NCSC Annual Review 2026

It’s been another year of destructive cyber attacks, with the familiar story of state-sponsored espionage and cyber crime conducted at scale.

Russian hacking groups engage in offensive cyber operations in Ukraine, including disrupting power generation. Critical infrastructure and government institutions continue to be targeted by state actors, including a massive breach of government personnel records. Meanwhile, UK telecoms and health sectors are victims of high-profile ransomware attacks in pursuit of financial gain.

Except the year in question is not 2026. It’s 2015, and the incidents described above are - respectively - the Sandworm power grid attacks, the US Office of Personnel Management breach, the TalkTalk data breach and attacks on US hospitals by Russian-based ransomware groups. 

Those incidents from ten years ago tell us something important about the cyber threat. While technology has changed dramatically over the last decade, many of the weaknesses exploited by attackers remain remarkably familiar. The threat picture of the last ten years is therefore a story of both remarkable continuity and change. Understanding both is vital to give us a clearer view of the challenges ahead, and also warns us of the consequences of complacency.

There’s continuity in the actors we face and the tools they use. The most serious adversaries we face today are the same as they were a decade ago.

 

Their core tactics have evolved, but their success still relies extensively on the targeted exploitation of the scaled and known vulnerabilities across government, economy and society. The bulk of capability we have seen deployed in recent state-backed incidents is not an advanced, autonomous end-to-end AI attack, but a much simpler exploitation of common vulnerabilities and exposures (CVEs) and other open vulnerabilities, based on  decades of operational experience, patience and understanding of what works.

In other words, the same well-established attack techniques continue to deliver results for attackers. Our data from the incidents we handle supports this. 

But change is here as well. Autonomous end-to-end AI capability is coming into view. Threat actors are using and experimenting with AI across the full threat stack. We increasingly see the effects of automation in driving scale, efficiency and effectiveness, and the potential to outpace defences. What once required significant time, effort and expertise can increasingly be achieved faster, more cheaply and by a wider range of attackers.

At the same time, the ‘widening gap’ we highlighted in 2024 is growing. Organisations that modernise their technologies, address vulnerabilities and strengthen resilience are becoming more secure. Those that do not are finding it harder to keep pace with an evolving threat, as evidenced by recent attacks on programmable logic controllers (PLCs).  

These attacks come at a time when the number of adversaries, state and non-state, continue to grow. Driving all of these developments is a world that's far more confrontational than in 2015, and in which cyber capabilities are now an increasingly important component of national power. 

The lesson is clear. We must learn to live with both continuity and change. Both long-term relatively static threats and emergent new threats. We need to prepare now for the large-scale exploitation of vulnerabilities and weaknesses that attackers continue to target every day. At the same time, we must prepare for the impact AI will have on the speed, scale and effectiveness of cyber operations.

AI, decades in the making, represents both continuity and change. Today, in the hands of threat actors, it is helping to industrialise many of the cyber attacks we have lived with for the past decade, allowing them to identify vulnerabilities, target victims and operate more efficiently. Looking further ahead, AI has the potential to become a genuinely novel cyber capability, enabling new forms of attack and fundamentally changing cyber security.

The threat development of the last decade reinforces a lesson from history; the more things change, the more they stay the same. If we have lived with broadly similar cyber attacks for the last decade, then we can say that our resilience has not yet been overwhelmed. We cannot spend our time obsessing about the latest AI-driven threat, but equally we can no longer remain complacent.

History shows us a way forward. The partnerships, interventions and innovations of the last decade have shown that progress is possible. The future will depend on whether we can scale those efforts quickly enough to keep pace with a changing threat.