NCSC Annual Review 2026

The NCSC Incident Management Team (IM) responds to cyber incidents affecting UK organisations. It plays a central role in triaging reports, supporting affected organisations, and coordinating NCSC and cross-government responses to nationally significant incidents, helping to ensure that the risks they pose to the UK are managed effectively.

Rapid notification via automated systems of early stages of attacks helps organisations deal with minor incidents before they can grow into ones that require NCSC support.

It is important to note that incident reporting does not follow a simple year-on-year trend. There is never a flat trend in incident activity, and peaks in previous years have often been associated with a small number of particularly significant incidents. Equally, the impact of proactive measures should not be overlooked. The scale of notifications generated by the Early Warning service is likely to have headed off a number of incidents before they developed into events requiring NCSC intervention.

These figures do not tell the whole story: the scale and complexity of incident response vary greatly. Several high-profile incidents during the year required support from across the NCSC, including invaluable assistance from the Legal and Media teams.

Most successful compromises still rely on familiar methods. Threat actors routinely exploited known vulnerabilities in internet-facing systems, used stolen credentials, and employed social engineering to gain access to networks. Fundamental security measures therefore remain critical to organisational resilience, including wider adoption of passkeys in place of passwords to reduce the risks associated with stolen credentials.

The year included a number of incidents assessed as having links to state or state-aligned actors. Although their objectives often differ from those of cyber criminals, many target vulnerabilities in internet-facing systems. While some cases involved exploitation of previously unknown vulnerabilities, many involve vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion.

The IM team has also begun to see threat actors incorporating AI tools into their attacks. None of the observed uses of AI enabled a novel class of attack, reinforcing the importance of consistently applying established security controls.

The cyber threat to the UK's Critical National Infrastructure (CNI) also remains enduring. The NCSC continued to observe activity affecting CNI and its supporting ecosystem, including activity believed to be linked to nation states. Such activity may be intended to gather intelligence, gain access to sensitive networks, or establish a foothold in systems of strategic interest.

Potentially increasing exploitation of vulnerabilities affecting internet-facing systems within CNI environments reinforces a familiar lesson from incident response activity: even sophisticated adversaries frequently gain initial access through known and often preventable weaknesses. This underlines the importance of maintaining strong cyber resilience across the UK's essential services.

The incidents handled by the NCSC this year reinforce a clear message: the cyber threat to the UK remains significant, with most successful attacks still exploiting familiar weaknesses. Strong cyber hygiene, informed and vigilant staff, effective monitoring and incident response, and resilient supply chains remain among the most effective ways to reduce cyber risk and limit the impact of incidents.