Estimated reading time: 7 minutes
The NCSC, part of GCHQ, opened 10 years ago. Its 2026 Annual Review, “The state of the cyber nation,” opens with a warning from CEO Richard Horne. “The UK’s cyber resilience is not yet where it should be,” he writes. The threat has grown faster than defenses, he says.
Horne puts AI at the center of the review. He doesn’t treat it as the cause. “AI did not create these cyber security weaknesses; it revealed them,” he writes. AI exposed “years of technical debt” and the failure to put basic protections in place, he says.
The Four Ways Into Large UK Organizations
The NCSC’s incident data shows how little has changed. At large organizations, 88% of incidents came through four initial access routes:
- exploiting public-facing applications
- phishing
- misusing valid accounts
- exploiting external remote services
“The most serious adversaries we face today are the same as they were a decade ago,” the review says. Most capability in recent state-backed incidents was “not an advanced, autonomous end-to-end AI attack,” it says. It was the exploitation of known vulnerabilities.
The review’s seventh lesson makes the same point: “Sophisticated actors don’t have to be sophisticated to gain access.”
Those four routes line up with the controls cyber insurers already ask about. Patching internet-facing systems addresses the first. Multi-factor authentication addresses phishing and account misuse, though CINI reported that insurers now need to ask which kind. The NCSC now recommends passkeys in place of passwords.
The pattern matches CINI’s recent reporting. An AI-built ransomware crew still got in with stolen passwords. Travelers’ Lauren Winchester said attackers haven’t needed AI to get in.
What AI Changes, According To The NCSC
AI’s main effect is speed and scale, the NCSC judges. Its greatest impact will be “the acceleration and scaling of existing tactics,” not new attack routes. The NCSC’s incident team has seen attackers use AI tools. None of those uses enabled a new class of attack, the review says.
The forward judgments are sharper. The NCSC looks ahead to 2028. It says it is “highly likely AI malware will be used in a ransomware attack on UK CNI.” China is best placed to use AI against critical national infrastructure, it says. The review also warns of a widening divide between organizations that can use AI for defense and those that can’t.
It tells organizations to prepare for a “patch wave.” AI is finding vulnerabilities faster. A rush of security updates is coming. The NCSC expects some to be critical. CINI covered how the UK’s AI Security Institute tested a frontier model’s agentic behavior.
Fewer Nationally Significant Incidents, With A Caveat
The NCSC’s incident team received 1,831 reports this year. Of those, 337 needed its support. Eighty were classed as nationally significant. The team also warned 8,500 organizations of suspected compromises through its Early Warning service.
Last year’s review counted 429 incidents handled and a record 204 nationally significant ones, up from 89 the year before. On those figures, the most serious category fell about 60%.
The review doesn’t comment on the fall. It cautions that incident reporting “does not follow a simple year-on-year trend.” Past peaks have often tracked a small number of very significant incidents, it says. Early Warning alerts are “likely to have headed off a number of incidents,” it adds.
CINI has asked the NCSC what drove the change and whether the two years are measured the same way. A reply is awaited.
Jaguar Land Rover: The Cost Of One Attack
The NCSC’s case study on Jaguar Land Rover shows what one incident can do. JLR reported about £196 million in direct cyber-related costs, the review says. The attack contributed to UK growth of just 0.1% in the third quarter of 2025.
The damage reached JLR’s suppliers too. The Cyber Monitoring Centre estimated the attack cost the UK £1.9 billion, as CINI reported. On the CINI podcast, Cyber Tzar’s Andrew Horkan described a hauler that lost £390,000 in the first month. CDL Cyber Intelligence’s episode also took up JLR and the uninsured.
The review doesn’t say whether JLR was insured. Reuters reported that JLR had been negotiating cyber cover through Lockton but hadn’t finalized it, Insurance Business reported.
Malicious cyber activity costs UK organizations an estimated £14.7 billion a year, the review says. It cites government research. The retail attacks of 2025 left their own mark. Most UK retailers hit by cyber disruption told Marsh they overspend on cyber.
Cyber Essentials And The Insurance Link
The government’s answer for most organizations is Cyber Essentials, the NCSC-backed baseline of five technical controls. Certifications reached 47,661 in the year to August 2026, up 19.6%. Cyber Essentials Plus certifications rose 21.5% to 15,646. In 2017, the scheme issued 6,037 certificates.
Security minister Dan Jarvis is blunt in his foreword. “Implement Cyber Essentials. Sign up to the Cyber Resilience Pledge,” he writes. The pledge includes a commitment to roll Cyber Essentials out across supply chains.
The 84-page review doesn’t mention insurance. Cyber Essentials does carry cover, though. UK organizations with turnover under £20 million can get cyber liability insurance with it. They must certify their whole organization, the NCSC’s Cyber Essentials page says. IASME arranges the cover.
That matters because take-up is low. Only about 8% to 10% of small businesses in the UK and Europe buy cover. Munich Re’s Helga Munger gave that estimate at a Zywave panel last week.
Regulation, Boards And The Quantum Deadline
The Cyber Security and Resilience Bill will bring “a more comprehensive, flexible and enforceable regulatory framework,” the review says. New sectors come into scope. The NCSC has also published a minimum resilience benchmark for essential services, the CAF Core Profile.
Boards get their own section. The NCSC calls AI a likely “net positive” for cybersecurity. Getting there “requires urgent action now and board-level engagement,” it says.
The review also sets out a post-quantum timeline. The NCSC recommends discovery and migration planning by 2028 and priority migration by 2031. It wants migration to post-quantum cryptography finished by 2035. IBM’s John Buselli told the Zywave conference the work starts with a cryptographic inventory.
What The NCSC Wants From Organizations
The tools to protect the UK “already exist,” Horne writes. The challenge is putting them in place at scale.
He ends his foreword on responsibility, not attackers. The biggest challenge of the next decade, he writes, “requires us to look not at our attackers, but at ourselves.”
FAQ – NCSC Annual Review
What does the NCSC Annual Review 2026 say?
The UK’s cyber resilience is not yet where it should be, the NCSC says. The threat has grown faster than defenses. AI exposed weaknesses rather than creating them.
How do attackers get into large UK organizations?
The NCSC says 88% of incidents at large organizations came through four routes: public-facing applications, phishing, misused valid accounts and remote services.
How many nationally significant incidents did the NCSC handle?
Eighty this year, down from a record 204 last year. The NCSC cautions that incident counts don’t follow a simple year-on-year trend.
What did the Jaguar Land Rover attack cost?
JLR reported about £196 million in direct costs, the NCSC says. The Cyber Monitoring Centre estimated the cost to the UK at £1.9 billion.
Does Cyber Essentials include cyber insurance?
Yes, for UK organizations with turnover under £20 million that certify their whole organization. The cover is arranged by IASME, the NCSC says.
What is the NCSC’s post-quantum timeline?
Discovery and migration planning by 2028, priority migration by 2031 and full migration to post-quantum cryptography by 2035.
Related Cyber Insurance Posts
- Ransomware Crews Haven’t Needed AI To Get In. The Old Ways Still Work, Travelers’ Lauren Winchester Says.
- UK Cyber Insurance Industry Unites to Combat Ransom Payments(Opens in a new browser tab)
- Jaguar’s New Tagline is “Copy Nothing,” but its Cyber Insurance Disaster Suggests “Penny Wise, Pound Foolish” Might be More Apt(Opens in a new browser tab)
- Critical National Infrastructure Cyber Insurance: The NCSC Warning(Opens in a new browser tab)
- Open Source Supply Chain Risk Tests Cyber Insurers(Opens in a new browser tab)