The NCSC’s tenth annual review warns that AI will turn years of neglected technology into a wave of incidents, with AI-powered ransomware highly likely to hit UK critical infrastructure by 2028. Its message for boards and compliance teams is blunt: certificates and policies are no longer evidence of resilience.
What happened
On Tuesday 3 November 2026 the National Cyber Security Centre published its Annual Review 2026, branded the State of the Cyber Nation report, covering the twelve months from 1 September 2025 to 31 August 2026. The headline judgement is that hostile use of AI is “highly likely” to make ransomware, social engineering and vulnerability exploitation faster and larger in scale over the next two years, and that AI-powered malware is highly likely to have featured in a ransomware attack on the UK’s critical national infrastructure by 2028.
In prepared launch remarks, NCSC chief executive Dr Richard Horne says the country had “collectively got away with doing tech on the cheap” for decades. His argument is not that AI has created a new class of attack. It is that weaknesses organisations have tolerated for years can now be found and abused at a speed and volume defenders have not faced before, and he expects incident numbers to climb sharply over the coming months.
The incident figures give that warning some weight. The NCSC’s incident management team received 1,831 reports of attacks during the year, 337 of which needed hands-on support, and 80 of those were classed as nationally significant. Its Early Warning service separately alerted 8,500 organisations to signs of a suspected compromise.
The detail
Read as a governance document, the review argues throughout against treating compliance as the finish line. It says organisations with ageing estates, poor asset visibility and slow remediation will struggle as frontier AI makes flaws cheaper to find.
The Cyber Security and Resilience Bill features prominently. The NCSC describes it as a more enforceable framework that brings new sectors into scope and adds national security powers for crises, but it is careful to say regulation will not deliver the outcome by itself. Boards and executive teams, the review says, should want proof of measurable improvement in preparedness and recovery, not just confirmation that policies exist.
Several assurance mechanisms underpin that position:
- A resilience pathway that treats the Cyber Action Toolkit, then Cyber Essentials, then the Cyber Assessment Framework (CAF) as successive maturity stages.
- The CAF Core Profile, now the NCSC’s recommended minimum benchmark for essential services and other critical organisations.
- The Cyber Resilience Audit Scheme, which lets approved third parties audit organisations against the CAF, aimed mainly at regulated operators.
- Cyber Essentials Pathways, an alternative route to Cyber Essentials Plus for large organisations whose architecture does not fit the prescriptive controls, provided they can show equivalent or better protection.
The review also notes that the CHECK scheme delivered around 3,000 tests to over 680 organisations in the year, alongside a forthcoming Cyber Adversary Simulation scheme. Horne’s own framing of Cyber Essentials is telling: it should be where security starts, not where it ends, with further controls scaled to an organisation’s size, complexity and risk.
On the threat side, the incident data is familiar. Most successful compromises relied on known flaws in internet-facing systems, stolen credentials and social engineering. The NCSC also says that where it saw attackers using AI tools, none of it amounted to a new category of attack.
Why it matters for UK organisations
For any organisation expecting to fall under the Cyber Security and Resilience Bill, the review is a preview of how regulators are likely to judge them. The language of independent audit, CAF benchmarks and demonstrable outcomes points to supervision that asks for evidence, not self-declaration.
For everyone else the significance is the “patch wave” the NCSC asks organisations to prepare for: a surge of security updates as AI-assisted research drags old defects into the open. Organisations that patch monthly at best, or that cannot say what they have exposed to the internet, are the ones the review is describing. Horne also put the accountability squarely on leaders, saying they risk having to explain to investors, staff and customers why services failed.
Public sector readers get a benchmark too. Under the Government Cyber Action Plan, the median time to fix domain-related vulnerabilities across government fell from 50 days to eight. That is a useful figure for any board comfortable with month-long remediation. The funding announced the week before the report, including a £70 million National Exposure and Real-Time Vulnerability Centre and the previously reported Cyber Shield, is about national capability; it does not reduce any individual organisation’s own obligations.
Expert view
I have spent a long time writing reports that list the same findings year after year: unsupported operating systems, management interfaces facing the internet, shared admin accounts, patches deferred for “business reasons”. None of that is new. What the NCSC is saying, correctly in my view, is that the cost of leaving those findings open has changed. When automated tooling can sweep for and weaponise old flaws at scale, the time between a weakness existing and a weakness being used shrinks towards zero.
The governance point is the one I would underline. In my experience, organisations often treat a Cyber Essentials certificate or an ISO audit as the outcome, rather than as a snapshot taken on one day. The review’s insistence on measurable improvement and independent testing is a direct challenge to that culture. A board that receives a green dashboard of policy compliance but no data on time to patch, exposed services or recovery testing is not governing cyber risk; it is being reassured.
Nor should the AI forecast be read as a reason to buy AI products. The NCSC’s own data shows attackers still walking through the old doors, and closing them is cheaper than any new platform.
What to do now
- Measure remediation speed. Report median time to patch internet-facing systems to the board, and set a target. Cyber Essentials already sets tight deadlines for critical updates; treat them as a ceiling, not a target.
- Shrink the attack surface. Inventory everything reachable from the internet and remove what does not need to be there, in line with the Cyber Essentials firewalls and secure configuration controls.
- Plan for the patch wave. Pre-agree emergency change processes, test rollback, and ask key suppliers how quickly they can deploy updates.
- Fix credentials. Enforce MFA everywhere it is available and begin moving staff and administrators to passkeys, supporting the user access control requirements.
- Benchmark against the CAF. If you expect to be regulated under the Bill, assess yourself against the CAF Core Profile now and consider independent audit.
- Change what the board sees. Use the Cyber Governance Code of Practice to replace policy attestations with outcome measures: exposure, patch latency, tested recovery times.
Bottom line
The NCSC has stopped asking politely. Its annual review says the bill for decades of cheap, under-maintained technology is about to arrive, and that regulation and certification will not pay it on anyone’s behalf. Organisations that can prove, with numbers, that they find and fix weaknesses quickly will be in a defensible position. Those relying on last year’s certificate will not.
Sources
- NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
- NCSC: Annual Review 2026, A moment of choice
- NCSC: Annual Review 2026, Incident management
- The Record: UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief
- The Independent (via Yahoo News): Hackers ‘highly likely’ to use AI-powered malware to target UK infrastructure by 2028, report warns
