NCC Group welcomes the publication of the NCSC Annual Review 2026, which marks the National Cyber Security Centre’s tenth anniversary and sets out a stark choice for the decade ahead: strengthen the UK’s cyber foundations now, or risk falling further behind as artificial intelligence accelerates the scale and speed of the threat.
The review warns that the cyber threat is increasing faster than defensive capability. Over the past year, the NCSC received 1,831 reports of cyber attacks, with 337 incidents requiring its support and 80 classed as nationally significant. It also notified 8,500 organisations of suspected compromises through its Early Warning service
As the NCSC enters its second decade, the message is clear: while AI is changing both sides of the cyber landscape, many of the vulnerabilities being exploited are not new. Known vulnerabilities, stolen credentials and social engineering remain common routes to compromise, reinforcing the importance of getting the fundamentals right.
In response, Guy Ellis, CEO at NCC Group, commented:
“NCSC’s Annual Review shows that in this AI era, organisations of any scale that have not kept up with cyber fundamentals are likely to be rapidly found out. Despite many of the methods and techniques being the same as they were ten years ago, as AI increases the speed and scale of both attack and defence, investment in cyber fundamentals has never mattered more. Our economy and public services depend on operational technology and critical infrastructure which is under persistent attack from a growing range of Ai enabled attackers and we need to do more to defend them as one.
“NCC Group has long argued for greater support to help SMEs strengthen their defences, so we welcome this renewed focus. As both a first-cohort Software Security Ambassador and Cyber Resilience Pledge signatory, we are committed to playing our part. Cyber resilience is an economic and competitiveness imperative, and it deserves sustained attention in every boardroom no matter what the size and sector of the organisation.”
Building resilience from the foundations up
The NCSC Annual Review 2026 reinforces that AI has not created many of the weaknesses organisations face, but is exposing existing technical debt and years of underinvestment in fundamental cyber security. At the same time, the NCSC sees AI as an opportunity to strengthen defence at scale, from identifying vulnerabilities more quickly to automating defensive action and accelerating recovery.
That is particularly important for the systems underpinning critical national infrastructure. Operational technology environments can combine legacy systems, long asset lifecycles and increasingly connected infrastructure, making strong foundations and proactive resilience essential. As AI becomes a force multiplier for attackers and defenders alike, organisations cannot afford to wait for an incident to force investment in those foundations.
Supporting stronger cyber resilience across the economy
The Government is also urging businesses to implement practical measures including Cyber Essentials and the NCSC’s Early Warning service as part of a wider effort to strengthen the UK’s cyber foundations.
NCC Group is committed to supporting that effort. As a first-cohort Software Security Ambassador and signatory to the Cyber Resilience Pledge, we believe industry has an important role to play in helping organisations of all sizes turn resilience from an ambition into action.
This is particularly important for SMEs, where access to expertise and resources can create barriers to improving cyber security. Strengthening the resilience of smaller organisations also helps strengthen the wider supply chains and ecosystems on which larger businesses and critical services depend.
A decade after the NCSC was established, the cyber landscape may look very different, but the fundamentals remain remarkably consistent: understand your exposure, address vulnerabilities, invest in resilience and prepare to recover.
The arrival of AI only makes acting on those fundamentals more urgent.
NCC Group remains committed to working with government, industry and wider society to strengthen the security and resilience of the UK’s digital economy.
