NCSC Annual Review 2026: AI Is Making Old Attacks Faster

The numbers

The UK's National Cyber Security Centre (NCSC) has published its Annual Review for 2026. Three figures stand out:

• 1,831 cyber attacks were reported to the NCSC in a year.
• 80 of them were classed as nationally significant.
• £14.7bn is the estimated yearly cost of cyber attacks to UK organisations.

What the review says about AI

AI is the headline, but the detail matters more. The NCSC says attackers have started using AI tools, and it is also clear about the limits of what it saw: "None of the observed uses of AI enabled a novel class of attack."

AI isn't opening new doors. It's getting to the open ones faster.

Where the damage still comes from

According to the review, most harm still arrives through familiar gaps:

• Unpatched internet-facing systems. Known vulnerabilities in systems exposed to the internet were routinely exploited. In many cases a patch was already available and had not been applied in time.
• Stolen credentials. Attackers logged in with passwords they had stolen. The NCSC recommends passkeys as a stronger alternative.
• Social engineering. People were tricked into giving access away.

What to do about it

1. Know what you expose. List every system that can be reached from the internet, and remove anything that doesn't need to be there.
2. Patch those systems first. When a security update is released, internet-facing systems go to the front of the queue.
3. Strengthen sign-in. Turn on multi-factor authentication everywhere, starting with administrator accounts, and move to passkeys where your systems support them.
4. Join the NCSC's Early Warning service. It flagged suspected compromises to around 8,500 organisations last year, and it costs nothing to join.

How we can help

Our engineers can review what your business exposes to the internet and help you close the gaps.

Want an engineer to take a look? Talk to us.

Source: NCSC Annual Review 2026.