Published 3 November 2026 | Last updated 3 November 2026

This post summarises the main messages from the launch of the NCSC Annual Review 2026 on 3 November 2026, including speeches by Dr Richard Horne, NCSC chief executive, and Baroness Lloyd of Effra CBE, Minister for Space, Cyber and Regulatory Reform at the Department for Digital, Culture, Media and Sport (DCMS).

Full review here: https://www.youtube.com/live/lIF757dunFY?si=Pgm0JD_8hryKbJHe 

Key takeaways from the NCSC Annual Review 2026 launch: AI did not create the UK’s cyber weaknesses, but it is exposing them faster. The NCSC said there is a real prospect of an unprecedented rise in incidents in the coming months, because vulnerabilities tolerated for far too long can now be found and exploited at scale. The answer is stronger foundations, leadership from the boardroom and using AI for defence faster than attackers can use it. The government also published a Cyber Essentials funding package, including a 75% discount on new certificates for eligible SMEs until the end of March 2027, or until funding runs out. 

What is the main message of the NCSC Annual Review 2026?

The launch opened with a short statement that sets the tone: “Artificial intelligence did not create those weaknesses. It has revealed them.”

Horne developed the point. The immediate cyber security risk from AI, he said, is not new. The coming rise in incidents will not be because AI has invented new ways to attack us, but because long-tolerated vulnerabilities can now be discovered and exploited at a scale and pace that was once unimaginable.

Baroness Lloyd described the review as a wake-up call rather than a victory lap. She said threats are evolving faster than many organisations are improving their defences, and set out the review’s central question: can we harness AI for cyber defence quicker than our adversaries can exploit it? She added that the review concludes the structural advantage will remain with defenders.

Why are old vulnerabilities now the biggest risk?

Because AI shortens the gap between a weakness existing and someone exploiting it. Horne said the UK has “got away with tech on the cheap” for decades:

• End-of-life systems kept running for one more year
• Upgrades pushed back in the name of cost efficiency
• Technology providers not investing in security by design and default
• Technology installed and then not invested in across its lifecycle
• Access granted where it was convenient rather than where it was necessary
• Services bought on price alone, without asking whether the underlying technology and operations were secure or resilient
• No monitoring in place to detect when things go wrong

These are not desirable features, he said. They are fundamental requirements.

Three examples came up:

• Known vulnerabilities left open. The NCSC issued over 110,000 proactive notifications and early warning alerts to UK organisations in response to the PHP vulnerability. Baroness Lloyd said the attack on French supermarkets came from exploiting known vulnerabilities, and pointed to poor cyber hygiene such as weak passwords.
• Supply chains. Horne said too many organisations and supply chains rest on weak technology and operational foundations.
• Operational technology. Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls are not seen as traditional IT, and their security is even more overlooked in investment decisions. Horne pointed to the recent disruption of refrigeration units across Europe as an example of the exposure being exploited.

Who is behind the threat?

Horne described the current picture:

• Russia: campaigns that deliberately fall below the threshold of armed conflict as it escalates hybrid warfare, alongside sustained attempts to penetrate UK military networks, as Sir Ken McCallum, Director General of MI5, warned in his October 2026 annual speech.
• Iran: still carrying out malicious cyber operations globally despite the Middle East conflict, including against the UK and individuals seen as a threat to the regime.
• Criminals: recent smash-and-grab ransomware attacks, with threats to publish stolen data to extort victims.
• China: highly likely to have the intent, and best positioned, to use AI against critical national infrastructure and other strategic targets. Horne called its activity the most sophisticated and sustained cyber challenge the UK faces.

AI, he said, may never mean us harm itself, but in the hands of those who do it becomes a force multiplier, increasing the speed and scale of adversaries’ operations.

How is AI helping defenders?

Both speakers stressed that the same technology can strengthen defence. Horne said AI is enabling vulnerabilities to be found and fixed faster than ever. Major technology providers are now fixing hundreds of vulnerabilities in a single update, and the Linux kernel project alone patched more than a thousand in the month before the launch.

Baroness Lloyd’s principle was simple: if attackers are going to use AI, defenders must use it too, and use it better. Announcements included:

• National Cyber Shield: a vision, developed jointly by NCSC and DCMS, for a national-scale AI-powered cyber defence capability that uses frontier AI to reduce and resolve national cyber risk at machine speed. Horne said the Chancellor backed it last week.
• National Agentic Security Unit: announced by Baroness Lloyd at the launch, backed by £4 million and housed at the NCSC, to detect, investigate and respond to cases involving agentic AI.
• National Exposure and Real-Time Vulnerability (NERV) Centre: will use AI to identify vulnerabilities across critical infrastructure and the economy.

What is the government doing next?

• • National Cyber Action Plan: to be published shortly, setting out how government and industry must work together to raise resilience across the economy.
  • Cyber Security and Resilience Bill: currently before Parliament, to establish a minimum level of resilience across critical national infrastructure.
  • Government Cyber Action Plan: the roadmap for central government and the wider public sector.
  • Cyber Resilience Pledge: over 200 organisations have signed so far, and Baroness Lloyd said more are needed.

  Baroness Lloyd was clear that the challenge cannot be solved by government alone, nor by industry alone. She said there can be no growth in every postcode without cyber security and resilience in every postcode.

What is the Cyber Essentials First Step Fund?

Baroness Lloyd said the government wants as many businesses as possible to adopt Cyber Essentials. She cited data showing certificate holders are 92% less likely to make a claim on their cyber insurance than those without one, and announced nearly £10 million to help small and medium-sized businesses take it up.

The government has since published its Cyber Essentials funding package. It has two parts:

• Cyber Essentials First Step Fund: a 75% discount on certification for eligible micro, small and medium-sized organisations seeking a new Cyber Essentials certificate. It runs until the end of March 2027, or until funding runs out. Organisations access the discount through IASME, and it still applies if they certify through a Certification Body.
• Cyber Resilience Pledge grant: a higher level of support for selected suppliers of Pledge signatories, with a fully funded Cyber Essentials certificate and tailored support from an NCSC-assured Cyber Advisor. It runs until the end of March 2029.

The funding covers the cost of assessment and, where it is passed, certification. It does not guarantee certification, and eligibility criteria apply.

What does Cyber Essentials cover?

Cyber Essentials checks that five technical controls are in place:

• Firewalls: a security filter between the internet and your network
• Secure configuration: setting up computers securely to minimise ways in for criminals
• Security update management: stopping criminals using vulnerabilities in software as an access point
• User access control: controlling who can access your data and services, and at what level
• Malware protection: identifying and stopping viruses and other malicious software

What did the NCSC ask organisations to do?

1. Horne’s vision of a resilient nation came down to these choices:

   1. Invest with urgency, and do not delay. In particular, replace end-of-life technology.
   2. Keep critical physical systems inaccessible to attackers.
   3. Make passkeys the norm.
   4. Treat security and resilience as a fundamental requirement, not an afterthought.
   5. Buy on resilience, not just price. Ask whether the technology and operations behind a service are secure.
   6. Take it to the boardroom. Baroness Lloyd urged leaders to use the Cyber Governance Code of Practice. Horne warned that leaders who do not make different choices now may one day have to explain to their investors, employees, customers and families why they remained “wilfully blind”.

What this means for your business: our take

Horne’s list of what the UK got wrong reads like a checklist of day-to-day IT management: systems past end of life, access granted for convenience, services chosen on price, and no monitoring. For most small and medium-sized businesses, the gap isn’t understanding the problem. It’s that nobody owns these jobs from one month to the next.

That is where a managed service provider helps. The work is routine and unglamorous: keeping devices and software supported and patched, reviewing who has admin access, configuring systems consistently, and monitoring for problems. It is also the groundwork behind the five Cyber Essentials controls, so businesses that run their IT this way are well placed to certify while the discount is available.

Frequently asked questions

Is this a summary of the NCSC Annual Review?
It summarises the main messages from the launch of the NCSC Annual Review 2026, including the speeches by Richard Horne and Baroness Lloyd of Effra. For the full findings, read the review on the NCSC website: [link].

What is the NCSC Annual Review?
It is the National Cyber Security Centre’s yearly review of the UK threat picture and its own work. The 2026 launch took place on 3 November 2026.

Is AI creating new types of cyber attack?
According to the NCSC, the immediate risk from AI is not new. AI is helping attackers find and exploit long-tolerated vulnerabilities at far greater speed and scale.

What is Cyber Essentials?
A government-backed scheme that helps organisations protect themselves against common online threats by putting five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.

Is there funding for Cyber Essentials?
Yes. The Cyber Essentials First Step Fund offers a 75% discount on a new certificate for eligible micro, small and medium-sized organisations. It runs until the end of March 2027 or until funding runs out, and is accessed through IASME. Eligibility criteria apply, and the funding does not guarantee certification. See the GOV.UK funding package.

What is the National Cyber Action Plan?
A forthcoming government plan setting out how government and industry will work together to raise cyber resilience across the economy. It had not been published at the time of the launch.