This list selects the main cyber threat findings from chapter 1 of the NCSC Annual Review 2025, which covers 1 September 2024 to 31 August 2025 and was published on 14 October 2025. It is not a ranking. The NCSC says it handled 429 incidents, 204 of them nationally significant, and it names China, Russia, Iran, the DPRK, ransomware, AI and cyber proliferation.
How was this list chosen?
The NCSC is part of GCHQ and calls itself the UK’s technical authority for cyber security. The review covers its ninth year. We selected the headline threat and incident statements in chapter 1, “Countering the cyber threat”, and its sub-pages on incident management and “Beyond detection”. The order follows the chapter.
Two limits come from the NCSC itself. It says not all its work can be disclosed publicly. It also says reporting a breach is not mandatory for many businesses, so its data is not a true reflection of the number of cyber incidents that affect the UK.
How many incidents did the NCSC handle in 2024 to 2025?
The NCSC incident management team received 1,727 incident tips and triaged them into 429 incidents that needed its support. The NCSC says this is a similar total trend to the previous year. The change is in severity.
- 1,727Incident tips receivedSource: NCSC Annual Review 2025, incident management
- 429Incidents requiring NCSC supportSource: NCSC Annual Review 2025, incident management
- 204Nationally significant incidents (48% of all incidents)Source: NCSC Annual Review 2025, incident management
- 18Highly significant incidents (4%)Source: NCSC Annual Review 2025, incident management
The NCSC says nationally significant incidents are 48% (204) of all incidents, up from 89 last year. On its “Beyond detection” page it describes them as up by 50%. It also says highly significant incidents rose almost 50%, the third consecutive yearly increase.
| Measure | 2023 to 2024 | 2024 to 2025 |
|---|---|---|
| Total tips | 1,957 | 1,727 |
| Incidents handled | 430 | 429 |
| Highly significant and significant | 89 | 204 |
| Of which highly significant | 12 | 18 |
The NCSC links part of the rise to the exploitation of vulnerabilities by a small number of cyber actors. Three vulnerabilities for which it published alerts were associated with 29 incidents it managed.
Which state threats does the NCSC name?
China
The NCSC calls China a highly sophisticated and capable threat actor. In September 2024 it and allies exposed a botnet of over 260,000 compromised devices, linked to Flax Typhoon. In August 2025 it co-sealed an advisory linking three China-based companies to a campaign against foreign governments and critical networks, partially overlapping with campaigns reported most commonly as Salt Typhoon.
Russia
The NCSC says Russia’s most disruptive activity is focused on Ukraine. It describes Authentic Antics malware, which steals login details and tokens to give long-term access to email accounts. It also reports a growing number of pro-Russia hacktivist groups that choose targets, including CNI sectors, based on what is vulnerable.
Iran and the DPRK
The NCSC assesses that Iranian cyber activity highly likely extends to UK entities. For the DPRK, it says UK firms are almost certainly being targeted by IT workers disguised as freelance third-country IT staff, and UK cryptoasset firms are highly likely at risk.
Why does the NCSC call ransomware acute?
The NCSC says ransomware remains one of the most acute and pervasive cyber threats to UK organizations. It cites the attacks on Marks & Spencer, the Co-op and others in retail, as covered in our note on the UK retail attacks. It says most criminals are sector agnostic and pick victims they believe:
- are most likely to pay a ransom
- are vulnerable to operational downtime
- hold sensitive data that would cause significant harm to UK citizens if leaked
The top sectors reporting ransomware to the NCSC were academia, finance, engineering, retail, health and manufacturing, though it says no sector is exempt. Despite the 2024 disruption of LockBit, it says the threat remains high. For CNI, it says DragonForce attacks left customers unable to make payments and saw the data of all 6.5 million Co-op members stolen. It also detected hacktivist activity shifting to low-skilled attacks against OT systems. For the wider picture, see our UK threat landscape post and the ransomware trends report.
What do AI and cyber proliferation add?
The NCSC says threat actors of all types use AI to enhance existing tactics, not to create novel attacks. Actors linked to China, Russia, Iran and the DPRK use large language models for tasks such as reconnaissance and exploit development. It expects the most significant near-term AI development to come from AI-assisted vulnerability research and exploit development.
It also says the commercial cyber intrusion sector will almost certainly expand over the next five years. At the second Pall Mall Process conference, in Paris in April 2025, 26 states signed a Code of Practice. The NCSC also says there is likely an increasing number of smaller entities, vulnerability researchers and exploit developers, working in collaboration with other specialist entities.
What does the NCSC say organizations should do?
The NCSC’s own advice in these pages is short. It treats incident reports in confidence and encourages affected organizations to report to regulators.
- Report the incidentUse the signposting service at gov.uk/report-cyber to find where to report.
- Check personal dataA personal data breach may need to be reported to the Information Commissioner’s Office.
- Use the ransomware guidanceNCSC resources cover mitigating attacks and how to recover.
- Share threat insightThe NCSC asks for sharing communities that are deeper, faster and more actionable.
Some checks follow from these facts. A CISO can ask whether the organization knows where to report an incident and whether a ransomware recovery plan exists. An incident response team can ask whether it takes part in a sharing community. The NCSC itself asks: what more can we do to understand threat collaboratively, and at the pace we need to?
To go further, read the UK Cyber Security and Resilience Bill and the 2027 threat intelligence priorities.