Cyber attacks keep landing, and the NCSC’s 2026 Annual Review makes a blunt observation.
At large organisations, 88% of incidents still arrive through four initial access routes: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting remote services.
Those are the same class of weaknesses that have been around for over a decade: TalkTalk’s SQL injection on a public-facing application among them – and the review itself sets them beside Sandworm and the 2015 hospital ransomware wave.
AI did not cause this. The problem was already there.
The board question is no longer whether you have policies for those four doors. It is whether anyone has proved your defences hold when an adversary walks through one of them.
AI has not created new problems. It has industrialised a decade of unremediated ones
Richard Horne, NCSC CEO, puts it cleanly: “AI did not create these cyber security weaknesses; it revealed them. It exposed years of technical debt and the failure to implement even basic cyber protections, with technology and security investments too often deferred.”
The incident data matches the diagnosis. From the cases the NCSC handled, the finding is sharper still: “Sophisticated actors don’t have to be sophisticated to gain access.” Initial access stays ordinary. What follows is where capability shows.
That is the decade’s pattern. Familiar routes. Faster operators.
Cyber attacks carry consequences boards cannot park with IT
The review prices the problem. Malicious cyber activity costs UK organisations an estimated £14.7 billion a year, which the NCSC notes is equivalent to wiping out the UK cyber security sector annually.
The review’s case study is the 2025 attack on JLR. Suppliers tied to JLR’s production schedules took operational and workforce hits as the effects spread. JLR reported around £196 million in direct cyber-related costs. On the wider impact, the NCSC is direct: “The attack had a direct impact on GDP, contributing to the UK economy expanding by only 0.1% in Q3 2025 (lower than originally forecast).” One incident. Effects visible in the national accounts.
Treat cyber as a technical line item, and you misprice the risk. The board owns that mispricing.
Proving your defences hold means testing them. Attestation is not the same thing
The NCSC is not short of guidance. It is short of organisations that can show the guidance worked under pressure.
Boards and executives are told to “seek assurance not only that policies exist, but that they can demonstrate measurable improvements in preparedness, recovery capability and resilience outcomes.” Those are different asks. A scoped test run once a year against a predetermined list tells you whether certain controls exist. It does not tell you whether, on the day, your defences hold against an adversary operating outside that scope, on a timeline you did not choose.
That is why the NCSC is standing up its Cyber Adversary Simulation Scheme: reconnaissance-led testing against a determined adversary. Assurance of outcomes. Not a certificate on the wall.
The gap between organisations that invest and those that do not will widen
The forward look is precise. AI-assisted vulnerability discovery will throw out disclosures faster than manual patching cycles can absorb. “An approach based on discovering and manually patching every flaw cannot keep pace with machine-speed vulnerability discovery.”
The NCSC expects an influx of updates across severities, including critical ones. Plan for it now. Especially if your patch windows still assume human-speed disclosure.
It is also almost certain, in the review’s language, that “a widening digital divide will emerge between organisations able to adopt AI for defence and those unable to adapt.” Mature programmes will get stronger. Weaker postures, legacy estates and thin resource will fall further behind, becoming more attractive targets because of it. In regulated environments, that divide will show up first as who can evidence resilience under pressure, and who can only evidence paperwork.
Horne’s framing is the right one: act, and cyber security can be a source of strength; delay, and attacks get more frequent, more severe and more costly.
What leaders should ask this quarter
Knowing what good looks like has never been the gap. The NCSC has described it for a decade. The question is whether you spent that decade proving your defences work, or only assuming they do.
Three questions are worth putting on the next board or executive risk agenda.
- Who owns each of the four primary access routes, and when was each last tested outside a predetermined scope?
- What does it mean for this organisation if one of those routes is functionally undefended: in pounds, in customers, in regulatory exposure?
- Does your assurance programme show measurable resilience outcomes, or only that policies exist?
The future is not determined by the sophistication of the next attack. It is determined by whether you know your position before the attacker does.
