NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 9 of 29
The cyber threat to the UK
A more contested, competitive and technologically accelerated cyber environment.
Cyber attacks are no longer just a means of stealing secrets or disrupting systems. They are increasingly a tool used to shape economic outcomes, project state power and pursue strategic advantage. We've identified four interconnected trends, summarised below, to help understand the cyber challenge facing the UK today.
1. China is changing the scale of cyber competition
China's adversarial cyber activity represents the most sophisticated and sustained cyber challenge facing the UK.
China’s rapid development into a tech superpower is distinguished by its scale and its ‘whole-of-state’ approach, which sees it combine legislation, private sector contractors and technology development to achieve its goals.
Data sits at the centre of China’s approach, and in this AI era, data is more valuable than ever. China uses its advanced cyber capabilities to acquire large amounts of information from the UK and elsewhere. It trains models, improves capability and generates insight. China's ability to acquire, process and exploit vast quantities of information therefore has implications far beyond traditional espionage.
Its growing influence in global technology markets and standards further strengthens its ability to project cyber power internationally.
China Case Study: Use of compromised devices to conduct cyber espionage
In December 2025, the UK government sanctioned two technology companies based in China for their reckless and indiscriminate malicious cyber activity against the UK and its allies.
- Sichuan Anxun Information Technology co Ltd, known as i-Soon, targeted over 80 government and private industry IT systems across the world and supported others to carry out malicious cyber activity.
- Integrity Technology Group ran a covert network and provided technical assistance to enable further attacks. This company was also assessed by the FBI to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon.
In April 2026 the NCSC, alongside 15 international partners from across nine other countries, issued a joint advisory, highlighting how to defend against these attacker tactics which are believed to be used by the majority of China-linked actors to disguise malicious cyber activity.
2. Cyber operations have become a tool of state power
Cyber operations are increasingly being used alongside diplomacy, economic pressure, military power and information operations. Nation states use cyber capabilities to enable espionage and interference operations (such as hack and leak or transnational oppression), planning of lethal operations, acquisition of sensitive economic data, and operations to disrupt or destroy assets and services.
The growth of the commercial cyber intrusion marketplace has almost certainly lowered the barrier to entry for states to acquire commercial cyber intrusion capabilities (CCICs), enabling a broader range of actors to conduct sophisticated cyber operations.
During periods of heightened tension or crisis, the cyber threat to the UK can escalate rapidly and without warning. Cyber vulnerabilities can quickly cascade into loss of individual, business or government data and lead to societal harms. 
While the threat will change in line with intent, Russia currently represents the most audacious cyber threat to the UK. Elsewhere, Iran-linked groups continue to demonstrate how cyber operations can be used to create indiscriminate disruption at scale.
Russia Case Study: exploiting vulnerable routers to target critical national infrastructure
In July 2026 the NCSC, alongside 18 international partners from across 12 countries, issued a joint advisory, highlighting the methods of Federal Security Service (FSB) Centre 16 cyber actors. They were exploiting vulnerable routers and globally targeting networks belonging to critical national infrastructure (CNI).
On the same day, the UK government sanctioned 24 individuals and entities behind destructive cyber and hybrid operations including cyber criminals involved in proxy networks linked to the Russian Intelligence Services. The UK and EU member states formally attributed an attack on Poland’s energy grid on December 2025 to Russia’s FSB Centre 16. The attack, if it had been successful, could have caused 500,000 citizens to lose electricity.
3. Economic security depends on cyber security
Cyber threats are increasingly translating into real economic harm in the UK. Ransomware, data breaches and supply chain compromises disrupt business operations, halt production and impose significant recovery costs.
Cyber espionage is highly likely to be the most significant cyber threat to the UK's long-term economic growth. The financial consequences  accumulate through reduced innovation, diminished competitive advantage and lost commercial opportunities, with high-value, knowledge-intensive sectors increasingly attractive targets for cyber espionage. 
According to UK government research, malicious cyber activity costs UK organisations an estimated £14.7 billion every year. Put another way, cyber attacks are wiping out value equivalent to the size of the UK's cyber security sector annually.
Automotive Sector Case Study: Jaguar Land Rover cyber incident
The cyber attack that affected Jaguar Land Rover (JLR) in 2025 caused severe and prolonged disruption to its global production and retail activity, with significant impacts across the supply chain. As one of the UK's largest automotive manufacturers, the effects extended beyond JLR itself, impacting suppliers, retail operations and wider economic activity linked to the UK automotive sector.
Suppliers reliant on JLR's production schedules, orders and payment processes experienced operational challenges and workforce pressures as the effects of the incident were felt. JLR reported approximately £196 million in direct cyber-related costs. The attack had a direct impact on GDP, contributing to the UK economy expanding by only 0.1% in Q3 2025 (lower than originally forecast).
4. Technology advances are changing and increasing the threat
Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness. AI, automation and advances in computing power are already helping some threat actors identify vulnerabilities, target victims and operate more efficiently.
By 2028, it is highly likely China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals with the UK facing an increase in scale and speed of sophisticated cyber attacks.
It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.
In addition, increased reliance on space-based technologies will also expand the threat surface, providing more opportunities to adversaries over the next ten years.
Responding to these challenges
These four trends point to a clear challenge: the UK is operating in a more contested, competitive and technologically accelerated cyber environment. The answer is not to choose between today's threats and tomorrow's. We must address both. The vulnerabilities that attackers exploit today remain well understood, while new technologies are increasing the speed and scale at which they can be exploited. The challenge for the UK is therefore straightforward: strengthen resilience now while preparing for what comes next.
Defending Democracy Case Study: Targeting of election candidates and democratic institutions
Hostile states continue to target election candidates, elected officials and democratic institutions in attempts to gain access to sensitive political and government information. During the year, the NCSC observed persistent spear-phishing activity against high-risk individuals and increasing efforts to compromise messaging applications.
The NCSC responded by updating guidance relating to a Russia-linked threat actor known for spear-phishing campaigns and expanding its high-risk individuals guidance to include securing messaging applications. During a year that included local elections, Scottish Parliamentary and Senedd elections, by-elections and a transition to a new Prime Minister, the NCSC worked closely with the Joint Election Security Preparedness Unit, political parties and other democratic institutions to help strengthen the resilience of the UK's democratic processes.