Blog · NCSC Annual Review
AI didn't create your weak spots. It's finding them.
The NCSC's 2026 review says attackers still get in through old flaws and weak sign-in. What that means for UK firms, and the exemptions to remove first.
The National Cyber Security Centre (NCSC) published its tenth annual review last week [1].
The headline for most UK firms isn't new technology. Most successful attacks still rely on known flaws, weak credentials and people being tricked [2]. What has changed is speed. Artificial intelligence (AI) helps attackers find those gaps faster and at greater scale.
The NCSC's chief executive put it plainly: we face more incidents because flaws "tolerated for far too long" can now be found and used at scale [1]. He also said that for decades we have "got away with doing tech on the cheap" [1].
The UK government's own survey agrees. Phishing is still the most common attack, reported by 38% of businesses [3].
So the question for a board isn't "what's our AI strategy for security?" It's "which weaknesses have we been tolerating?"
In my experience, the answer is often sitting at the top of the organisation.
In 2023 I was acting chief information security officer (CISO) at a UK financial services firm. For years, the senior team had been excused from multi-factor authentication (MFA). The head of the firm had an assistant manage their sign-in. The service desk knew the executives' passwords [4].
The exemption protected them from inconvenience, not from attack. It made them the easiest way in.
We didn't force a clumsy process on them. We replaced it with sign-in that was simpler and much harder to defeat, then applied it to everyone, with no exceptions [4].
Your exemption list is an attacker's shortlist. AI just reads it faster.
What to do this week
- Ask for the exemption list. Who is excused from MFA, password rules or device checks, and who approved it? Every name needs a reason and a review date.
- Start with the people who can move money or data. Directors, finance staff and IT administrators should be first in line for phishing-resistant sign-in, such as passkeys or security keys. The NCSC is promoting passkeys as the replacement for passwords [2].
- Patch what faces the internet first. Firewalls, remote access and anything a supplier connects to. These are the known flaws AI-assisted attackers look for.
- Sign up for the NCSC's Early Warning service. It's free, and it tells you when the NCSC sees signs that your systems may be compromised [2].
Read more
Sources
- [1]National Cyber Security Centre, Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years, 3 November 2026. https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
- [2]techUK, NCSC Annual Review: the state of the cyber nation, 4 November 2026. https://www.techuk.org/insights/news/ncsc-annual-review-the-state-of-the-cyber-nation
- [3]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- [4]CyberCQR, Simpler and stronger: fixing sign-in from the boardroom down (case study), 2 November 2026. https://cybercqr.com/papers/case-study-simpler-stronger-sign-in/