The NCSC has just published its 2026 Annual Review, marking ten years since it opened its doors. I've read the whole thing so you don't have to. It's 84 pages, and a good chunk of it is the usual catalogue of services, statistics and programme names. But underneath that is a document that is unusually candid for a government body.
Richard Horne's foreword sets the tone. The UK's cyber resilience, he writes, 'is not yet where it should be'. The threat has grown faster than our defences. And then the line that I think is the most important in the whole review: 'The biggest cyber security challenge of the next decade requires us to look not at our attackers, but at ourselves.'
I spent a good part of my career on the attacker side of that sentence, so I read it with some interest. Here are the five things I took from the review, and what I think they mean for anyone running an organisation in the UK right now.
1. AI didn't create our weaknesses. It revealed them.
The review opens its threat section with a trick. It describes a year of power grid attacks, a massive breach of government personnel records, a UK telecoms ransomware incident and attacks on hospitals. Then it tells you the year was 2015. Sandworm, OPM, TalkTalk. The point lands: the technology has changed beyond recognition, but the weaknesses attackers exploit have barely moved.
The incident data backs that up. For large organisations, 88% of the incidents the NCSC handled came from just four initial access routes: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services. None of those is new. None of them needs AI.
And on AI specifically, the NCSC's incident team is blunt; they have started to see attackers using AI tools, but 'none of the observed uses of AI enabled a novel class of attack'. The bulk of what has been deployed in recent state-backed incidents is not some autonomous end-to-end AI operation. It is 'a much simpler exploitation of common vulnerabilities and exposures'. The NCSC's central judgement is that AI's greatest impact will be 'the acceleration and scaling of existing tactics, techniques and procedures as opposed to generating new attack vectors'. This matches our thinking here at Nova Blue.
So the honest reading is this. AI is making attacks cheaper, faster and more scalable. It is industrialising the same old tradecraft. What it is exposing, in Horne's words, is 'years of technical debt and the failure to implement even basic cyber protections'. To be clear: this is not a technology problem; it is a decision problem, and the discretion sits with us.
2. The widening gap has become a digital divide
Two years ago the NCSC talked about a 'widening gap' between organisations that keep pace with the threat and those that don't. This year it has hardened into a formal assessment. The NCSC says it is 'almost certain a widening digital divide will emerge between organisations able to adopt AI for defence and those unable to adapt'.
What I find more striking and consequential is the second half of that judgement: the organisations on the wrong side of the divide don't just fall behind; they become more attractive targets. In the NCSC's words, 'the latter becoming increasingly attractive targets for both state and criminal actors'. If AI makes it cheaper to find and exploit a weak organisation, then the economics of attacking weak organisations improve, and financially-motivated attackers will always follow the economics.
The review adds a quieter point in the same section that I think many leaders are underestimating. It assesses it 'highly likely' that shadow AI, meaning staff using unsanctioned AI tools, often on personal devices, will leave organisations open to exploitation. The obvious risk is sensitive data walking out of the door with no visibility of where it goes. The less obvious risk is that organisations 'lose sight of their workforce's competency in cyber security if the tasks are frequently outsourced to shadow AI'. You cannot defend what you cannot see.
The divide is not about budget alone. Plenty of well-funded organisations are on the wrong side of it. It is about whether you have a technology estate you actually know, can patch, and can change at the speed the threat now demands.
3. Prepare now for the patch wave
This is the most practical point in the review and the one I've seen least discussed. The NCSC is telling every organisation, in plain terms, to get ready for a 'patch wave': 'a rush of software updates that will need to be applied across the technology stack to address the disclosure of new vulnerabilities'. It expects 'an influx of updates to address vulnerabilities across all severities' and expects 'a number to be critical'.
The reason is that AI-assisted vulnerability discovery is no longer theoretical. The NCSC assesses that AI models 'have become capable of detecting vulnerabilities in large codebases and misconfigurations in systems that have historically remained undetected'. The review's own evidence is Project DROMOS, where government teams pointed frontier AI models at their code repositories and 'uncovered hundreds of potential security issues, including critical vulnerabilities'. If government can do that to its own code, assume others are doing it to the software you run.
The consequence is a digital "arms race". The NCSC puts it as 'highly likely defenders and maintainers of systems will face a race to shorten patch deployment timelines' before attackers can build working exploits. The review is honest that the old model is finished: 'an approach based on discovering and manually patching every flaw cannot keep pace with machine-speed vulnerability discovery'.
There is proof in the same document that the race can be run. Through the Government Cyber Action Plan, the median time to fix domain-related vulnerabilities across government fell from 50 days to 8. That is not a technology miracle. It is ownership, visibility and a process that runs on a cadence instead of a crisis.
If you want a date to plan against, the review offers one. The NCSC judges it highly likely that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure before 2028, and that by 2028 China, Russia and other states will routinely use AI in cyber operations against the UK.
The key advice I have here is that building security in at design time, having security assurance throughout the entire development lifecycle, and continuous security execution post-launch is more critical now than it ever has been.
4. Cyber risk is now economic risk, and that puts it on the board's desk
The review quotes UK government research putting the cost of malicious cyber activity to UK organisations at an estimated £14.7 billion a year. It then makes the comparison itself: that is value 'equivalent to the size of the UK's cyber security sector annually'. We are losing roughly as much as the entire defensive industry earns.
The Jaguar Land Rover case study makes it concrete. JLR reported approximately £196 million in direct cyber-related costs. Suppliers who depend on its production schedules felt the disruption too. And the review states the attack 'had a direct impact on GDP, contributing to the UK economy expanding by only 0.1% in Q3 2025'. One incident at one company moved the national growth figure.
The Cyber Security and Resilience Bill will bring new sectors into scope and add national security powers. The NCSC has published the CAF Core Profile as a recommended minimum benchmark for essential services. Defence Cyber Certification has replaced supplier self-attestation with independent assurance across the defence supply chain. And the new Supplier Check Tool has already handled more than 1.5 million searches by organisations checking whether their suppliers hold Cyber Essentials. Expect to be asked.
For boards, the review's own words are the ones to remember. Organisations must 'manage cyber security as a business risk rather than solely a technical issue', and boards 'should seek assurance not only that policies exist, but that they can demonstrate measurable improvements in preparedness, recovery capability and resilience outcomes'. To state it bluntly: a policy on a shelf is not evidence. A rehearsed recovery plan and a patch cadence you can clearly demonstrate are.
5. Defence is going continuous and agentic
The final section of the review describes a shift in how defence itself works: 'from periodic, human-led activity towards continuous, machine-assisted defence operating at national scale'. Vulnerability management stops being a quarterly scan and becomes a connected pathway of discovery, prioritisation, remediation and verification. Security operations move beyond presenting alerts to analysts, with agents investigating, correlating evidence and, in some cases, taking reversible action. This is not some mythical future-state; right now all of our MIDAS and AEGIS packages come with agentic-assisted configuration drift management.
The programmes behind this are real and funded. Cyber Shield is a five-year joint programme between the NCSC and DCMS to build a national agentic cyber defence ecosystem, with the NCSC providing the platform and data and the market building the agents. The National Detect Strategy sets outcomes for 2030. And the simplest service in the list, Early Warning, saw sign-ups rise 52% to nearly 20,000 organisations this year.
The part of this section I'd underline is the one about advantage. The NCSC argues that 'the structural advantage will remain with defenders; they own or operate the environment, can instrument it, can change it and can define acceptable behaviour'. That is true, and it is the thing attackers have always envied. But the review immediately qualifies it: 'this advantage is not a given, and realising it requires clear direction, investment and disciplined adoption'.
The NCSC is also careful about what it asks of automation. Initial capability will focus on detection and blocking, which research suggests are 'more amenable to automation' than autonomous remediation. Defenders need confidence that automated actions 'will be safe, predictable and proportionate'. That caution is right, and it applies to any organisation adopting AI in its security operations. Start where the blast radius of a mistake is small.
The review closes this section with a call to action for industry: 'integrate agents, share insights, help shape emerging standards'. Having spent years on the other side of the fence, I'd put it more simply. For the first time in a long while, the tools favour the people who own the ground. The question is whether we use them.
What I'd do with this
If I were reading this review as a CEO rather than a security person, I'd take three actions from it, and none of them is buying a new product.
First, find out whether anyone in your organisation can tell you, today, how long it takes to deploy a critical patch across everything you run, including the things your suppliers run for you. If the answer is a shrug, that is your first project. The patch wave will not wait for you to build the process.
Second, ask your board what evidence it has seen, not what policies it has approved. The NCSC's test is measurable improvement in preparedness and recovery. If the last board paper on cyber was a RAG status, that is not evidence.
Third, decide which side of the divide you intend to be on, and recognise that it is a decision. Most of the organisations on the wrong side did not choose it. They deferred, and their adversaries chose for them.
The review's own summary of what works has not changed in ten years: know what technology you rely on, keep it updated, control access to important accounts, back up what matters, and prepare for incidents. The NCSC's line is that 'the challenge is no longer understanding what good cyber security looks like. It is putting it into practice, consistently, at scale and at the speed the threat now demands.' That is the whole job. It is also, not coincidentally, what we spend our days doing at Nova Blue.
Source: all quotations and figures are from the NCSC Annual Review 2026, 'The State of the Cyber Nation' (Crown copyright 2026, Open Government Licence). The £14.7 billion figure is attributed in the review to UK government research; the JLR figures are as reported in the review.