The NCSC Annual Review 2026 is the UK National Cyber Security Centre’s yearly account of the threats it saw and its work. The NCSC published the review of its tenth year on 3 November 2026. Its incident numbers are lower than in 2025: 337 incidents needed support, against 429. Its AI language is firmer, with a judgement that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI) between now and 2028.
This explainer defines the review, sets its numbers beside the 2025 edition, and shows what changed in its language on AI. Our own readings are marked as ours. The checklist near the end is our advice, not NCSC guidance.
What Is the NCSC Annual Review 2026?
The NCSC is part of GCHQ and calls itself the UK’s technical authority for cyber security. The review covers its tenth year and says that, as part of a national security agency, not all its work can be disclosed. It also says its incident figures do not tell the whole story.
- 1,831Reports of cyber attacks receivedSource: NCSC Annual Review 2026, incident management
- 337Incidents that needed support from the incident teamSource: NCSC Annual Review 2026, incident management
- 80Of those, classed as nationally significantSource: NCSC Annual Review 2026, incident management
- 8,500Organisations notified by the Early Warning service of a suspected compromiseSource: NCSC Annual Review 2026, incident management
The NCSC says incident reporting does not follow a simple year-on-year trend. It adds that peaks in earlier years were often tied to a small number of particularly significant incidents. It also says the scale of Early Warning notifications likely headed off some incidents before they needed NCSC support.
What Does the NCSC Annual Review 2026 Say About AI-Powered Ransomware?
The threat chapter names four trends: China changing the scale of cyber competition, cyber operations as a tool of state power, economic security, and technology advances. The AI claim sits under the fourth. The NCSC says it is highly likely that between now and 2028 AI-powered malware will have been used in a ransomware attack on UK CNI.
- ChinaChanging the scale of cyber competition
- State powerCyber operations used alongside diplomacy, economic pressure and military power
- Economic securityRansomware, data breaches and supply chain compromises cause economic harm
- Technology advancesAI, automation and computing power raise the speed and scale of attacks
The AI assessment page gives the reason. It says criminal use of AI will highly likely increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation. It adds that open source AI tools made for security researchers are likely to be repurposed by criminals.
The same page sets limits. The NCSC says human operators highly likely remain essential, and that AI is more likely to speed up existing methods than to run end-to-end attacks. Its incident team says none of the AI uses it observed enabled a novel class of attack.
The separate NCSC assessment page behind the 2028 judgement is covered in our post on the NCSC AI malware assessment for 2028. This explainer stays with the review itself and what changed since 2025.
How Do the 2026 Incident Numbers Compare With 2025?
The 2025 review covered 1 September 2024 to 31 August 2025 and was published on 14 October 2025. Our summary of the NCSC Annual Review 2025 lists its main findings. The table below sets the two incident pages side by side, with each figure as the NCSC prints it.
| Measure | 2025 review | 2026 review |
|---|---|---|
| Period covered | 1 Sep 2024 to 31 Aug 2025 | 1 Sep 2025 to 31 Aug 2026 |
| Published | 14 October 2025 | 3 November 2026 |
| Tips or reports received | 1,727 incident tips | 1,831 reports of cyber attacks |
| Incidents needing NCSC support | 429 | 337 |
| Nationally significant incidents | 204 (48% of incidents) | 80 |
| Highly significant incidents | 18 (4% of incidents) | Not given on the incident page |
| Early Warning notifications | Not given on the incident page | 8,500 organisations |
On these figures the NCSC supported fewer incidents in its tenth year than in its ninth, and fewer were nationally significant. Two cautions apply. The pages label the first row differently. The 2026 page does not define “nationally significant”, which the 2025 review defined as the upper three categories of the UK model.
The 2026 page does not say the threat fell. It says the cyber threat to the UK remains significant, with most successful attacks still exploiting familiar weaknesses. Its “7 things we learned” page lists known vulnerabilities, stolen credentials and social engineering as the usual routes in, and says ransomware remains highly disruptive.
What Changed in the Review’s Language on AI From 2025 to 2026?
In 2025 the NCSC said threat actors of all types used AI to improve existing tactics, not to create novel attacks. It said the most significant near-term development would highly likely be AI-assisted vulnerability research and exploit development. It pointed to its assessment of AI impact to 2027.
The 2026 text keeps the “existing tactics” message. It goes further in four places.
- It calls AI almost certain to act as a force multiplier across cyber threats, and moves the horizon to 2028.
- It says defenders and maintainers will highly likely face a race to shorten patch timelines before attackers build working exploits.
- It warns of a widening digital divide between organisations that can adopt AI for defence and those that cannot, and of risk from “shadow AI”.
- It adds a judgement the 2025 threat chapter did not contain: AI-powered malware in a ransomware attack on UK CNI.
The CEO’s foreword frames the cause. It says AI did not create these cyber security weaknesses, “it revealed them”. In the foreword’s words, the cyber threat has increased faster than the UK’s defensive capabilities.
Which Real Cases Does the Review Use as Evidence?
The review ties its judgements to dated cases. In July 2026 the NCSC and 18 international partners from 12 countries issued an advisory on FSB Centre 16 actors, who were exploiting vulnerable routers to target CNI networks worldwide.
On the same day the UK sanctioned 24 individuals and entities. The UK and EU states attributed a December 2025 attack on Poland’s energy grid to the same FSB unit. The review says that attack, had it succeeded, could have left 500,000 citizens without electricity.
On cost, the review cites UK government research putting the yearly cost of malicious cyber activity to UK organisations at an estimated £14.7 billion. It describes a 2025 attack on a UK car maker that caused prolonged production disruption, with about £196 million in direct cyber-related costs reported. It says the attack contributed to the UK economy growing by only 0.1% in the third quarter of 2025.
Our reading is that these cases show the review’s main point: sophisticated actors often enter through known, unpatched or exposed systems. AI is expected to speed that up. For one documented ransomware case in which Bitdefender saw both human and AI-like behaviour, see our analysis of the 3AM ransomware hybrid intrusion.
What Should Defenders Change After the Review?
The CEO writes that the tools, standards and frameworks to protect the UK from conventional and AI-powered attacks already exist. The challenge, in the NCSC’s words, is implementing them at scale. The review also asks organisations to prepare for a “patch wave”, a rush of software updates to address newly disclosed vulnerabilities. It links that wave to AI making flaws easier to find, and asks for updates deployed quickly, more frequently and at scale.
- Map what faces the internetThe review says threat actors routinely exploit known vulnerabilities in internet-facing systems. List every exposed service and give each an owner.
- Shorten your patch pathThe NCSC expects a wave of updates, some critical. Measure your time to patch for exposed systems and agree an emergency route for critical fixes.
- Cut reliance on passwordsThe NCSC points to wider use of passkeys in place of passwords to reduce the risk from stolen credentials.
- Rehearse recoveryNCSC guidance on recovering from a highly disruptive attack has three phases: the first hours, the first days or weeks, and the rebuild. Test your plan against them.
The order of these steps is ours. Our guides on vulnerability management and patch management cover the first two in more detail.
UK operators should also watch the regulatory side. The review says the Cyber Security and Resilience Bill will bring important new sectors into scope and add new national security powers. Our post on the Cyber Security and Resilience Bill in 2026 tracks where it stands.