Annual Review
NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 13 of 29
7 things we learned
What 337 incidents revealed about cyber resilience in the UK.
- 1
Attackers exploit the basics
- known vulnerabilities
- poorly secured systems
- internet-facing assets remain a primary route to compromise
- 2
People remain the target
- social engineering
- credential theft
- security culture matters
- 3
State and criminal actors share weaknesses
- similar routes to compromise
- vulnerability exploitation
- credential abuse
- poor cyber hygiene creates opportunities for all threat actors
- 4
Ransomware remains highly disruptive
- extortion
- data theft
- operational disruption
- long recovery timelines
- 5
Preparation determines outcomes
- logging
- monitoring
- incident response planning
- supply chain resilience
- 6
Early action reduces impact
- Early Warning notifications
- faster detection
- containment before escalation
- incidents prevented from requiring NCSC support
- 7
Sophisticated actors don't have to be sophisticated to gain access
- initial access doesn't have to be sophisticated
- onward activity by the actor is where sophistication becomes evident
Key takeaway:
Most successful attacks continue to exploit familiar weaknesses. Improving cyber resilience fundamentals remains the most effective way to reduce both the likelihood and impact of cyber incidents.