a joined-up approach to cyber defence, bringing together operators, oversight bodies, technology providers, government and academia to strengthen detection, share expertise and improve resilience. It focuses on challenges that are beyond the ability of a single organisation to address alone and therefore require collective action. The NDS is a key part of the Government Cyber Action Plan (GCAP) and the forthcoming National Cyber Action Plan (NCAP).
What is the NDS seeking to achieve?
By 2030, the NDS aims to deliver two national outcomes:
- Defenders are detecting and responding effectively to known vulnerabilities and adversary tactics, techniques and procedures (TTPs) across critical systems at organisational, community and national scale.
- Defenders have access to the capabilities, tooling and expertise required to detect and respond effectively to cyber threats.
The strategy is built around four themes that will help shape how the UK detects and responds to cyber threats.
- 1
Significantly strengthened defender communities
Defender communities help organisations combine knowledge of adversaries, vulnerabilities and technologies of common interest. The aim is to optimise scarce specialist skills through collaboration, creating a federated model that scales from individual organisations through to the national level. The NCSC is currently working closely with three key defender communities in this phase of the pilot, with plans to expand this in the future.
- 2
National Cyber Coordination Function (NCCF)
The strategy recognises the need for greater coordination and action at national scale. A National Cyber Coordination Function (NCCF) will help support defender communities, improve collaboration and strengthen collective responses to cyber threats. This is being explored through HUNT, which brings together the UK's national defender communities to share hypotheses and develop new tradecraft. Over 160 participants from government and industry, participated in Microsoft led guided threat hunts. Future events will focus on identity and TTPs associated with recent attacks. The NCSC is currently developing a wireframe of the NCCF, piloting essential functions with partners.
- 3
Improving national observability
Today, it remains difficult to establish an authoritative picture of significant cyber intrusions, exploitation and vulnerabilities affecting the UK. The strategy seeks to improve transparency and observability, enabling faster and more informed decision-making. The NCSC is currently working with major vendors and technology leaders, to establish the authorisations and frameworks needed to support greater national visibility.
- 4
Partnerships with industry and academia
Technology providers, researchers and academic institutions play a critical role in strengthening cyber defence. The strategy will work with partners on:
a) Application of frontier capabilities with partners, including the research and innovation needed to enable cyber defence for the AI era. The government's Cyber Shield work is exploring how agentic systems can support the near real-time detection, analysis and response to intrusions and vulnerabilities, helping to shape the next generation of cyber defence capabilities.
b) Creating the right market incentives. Well-designed technology components are typically easier to secure and defend. To help address known security challenges, the NCSC is working with vendors of edge devices, including VPN gateways, firewalls and other network appliances. This work includes initiatives such as Making forensic observability the norm for network devices. In the future, lessons learned from this pilot could help inform the development of a Critical Technologies Code of Practice covering a broader range of technology components.