NCSC Annual Review 2026: What It Means for Your Business

The National Cyber Security Centre's yearly report is out, and its main message for UK businesses is a familiar one: attackers are still getting in through unpatched systems, weak passwords and kit that shouldn't be on the internet. The NCSC Annual Review 2026, published on Tuesday 3 November, covers September 2025 to August 2026. It is written mainly for security professionals and the public sector, so we've pulled out what matters for everyone else, from sole traders to larger teams.

Within hours of its launch, a real example was making headlines: refrigeration systems in UK food businesses had been tampered with over the internet. More on that below, because it shows the report's advice in action.

The NCSC Annual Review 2026 in numbers

Over the twelve months, according to coverage of the review by Insurance Business and The Next Web:

• 1,831 incident reports reached the NCSC, up from 1,727 the year before.
• 337 needed hands-on support from the NCSC, down from 429.
• 80 were classed as nationally significant, down from 204.
• 19,922 organisations are now signed up to its free Early Warning service, a rise of 52%, and it alerted 8,500 organisations to signs of a possible compromise.
• 110,000+ notifications and alerts went out after the PHP2Shell flaws, which we covered in our post on the critical PHP security release.

The fall in serious incidents sounds like good news, but the NCSC is clear that it isn't treating it as a trend, and warns that a sharp rise in the coming months is a real possibility. Government research quoted in the coverage puts the cost of malicious cyber activity to UK organisations at around £14.7bn a year.

Are attackers really that clever?

Mostly, no. The review includes seven lessons drawn from the 337 incidents the NCSC supported, and the thread running through them is that the way in is usually simple. Known vulnerabilities, internet-facing systems that aren't locked down, stolen logins and staff being tricked remain the main routes. The clever part, where there is one, tends to come after the attacker is already inside.

Three of the lessons are worth pinning to the office wall:

• Preparation decides how bad it gets. Businesses with logging, a response plan and an understanding of their suppliers recovered faster.
• Early action limits the damage. Some incidents never became serious because a warning arrived and someone acted on it.
• Ransomware is still the most disruptive threat, with data theft and long recovery times on top of the ransom demand.

NCSC chief executive Richard Horne opens the review with a stark line: "The UK enters 2027 at a watershed moment."

What about AI?

The review judges it highly likely that by 2028 states such as Russia and China will routinely use AI in cyber operations against the UK, and that AI-powered malware will be used in a ransomware attack on UK critical infrastructure. For businesses, the more immediate effect is what the NCSC calls a coming "patch wave": AI tools are getting better at finding old flaws, so expect more urgent updates, more often.

A real-world example: connected fridges

On Monday 2 November, refrigeration controllers in food businesses across Europe were remotely switched into defrost and had their temperature settings pushed up. The NCSC said the UK impact was minimal, with a small number of organisations affected, including some meat processing firms, according to ITV News and Al Jazeera. The reported route in was depressingly ordinary: management screens reachable from the open internet, in some cases still using factory default passwords.

You may not run a cold store, but most businesses have something similar: a CCTV recorder, a door entry system, a heating controller, a printer or a storage box like the Synology NAS devices in the ransomware attacks we covered last week. If it has a web login and nobody has checked it in years, it's the same risk.

What should UK businesses do now?

Six practical steps, in rough order of effort:

1. Sign up to Early Warning. It's free from the NCSC and tells you if your internet addresses or domains show signs of trouble.
2. List everything with a login. Routers, cameras, building controls, the NAS, the website. Change any default passwords and switch on two-step sign-in wherever it's offered.
3. Take things off the internet that don't need to be there. If a supplier needs remote access to a system, use a secure connection such as a VPN rather than an open web page.
4. Get updates on a schedule. With a patch wave expected, "when someone remembers" isn't enough. Replace equipment that no longer gets updates.
5. Use Cyber Essentials as your baseline. The NCSC treats it as the starting point. 47,661 certificates were issued in the year to August, up nearly 20%, and certified organisations are 92% less likely to make a cyber insurance claim. Funding is available to help eligible smaller firms with the cost.
6. Write a one-page response plan. Who do you call, how do you reach staff if email is down, and where are your backups? The NCSC has also published new guidance for boards on recovering from a highly disruptive attack.

If you'd like more ideas, our 10 cyber security tips for 2026 go into several of these in more detail.

How Blink Web can help

With 30+ years of combined experience, we help UK businesses of all sizes put the basics in place and keep them there:

• Managed cyber security: monitoring, patching and alerts so warnings get acted on quickly.
• Managed IT helpdesk: day-to-day support that keeps devices updated and default passwords out of your network.
• Networks and Wi-Fi: we can find what's exposed to the internet and lock it down.
• Security awareness training: helping your team spot the scams the NCSC says are still working.
• Free website security check: a quick look at the part of your business that's always online.

Want a second pair of eyes on what's connected in your office? Get in touch and we'll talk it through.

Sources: NCSC Annual Review 2026, NCSC: 7 things we learned, NCSC: Foreword from the CEO, Insurance Business: NCSC warns of rise in cyber incidents even as serious breaches fall, The Next Web: UK cyber agency warns of AI-powered ransomware on infrastructure by 2028, ITV News: UK meat processing firms hit amid fridge and freezer cyber attacks, Al Jazeera: EU urges action as Germany, Romania and UK report supermarket cyberattacks.