Networks
Future ready, intelligent networks for critical environments.
What the NCSC’s 2026 Annual Review means for UK organisations
What the NCSC’s 2026 Annual Review means for UK organisations
5:46
A security weakness can remain unresolved for months without visibly affecting a business. That can make postponing the fix feel reasonable, particularly when budgets are stretched or systems are difficult to update.
The National Cyber Security Centre’s Annual Review 2026 challenges that approach. Attackers continue to exploit familiar weaknesses, while artificial intelligence increases the speed and scale at which they can act.For UK organisations, this raises a leadership issue: whether technology decisions are reducing exposure or allowing it to accumulate.
Familiar weaknesses carry significant consequences
-
Exploitation of public-facing applications
-
Phishing
-
Misuse of valid accounts
-
Exploitation of external remote services
These findings challenge the assumption that sophisticated attackers always need sophisticated methods. Organisations can make meaningful improvements by addressing weaknesses they already understand.
During the reporting year, the NCSC received 1,831 reports of cyber-attacks. Following triage, 337 incidents required its support, including 80 classified as nationally significant.
The management challenge is sustaining attention between incidents. Routine maintenance can struggle to compete with projects promising immediate commercial returns, even when delaying it puts those investments at risk.
Ongoing managed IT support helps organisations maintain that attention, keeping systems supported and addressing issues before they disrupt operations.
AI makes delays more consequential
The NCSC assesses that AI’s greatest immediate impact will be accelerating existing attack techniques. Vulnerabilities that once required considerable effort to discover may become easier to exploit.
A remediation process considered acceptable when attackers moved more slowly may now leave an organisation exposed for too long.
The report describes a government programme that reduced the median time to fix domain-related vulnerabilities from 50 days to eight days. This demonstrates the scope for improvement when remediation receives focused attention.
For leaders, the useful measure is how quickly a significant finding becomes a completed fix. A report provides limited reassurance if the same issues remain unresolved at the next review.
Our Head of Customer Experience, Nathan Charles, explores AI’s implications for attack and defence in The double-edged sword of AI in cybersecurity.
Cyber Essentials should shape everyday operations
The NCSC recommends Cyber Essentials as the minimum cybersecurity standard for UK organisations of all sizes.
Between September 2025 and August 2026, 47,661 Cyber Essentials certifications were awarded, up 19.6%. Cyber Essentials Plus certifications reached 15,646, an increase of 21.5%.
The scheme provides a common foundation, but its lasting value depends on maintaining the controls after assessment. New technology and changing access requirements can introduce exposure over time.
OryxAlign’s Cyber Advisor support helps smaller organisations understand the requirements and address gaps, establishing practices they can maintain as their business develops.
Resilience extends beyond your own systems
The report highlights the 2025 Jaguar Land Rover attack, which disrupted production and affected businesses across its supply chain. JLR reported approximately £196 million in direct cyber-related costs.
An organisation’s ability to operate can depend on security decisions made elsewhere. Supplier assurance should therefore reflect operational dependence, including how responsibilities would be shared during recovery.
This becomes particularly significant where connected systems support physical operations, where supplier access and maintenance arrangements can directly affect a building’s continuity.
Our Senior Technology Consultant, Peter Schwartz, examines these dependencies in Managing cyber-physical risk in smart buildings, including the importance of clear ownership across connected environments.
Recovery plans need evidence behind them
The NCSC identifies preparation as a factor that determines incident outcomes. Its recovery guidance covers the immediate response through to rebuilding normal operations.
For boards, confidence in a plan needs to come from testing it. Recovery processes may depend on systems that would be unavailable during an attack or assume colleagues can communicate through their usual channels.
Exercises expose those dependencies. Restoration testing provides evidence that backups can support recovery, while rehearsals help teams understand how decisions would be made under pressure.
Give leaders a clearer view of progress
The report supports a more demanding approach to cyber reporting, showing that leaders need evidence that exposure is falling and recovery capability is improving. Reviewing how long critical vulnerabilities remain open provides one measure. Findings from recovery exercises can reveal where further investment or decisions are needed.
OryxAlign connects technical findings with operational consequences, helping organisations focus on weaknesses that could affect their people and services.
Speak to our cybersecurity team below about reviewing your organisation’s exposure and identifying practical priorities.