The National Cyber Security Centre’s 2026 Annual Review - The State of the Cyber Nation, paints a challenging picture for UK businesses. AI is accelerating attacks, ransomware remains disruptive and supply chain risk continues to grow. But the biggest takeaway isn’t a new threat. It’s how quickly existing security gaps can now be exploited.
The bigger question is what businesses do about it.
While the threats are evolving, many successful attacks still start with familiar weaknesses: unpatched systems, compromised accounts, phishing and exposed services.
AI raises the stakes by increasing the speed and scale at which some of those weaknesses can be identified and exploited. That puts greater pressure on businesses to understand where they're exposed, strengthen the fundamentals and make sure they can recover when something goes wrong.
“AI did not create these cyber security weaknesses; it revealed them. It exposed years of technical debt and the failure to implement even basic cyber protections, with technology and security investments too often deferred.”
Richard Horne, CEO, NCSC - foreword, NCSC Annual Review 2026
AI features heavily in the NCSC’s assessment of what's coming next.
The NCSC expects AI to increase the speed, scale and efficiency of cyber attacks, including helping attackers discover and exploit vulnerabilities faster.
That changes the question businesses need to ask.
Rather than
“How do we defend against an AI attack?”
ask
“Can our existing security processes operate quickly enough in an AI-enabled threat landscape?”
Patching is a good example. If vulnerabilities can be identified and exploited faster, taking weeks to deploy a critical update becomes a bigger problem.
The NCSC is already warning organisations to prepare for a potential patch wave, where an increase in discovered vulnerabilities creates more updates that need to be deployed quickly and at scale.
What should businesses do?
Review how quickly you can identify, prioritise and remediate vulnerabilities, particularly across ageing or difficult-to-update technology.
For all the attention given to increasingly sophisticated attacks, attackers are still getting through using familiar routes.
This is significant because these aren't unknown security problems.
AI can help an attacker find vulnerabilities faster or create more convincing phishing attempts, but businesses still need to get the fundamentals right.
That means prioritising:
The five technical controls within Cyber Essentials provide a useful baseline for assessing these foundations. The NCSC makes the same point itself. Its review puts the five Cyber Essentials controls at the centre of what protects organisations against the most common attacks, and reports that Cyber Essentials certifications are up almost 20% on last year.
What should businesses do?
Before adding another security product, establish whether the controls you already rely on are working consistently across your environment.
Alongside the review, the government opened the Cyber Essentials First Step Fund on 3 November. Eligible UK micro, small and medium-sized businesses that have not held the certification in the past four years can claim a 75% discount on a new Cyber Essentials certificate, applying through IASME.
The fund is £2.4m, allocated first come, first served, and runs until the end of March 2027 or until the money runs out, whichever comes first. It covers Cyber Essentials only, not Cyber Essentials Plus. Availability isn’t published, so check before you plan around it.
Cyber security isn't only about stopping an attack. It's about what happens to the business if one succeeds.
The NCSC estimates malicious cyber activity costs UK organisations £14.7 billion each year. Its report also points to the 2025 cyber attack on Jaguar Land Rover, which resulted in approximately £196 million in direct cyber-related costs as well as disruption across suppliers and other operations.
The question for leadership teams shouldn't simply be
“Are we secure?”
It should be:
“If something gets through, can we keep operating and how quickly can we recover?”
What should businesses do?
Test your recovery capability. Can critical data actually be restored? Does everyone understand their role during an incident? Which systems need recovering first? When was your response plan last exercised?
Having backups and an incident response plan matters. Knowing they work matters more.
Few organisations operate or secure their technology environment entirely on their own.
Technology partners can strengthen a business's capability, security and resilience. But relying on external organisations also means understanding those relationships properly. The NCSC highlights increasing reliance on suppliers and service providers for critical functions, meaning a compromise elsewhere in the supply chain can create risk for your organisation too.
What should businesses do?
Map your critical dependencies and ask more of your technology partners. A good partner should be able to explain how they're protecting your environment, what they are responsible for and where your responsibilities begin.
Cyber resilience cannot sit solely with IT. Boards and leadership teams need enough visibility to understand where the business is exposed and whether improvements are actually reducing that exposure.
What should businesses do?
Give leadership a clear view of cyber resilience, not simply security activity. That means understanding your exposure, priorities, dependencies and ability to recover.
A cyber security review should look across your wider technology environment and answer five questions:
And not every finding should result in buying something new.
Sometimes the answer is configuring your existing technology properly. Sometimes it's improving a process. Sometimes ageing technology needs replacing. And sometimes there is a genuine security gap that needs investment.
We can work with you to assess your current environment, identify where your biggest exposures sit and turn those findings into a practical roadmap based on your technology, risks and business priorities.
Because if there's one message worth taking from the State of the Cyber Nation, it's this:
AI is changing the speed of cyber security more than it is changing the fundamentals.
The businesses best prepared for what comes next will be the ones that understand where they're exposed, get the fundamentals right and know they can recover when something goes wrong.
Don't start with another security product. Start by understanding where you stand.